Back to News
Advertisement
Advertisement

⚡ Community Insights

Discussion Sentiment

69% Positive

Analyzed from 3674 words in the discussion.

Trending Topics

#ubuntu#linux#windows#https#gnome#com#snap#debian#kde#things

Discussion (119 Comments)Read Original on HackerNews

teekertabout 4 hours ago
It's nice as always, but I have some issues.

* Select - Middle-click paste does not seem to work

* When something requires a password (ie just tried a bitlocker volume) the whole screen is blocked, so no password manager for you (unless you copy it before, or cancel - unplug drive-copy password - replug drive - paste.)

* The default tiling does not jive with me, sometimes I don't even know what it wants (it always tries to force you to also set a left windows if you tile right and vice versa) so I disabled it `gnome-extensions disable tiling-assistant@ubuntu.com`. Default Gnome tiling is ok (but missing quarter tiling (and 1/8th would be nice on my ultra-wide) imho so I use [0]

* I've been trying to use Nix home-manager for packages but I have GPU errors, need workarounds, icons that just remain generic. But I guess that is not Ubuntu's fault.

Ubuntu remains my nr. 2 choice, after NixOS (but I didn't get the latter to install on this Nuc, perhaps a bios update will help).

The installer offered (under experimental) to run root on zfs, I didn't end up selecting it because only on the forth try (and by that time you're clicking at a fast rate just taking defaults) I understood that it would only download packages via wifi, not the cable (same for NixOS installer, so must be my network).

[0] https://github.com/troyready/quarterwindows

WD-42about 4 hours ago
Select middle click not working is a stupid decision from GNOME to disable in 50. You can turn it back on with the tweak tool.
PaoloBarboliniabout 3 hours ago
Why do we still put up with GNOME?

I've spent the last 10 years off and on from Linux. Had I used something other than GNOME, I believe my experience would have been better.

I've been on KDE for the last 3-4 years and things work so well I could never imagine going back to GNOME.

jhoechtlabout 2 hours ago
I find it hilarious how much religion is put into Gnome vs. KDE in this case. I did use both. I honestly have no strong favourite. After that many years of Linux desktop environment DE hopping I came to the conslusion that the DE should get out of your way and allow you to focus on your work.

Both Gnome and KDE support that. Actually Gnome a tad better as it gives you less knobs to turn an waste your time. Accept the defaults and if defaults are bad move somewhere else.

SkiFire13about 2 hours ago
> Why do we still put up with GNOME?

Because maybe not all people have the same preferences as you?

reacwebabout 2 hours ago
I think power users are not the main target of Ubuntu.

I have put my parents on Ubuntu (gnome) in 2013 to replace windows XP. My mother is 88 now. I think it is the perfect fit for her (dad is dead years ago).

I use ubuntu gnome because tweaking my computer is not where I want to spend my time. YOLO. Using a "mainstream" desktop that can be explained to "non specialist" has its benefits. I accept to suffer some annoyances and there is always a way to fix the most annoying ones by sacrificing time.

XorNot12 minutes ago
Because Cinnamon exists and has a delightful commitment to functional minimalism.
rawoke083600about 2 hours ago
Been a long time i3 user. Usually works well if you put in the initial time. But of late been very happy with Xubuntu (xfce)
_blkabout 1 hour ago
Glad you like yours. I like (Vanilla) Gnome + PaperWM.

But seriously why would they disabled the middle mouse copy paste buffer by default? Anyways, gnome tweaks to the rescue I guess

teekert19 minutes ago
THANX! I don't know how people live on platforms that don't have this :)

As for the negative Gnome feedback (not from you but others) I do like Gnome, it's just enough window manager for me, I like the defaults and I like the touchpad gestures etc. Generally looks and works well for all I do. I always feel swamped by KDE.

littlecranky67about 2 hours ago
It is a preference - and not everyones. I always hated middle click paste, middle click is amongst the first thing I remap on my systems to do the macOS "exposé"-style of window rearrangements. Other people will have other preferences.
sphabout 2 hours ago
I suppose you use Super+Middle Click? Not a bad idea, I dislike hot corners, and the "exposé" feature of niri is quite good. I might actually remap it to Super+Middle Click.

