> That does not mean it improves security. If the images it allows to boot are less secure than those it prevents, it lessens security.

I appreciate what you're saying but your logic doesn't really work:

- The only image allowed is Windows. Anything else is disallowed. Those images might be malicious (eg someone somehow stole MS 3rd party cert) or they might not. But not allowing them is more secure than allowing them because you're reducing your risk.

- Furthermore, saying some images allowed are less secure (ie Windows) than the ones that aren't (eg CentOS) doesn't mean this "feature" (if you can call it that) doesn't still add some additional security. Because (and at risk of repeating the above), this still blocks some additional images that might be a security risk. Hence it reducing your risk and hence it providing additional security from the perspective of defence in depth.

- The point of "defence in depth" is not to have a single security countermeasure that acts as a silver bullet against attacks. It's to provide a layered approach where cumulatively they protect you. This "feature" certainly fits that criteria.

This is why I said the question shouldn't be "does it provide additional security?" but rather "is that additional security significant enough to warrant the other impacts (such as those you've outlined?"

If you were to make that point instead, then I might agree with you. But to say it doesn't provide any additional security really misses the point of how security is evaluated.

> > I'm not convinced it does in any meaningful way.

> It does booting Linux harder exactly to these users that it claims to protect.

That's not a counterargument, it's a contradiction. I don't really see the point of a "oh yes it does" / "oh no it doesn't" pantomime style argument. If you are able to cite how the short activity of unchecking an additional UEFI option is significant enough to turn people off from the already complicated process of installing Linux then I'd be interested to see it. Otherwise we might just have to agree to disagree.

> Power users can do it; less experienced users consider that difficult, especially if they are not familiar with the concept. This all contributes to the image that Linux is difficult to install and use. Linux forums are full of discussions on this topic.

But how many of those people are buying ThinkPads to install Linux who are not power users? I'd wager if you were to draw a Venn diagram, those groups would barely, if at all, intersect. And more often than not, you have to alter UEFA parameters to boot from removable devices regardless of your setting in secure boot.

> Would be it OK for Windows users to fiddle with UEFI settings before they can use Windows? If not, why is it OK for Linux users? Windows gets a clear advantage here.

This I do 100% agree with. I never liked secure boot to begin with because of exactly this reason. Still dislike it now and certainly don't agree with what Lenovo are doing with regards to the original topic. But that is an entirely separate point to the one made previously about defence in depth.

Here I think lies the issue of our discussion. You're arguing against a technical point with an emotional claim of morality. While I completely agree with your point about morality, it's doesn't address the technical point you're trying to argue against.