Yea I wouldn't choose a musl/BusyBox distro for my daily driver.

And who has that implementation?

Right? OpenSUSE stopped my distrohopping way before I thought I would. I love it.

Ahhh thank you, that makes a lot more sense! I don't feel too at-risk on my desktop, but if I ever find myself having to take a laptop to like, DEF-CON, then sounds like it'd be pretty essential, along with full-disk-encryption, AppArmor/SElinux, and all those other "wildly inconvenient but more secure" protocols set up.😂
(Lmao that would be terrifying.)

I might try to re-enable it just for the experience. After all, never know when some insane automated malware will hit the 'net that somehow exploits boot like that, and freaks out everyone who said "Nahh that's not possible."

With Linux? Kernel signed with your own key to get out of lockdown mode restrictions?

iBoot is the bootloader on all Apple products.

Depends on the distro! I could do it in 5 minutes with my bazzite installation: https://docs.bazzite.gg/General/Installation_Guide/secure_boot/

Very happy surprise when setting up my new PC :)

There are no lockdown mode restrictions on my system.
Kernel is not signed, but i switched to UKIs a couple months ago (hibernation worked fine with these).

It is worth noting that the failure is hibernating, not resuming.
Normally hibernate takes ~1 minute with fans spinning at max speed, but it recently started not finishing and instead being stuck on a black screen for more than 30 minutes without the fans running until i run out of patience (i hibernate before i go to sleep or head out) and force power off the system (power button 10 second press on my system).

What kind of attack does it actually protect against?

But who else can use that?

Rootkits

You are free to implement any filesystem driver, and either load it in your custom implementation of EFI, or from an EFI image stored on a FAT partition. The EfiFs project provides many drivers under a GPL, including exFAT, Btrfs, ext2-4, NTFS, ISO9660 (cdfs), ZFS and also HFS(+).

Ooh thanks I need to explore this thing!

Same here, I run Mint everywhere I can, and the XFCE edition works especially well in old machines.

Alpine is better suited for servers and especially containers, because the images can be really small. If you got enough RAM, there's an installation mode that runs on it without writing to disk, pretty cool for systems where you want always to reboot in the same state.

Evil maid attacks. Trusted boot is necessary to prevent the modification of unencrypted boot code like bootloader + kernel + initrd. Modified boot code could potentially steal the master key for the root volume while it gets entered. Also rootkits that inject below the os.

I dont like secure boot on Linux anyway.

Yeah, Ventoy will import its key for you too. If what you're using doesn't come with that utility, you'll be manually entering in public keys. 😭