(I use Super+side mouse buttons to move between workspaces, I hate the keyboard-centric workflow when one hand is always on the mouse)

jl6about 3 hours ago
Did they publish some rationale somewhere? It’s a useful feature.
nine_kabout 3 hours ago
Neither Windows nor macOS have it, so it's surprising to new users. If your target market (as in support contracts) is EU public servants, it's sort of understandable.
Gigachadabout 4 hours ago
Probably changed to work the same as macos. Not sure if windows does middle click paste.
NekkoDroidabout 4 hours ago
> Not sure if windows does middle click paste.

It doesn't. X was the only place I know of where that was a thing.

Sol-about 3 hours ago
Jesus, do the people who work on GNOME even like Linux?
LtWorfabout 3 hours ago
In Icaza's case I think he just always wanted to work for Microsoft. I don't know about the less famous developers though.
LtWorfabout 3 hours ago
> * Select - Middle-click paste does not seem to work

They did it on purpose for some reason. If I were you I'd give Plasma a try.

dotancohenabout 3 hours ago
Plasma, meaning KDE.

I've been using the Kubuntu 26.04 prereleases for a few weeks. No surprises from KDE, but Wayland has broken a few things. Autotype in Keepass does not work, keynav and even the Wayland keynav forks don't work, and Wayland does not support priority keyboard layouts for switching between two specific layouts.

LtWorf10 minutes ago
It's called plasma now :) KDE is the association, the desktop is plasma.

I still mostly use Xorg though, I only have wayland on a tablet.

hnuser123456about 4 hours ago
throwa356262about 3 hours ago
That was a lot of CVEs

Goes to show that not all security bugs are memory related bugs

sphabout 2 hours ago
Not aimed at you but... no sh*t. The "Rewrite it in Rust" community never heard of the second-system effect.

I'd rather use something written in a crappier language that has been battle-tested for decades, personally.

nine_kabout 3 hours ago
Indeed, many bugs are API usage bugs, something that no language can verify. (The API is implemented in C anyway.)
IshKebababout 2 hours ago
No, but some languages make designing difficult-to-misuse APIs a lot easier than others.
IshKebababout 2 hours ago
I wish they'd put the severity. There are 4 highs, the rest are medium or low. Here are the high ones:

https://www.cve.org/CVERecord?id=CVE-2026-35338 - `chmod --preserve-root` can be bypassed. That doesn't seem that bad tbh.

https://www.cve.org/CVERecord?id=CVE-2026-35341 - `mkfifo` accidentally resets the permissions of files that already exist, so if you manage to do `sudo mkfifo /etc/shadow` then it becomes world readable.

https://www.cve.org/CVERecord?id=CVE-2026-35352 - TOCTOU in `mkfifo` lets you do the symlink trick to get it to change permissions on an unrelated file.

https://www.cve.org/CVERecord?id=CVE-2026-35368 - You might be able to get chroot to execute arbitrary code.

Tbh I doubt if any of these would ever result in a real hack, unless your system is doing really mental things like running shell scripts with untrusted input.

I could only find a couple of CVEs that looked actually serious for GNU Coreutils too though. IMO if you're using these tools with untrusted input your system is janky enough that there are going to be serious flaws in it anyway. Probably though quoting mistakes.

collinfunkabout 2 hours ago
Well the TOCTOU issues do not require you to run untrusted scripts to be exploited. Another user on your system can use a legitimate command that you may run to make changes to files they shouldn’t be able to, or further escalate privileges.
Pay0823 minutes ago
Not to mention sudo-rs.
LtWorfabout 3 hours ago
I think this should be the real news.
jklmnopqrstuvwabout 3 hours ago
Ubuntu 26 + KDE Plasma 6.6 perfectly handles high-DPI scaling for me. I was originally planning to buy a Mac, but luckily I saw the news about Ubuntu 26 being released a few days ago.
abrookewoodabout 3 hours ago
I've just moved to a Mac for the first time, after using Windows for work for decades and Linux as my primary desktop for about 3 or 4 years. It certainly takes some getting use to: - Keyboard shortcuts are all different - Doesn't seem to like my Microsoft ergonomic keyboard (lots of keys do nothing) - I really hate the dock - Limited customisation on the menu bar - I also hate the universal menu thing / menu bar in general ... I run a really wide monitor and having to go all the way to the left hand side to access the menu when working on an app that is on the far right is crazy - Fonts look fat or washed out

I am sure a lot of this is fixable and will jsut take time to get used to, but honestly, at this point, I think I prefer ubuntu/linux to both Mac & Windows at this point.

I do love the hardware on the Mac and would probably try Asahi out if it wasn't a work machine.

Also worth pointing out that macOS is still better than Windows 11 at this point - MS should be ashamed at what they did to that OS.

rswailabout 1 hour ago
As a both old Linux and now decade user of MacOS, after I got used to no middle-click paste and no focus-follows-mouse:

1. Keyboard shortcuts are Emacs, Ctrl-A: start of line, E: end of line, K: kill selected or to end of line, Y to paste, etc. https://support.apple.com/en-au/102650#text

2. Karabiner elements (FOSS) fixes keyboard mappings outside of the Settings: https://karabiner-elements.pqrs.org/

3. I have the dock on the left hand side, not bottom and I have a 2 monitor (iMac 5K 27"+ Dell 4K 27") setup with the iMac flat in front of me and the curve/2nd to the right. Menu bar is then close to the main windows.

4. Menu bar widgets etc are fixable with thaw https://github.com/stonerl/Thaw

5. Window management via keyboard is fixable with rectangle https://rectangleapp.com/

6. Use Macports to add all the Linux/Unix utilities, works with MacOS properly (eg Python/Java frameworks). Ports can have variants, plus you can have multiple versions installed side-by-side with `port select`. https://www.macports.org/

Not sure about fonts, on a 5K iMac they're fine and the 4K Dell works too. You need to use a resolution that fits with Mac's ideas of resolution, so I've got the 5K and 4K both at 2560x1440, which is Mac's idea of 2x resolution.

rswailabout 1 hour ago
Another point, if you enable Settings > Desktop & Dock > Mission Control > Displays have separate Spaces, then you get a menu bar for each display, which helps with the menubar / window being far apart.

That doesn't work with a single monitor though.

IshKebababout 2 hours ago
> I am sure a lot of this is fixable

It is - sucks that you have to though. For keyboard shortcuts use Karabiner Elements.

compounding_itabout 4 hours ago
Ubuntu LTS is still the choice for many production environments and education and learning. As someone with Ubuntu from 2010 CDs, I find it refreshing that modern Ubuntu distros work OOB on most computers these days with excellent driver support.
alprado50about 3 hours ago
Is this even true? I mean, Windows is the main focus for all hardware vendors, and everybody who has owned a PC knows that malfunctions are unavoidable. If that is the case for Windows, then Linux cant be better.
michaeltabout 1 hour ago
There's working, and there's working.

20 years ago your Linux installation might not include wifi drivers, bluetooth support, decent GPU drivers, fat32/ntfs drivers, or the widely used video/audio codecs of the era. And you had to be careful when shopping for things like wifi cards, as only certain chipsets could be made to work.

Much of which was kinda fair enough, because if you're a volunteer making an open source OS because of a strong belief on the open source ideal, you don't want to distribute closed-source driver blobs or patent-encumbered codecs. But it meant mean the initial installation process was not always easy. One of the things that contributed to the success of Ubuntu was a particularly easy initial setup process.

Today, things are a lot better - you'll still get unsupported hardware from time to time, but it'll be much less severe. If your laptop has a non-USB integrated camera you might have to download and install a kernel module. Your corporate laptop's built in fingerprint scanner might not work, but who cares?

dmos62about 2 hours ago
Linux has been better for old hardware since early 00s. Just don't expect hw acceleration to work for older GPUs.
Joel_Mckayabout 3 hours ago
Windows 11 set a low bar to clear... Most popular hardware will work on linux, but like always its better to check before your buy.

Distro like Ubuntu are a fair compromise to get amd/nvidia GPU drivers, wifi, and brother laser printer/scanner networking installed. =3

edit: seriously, why down vote the guys karma if its a honest question. Try to be kind people.

ButlerianJihadabout 2 hours ago
https://www.lenovo.com/us/en/glossary/linux-standard-base/

When I was shopping Lenovo.com for my ThinkPad in 2018, there was a table with ThinkPads certified for Ubuntu Linux in one column, and certified for Red Hat Enterprise Linux in another column.

I chose the T580 as a RHEL-certified notebook, and it was fantastic. Lenovo.com let me configure each individual component exactly according to my needs and tastes, and it was custom-assembled and shipped from Shenzhen.

It did arrive with Windows 10 pre-installed (this was the least hassle and most popular OS option). I initially installed CentOS, but quickly realized that Fedora would be the sweet spot, and so it was a Fedora system for most of its lifetime. Near the end, I did revert to Windows 10, which also worked flawlessly.

The ThinkPad T580 literally never malfunctioned. It was still 100% working when I turned it in for recycling in 2025.

I've also run Ubuntu on my "daily driver" desktop system, which ran from 2006-2022. Yes, that's 16 years' worth of Ubuntu installs and upgrades. It was mostly a KDE Plasma (Kubuntu) system. I enjoyed every bit of that.

In 1999, I was avidly using OpenBSD on really old hardware (such as HP Apollo 425t workstations.) OpenBSD simply couldn't deal with the special graphics subsystem on those machines. I tried and tried to get something working, but there were obstacles, not only with the hardware and drivers, but also the monitor connection needed a particular type of cabling and a proprietary monitor, too.

However, OpenBSD did great for networking, security, Squid cache, proxies, all kinds of things. And even in 1999, though it was early, I ran Linux on a 386DX-40, because Linux supported the "ftape" floppy tape driver at that time, and I had some kind of QIC tape backup from Eagle that wouldn't be recognized by OpenBSD or NetBSD.

Meanwhile, in that same year, my "daily driver" desktop machine was a 486 with VLB, dual-booting Windows 98 and OpenBSD. The Windows 98 was set up with a Cygwin system and X11 server, so that I could run X11 clients on the OpenBSD machines, or the Linux machine, or whatever else was on the LAN.

abrookewoodabout 3 hours ago
Windows is a dumpster fire at this point. Just unusable
satvikpendemabout 4 hours ago
What should I use if I like Ubuntu but not snap, just Debian? Or are there alternatives around? Seems like Ubuntu has the best hardware and driver support so just curious what's new in Linux land.
amelius9 minutes ago
If you're using Ubuntu on Jetson then you're out of luck. That platform is tied to Ubuntu.
jwrallieabout 4 hours ago
Now Debian is packaging non-free drivers in the iso images directly. I would suggest to try Debian first, if it works well for you just keep it.

If you feel the need for newer packages, try other alternatives (or Debian unstable). I’ve set down on Fedora with XFCE, it’s really stable yet packages feel new.

beAbUabout 1 hour ago
Just don't use snap. No need to throw out the baby woth the bathwater.
bluGill20 minutes ago
Problem is most things are only snap. You can get them ocherwise but not by default
notabotiswearabout 4 hours ago
You can de-snap Ubuntu itself.

Dunno about the this release, but till 24.4 it was simply a matter of removing some packages then holding/masking the primary snapd one, followed by manually adding the official PPAs for Mozilla’s stuff (or just use the Flatpak).

Of course, there’s still the philosophical and long term issues with staying on a distro that’s promoting and continuosuly expanding the thing you dislike…

LtWorfabout 3 hours ago
This is what I do, because on my work computer IT imposed Ubuntu.

I initially tried to just use snaps but firefox was crashing quite often so I had to go with adding the mozilla's repository and of course configure the fake "firefox" package that actually installs the snap to be low priority for apt.

dima55about 4 hours ago
Debian is great, and is where the distro development actually happens. What doesn't it do that you want?
ntoskrnl_exeabout 4 hours ago
I’m curious about proprietary Nvidia drivers. Ubuntu normally comes with fairly outdated, if not obsolete ones, but there’s a semi-official PPA with more recent versions. How does Debian handle this?
dima55about 4 hours ago
Debian has their own nvidia driver packages (it's nvidia's drivers repackaged in a nice way that integrates with the system well). I can't say if they're "outdated" or how different they are from what ubuntu ships, but they've always worked very well for me.
tormehabout 4 hours ago
I think Pop does Nvidia well, but have no real experience with that.
gsprabout 2 hours ago
You can get an overview of that status by looking at the "version" box on https://tracker.debian.org/pkg/nvidia-graphics-drivers
ErroneousBoshabout 1 hour ago
> Ubuntu normally comes with fairly outdated, if not obsolete ones

Ubuntu 24.04 currently comes with 590, which is the most recent working driver.

forestoabout 2 hours ago
I switched to Debian and have been happy with it. The release cycle is less frequent than Ubuntu Desktop, which means fewer disruptions, and Debian Backports make it easy to pick new versions of the important stuff. Flatpak is also available on Debian.

Linux Mint is widely praised for being basically Ubuntu without the worst Canonicalisms (such as Snap). They maintain a Debian edition in parallel to their main one, as an exit strategy in case Ubuntu ever becomes unsuitable for their base. Some people already use that as their daily driver.

Just in case you're not aware, the default desktop environment on whatever distro you pick doesn't have to be what you use. I switched to KDE Plasma when Gtk-based desktops became intolerable, and haven't looked back.

throwaway2056about 4 hours ago
Just install Ubuntu and remove snap. We are doing this for our University pool etc and encountered no issues.

Make a list of all ppa before proceeding.

What is your use case?

satvikpendemabout 4 hours ago
The issue is them adding it back, sometimes even on apt upgrade, or silently installing it as a dependency for certain apps without mentioning it unless you look closely. That gets tiring after a while and I gave up on Ubuntu as even after having removed snap multiple times it always returned.
evdubsabout 4 hours ago
This is my experience, too, and my solution has been to run Debian.
leni536about 1 hour ago
Did you pin the package's priority or just apt removed it?
throwaway2056about 4 hours ago
Never happened in the last several years.
evdubsabout 4 hours ago
Doesn't snap come back on the next OS upgrade?

I was using Ubuntu and installed the apt version of Firefox as the snap version would not open html files in locations like /var/tmp and would not work with USB devices. Every time I ran `do-release-upgrade`, all of that work would need to be redone. It was very annoying.

flakeoilabout 3 hours ago
I have a year ago switched from Ubuntu to Fedora and I like it. Clean and stable. Uses Flatpak. I'm using Fedora Workstation which is the default, but Fedora KDE Plasma seems to be nice as well if you want to have more configuration options available directly in the GUI. And the layout is more Windows like with start button menu etc for people coming from the Windows side.
pezgrande25 minutes ago
I think snap is not preinstalled in Kubuntu.
vanc_cefepimeabout 4 hours ago
I distro hopped for a while and settled on Linux mint. Uses flat packs. Hits the spot for easy to use and easy to maintain without needing to use terminal scripts to get things my way. Just my opinion.
prmoustacheabout 1 hour ago
> Seems like Ubuntu has the best hardware and driver support

It is an urban myth

newtwentysixabout 3 hours ago
I was in the same spot recently, and my friends recommend Linux Mint. It is built on top of Ubuntu LTS, and no snap. I've been using it for the past few weeks in my old desktop computer. Definitely Good. Perfect fit for your needs
compounding_itabout 4 hours ago
PopOS
bboozzoo28 minutes ago
Isn't that essentially a release of Ubuntu with a different kernel, DE and maybe some userspace utilities?
satvikpendemabout 4 hours ago
This looks like it might be the best solution, no snap, maintained by an actual system integrator and laptop maker, and I also like the new Rust-based desktop environment. I wonder how well it runs on Framework laptops or MacBooks as well.
compounding_itabout 4 hours ago
Runs great on framework. Not sure about COSMIC on asahi.
nreeceabout 2 hours ago
Linux Mint.
troupoabout 3 hours ago
Gaming-oriented distros like CachyOS and Bazzite might be what you want. I'm on Cachy and can recommend it. Because they try to "just work" without jumping through hoops.

Even though I very much intenseley dislike the completely unintuitive idiosyncratic package management that Arch has. Which is further not helped by the fact that Cachy's default GUI for it isn't even integrated properly.

manvel_hnabout 4 hours ago
I hate snap as well. Use flatpak and KDE on Ubuntu. Never have been happier.
bashtoniabout 5 hours ago
Also green light for Fedora 44 release on 28 April

https://meetbot.fedoraproject.org/meeting_matrix_fedoraproje...

wao0uunoabout 1 hour ago
Cool. I'm pretty excited for the new login manager. Maybe now KDE will be able to fit all customization options (wallpaper, lockscreen, login screen) on a single Settings page.
egorfineabout 2 hours ago
Unfortunately they forgot to remove Rust coreutils and sudo-rs from Ubuntu prior to releasing 26.04.

I am starting to suspect this even might be intentional.

Joel_Mckay37 minutes ago
Those packages can simply be reverted like dracut, at least for a few months of testing.

And yes, using a user-base as Beta testers is fairly cheeky. =3

scorpioxyabout 2 hours ago
After using Ubuntu for many years both on the desktop and server, recent decisions have got me thinking that Canonical has lost a lot of its community spirit. That got me switching over machines to Debian which, to me, still feels like a community project. It's a shame.

I am pragmatic about it though so I still run Ubuntu for some things but it's no longer my first recommendation.

ErroneousBoshabout 1 hour ago
> recent decisions have got me thinking that Canonical has lost a lot of its community spirit

The rot set in when #ubuntu on Freenode (now Libera) became rigidly enforced as on-topic discussions of Ubuntu support only.

The channel is absolutely dead now. Maybe one person will say something in any given 12-hour period and no-one replies, just page after page of joins and parts.

azalemethabout 4 hours ago
I know that the interim releases had issues with zfs and trying to update gave the message "Sorry, cannot upgrade this system to 25.04 right now System freezes have been observed on upgrades to 25.04 with ZFS enabled. Please see https://wiki.ubuntu.com/PluckyPuffin/ReleaseNotes for more information. "

The release notes don't seem to mention zfs. I hope these issues have been fixed?

throwa356262about 4 hours ago
I am thinking of testing one of those AMD Ryzen AI laptops for development and local LLM. These come with win11 copilot+.

How well does 26.04 with the 7.0 kernel support these? Can it, say, use their GPU and NPU for compute out of the box?

notLayz99about 3 hours ago
Kindly keep us updated with your findings. Please also let me know where you publish it. Thanks
superkuhabout 5 hours ago
The comments there note there is no official Ubuntu MATE release for the first time since Ubuntu 15 (and before 14.04 gnome2 was an option). That's a shame but probably most people who chose MATE (or gnome2) no longer chose Ubuntu due to the conflicting ideologies inherent in the two. MATE users generally don't like change for change's sake.
razingedenabout 5 hours ago
its in the daily builds. I haven't tried it yet.

not sure if this confirms the impression you have there... I wasn't like this until a couple of headless VPS'es (on Arm8) got through the upgrade from 18.x -> 20.x -> 22.x and then crashed out over -> 24.x for a still unknown reason. now I'm just afraid .. or I should say reluctant ..to repeat that whole fiasco.

https://cdimage.ubuntu.com/ubuntu-mate/daily-live/current/

Joel_Mckayabout 3 hours ago
There were some issues with how the menu icon manager handled the new security policy defaults. This means the editor will break, and the displayed menu may be missing any item that didn't follow the naming convention syntax. Its a lot of packages to bring into compliance, for that one silly feature the devs had to put in before it was ready...

Maybe they fixed it since the rc release, but there were some rough edges in Feb... the kernel USB support cooked the thumb drive partition structure.

In 22.04 to 24.04 the kernel Nvidia GPU driver EOL abandonment began... In 26.04 people will discover most EOL hardware support prior to RTX series will be difficult to bring up.

Probably wise to wait a few weeks for the bug reports to clear out a bit. =3

Advertisement
rasenganabout 5 hours ago
> TPM-backed full-disk encryption

This is going to be very useful for servers hosted in third party DCs.

Davieyabout 4 hours ago
Keeping the key in the same room as the padlock only protects against casual drive theft and secure disposal.

Personally I'm more worried about someone stealing the entire server or a local threat actor.

Sure, keep TPM to help with boot integrity, maybe even a factor for unlock, but things like Clevis+Tang (or Bitlock Network Unlock for our windows brethren) is essential in my opinion.

djkoolaideabout 4 hours ago
The beta installer was completely unsuccessful in setting the TPM-backed disk encryption on both a ThinkPad X1 Carbon (Intel 258V) and a ThinkPad P14s (AMD 300-something). Hopefully they ironed that part out in the release, but it seems still early for this feature (at least for my comfort level).
nechucheloabout 4 hours ago
Same on my Framework Desktop. Looks like it works only with a limited number of TPM chips for now.
bboozzoo40 minutes ago
The constructed policy is quite strict and expects certain UEFI things to be set up correctly. For example both this https://github.com/canonical/secboot/blob/7434bac27844362ff8... and https://github.com/canonical/secboot/blob/7434bac27844362ff8... are enabled in the policy. The policy choices and various early checks, even as trivial as confirming that the TCG log content is correct after booting into installation system, are enough to rule out a lot of potentially problematic EFI deployments. Effectively making it more strict helps avoid a lot of funny issues where the firmware is clearly buggy and things would fall apart sooner or later.
Gigachadabout 4 hours ago
I want this on my own homeserver. Protection against someone stealing the server without requiring me to type a password every boot.
zenopraxabout 4 hours ago
In what way is TPM protecting your data if someone steals the entire server? TPM only ensures that the boot environment has not been modified. Whatever key is being used to automatically decrypt the disk would be in the clear.

Unless I'm misunderstanding your situation, I think you should look up the "Evil Maid Attack" to better understand how to mitigate risk for your threat model.

hfjtnrkdkfabout 2 hours ago
assuming there are no bugs in linux and you enable full memory encryption in BIOS, it protects you in the same way the FBI cant get into a locked iphone they physically posess

but linux is not as secure as an iphone, and linux users typically dont know how to set this up, so in practice you are right, it doesnt protect you

senectus1about 4 hours ago
oh man i hope this works on dell laptops
rs_rs_rs_rs_rsabout 5 hours ago
Hard to get some spotlight for this with all these new models around, I feel bad for Canonical.