Short answer: off

Long answer: If you won’t use your system for gaming (or anything requiring third-party drivers) and trust Microsoft to not fuck up and will also encrypt your disc, then Secure Boot makes you safer. Otherwise it just causes trouble.

Secure boot has always caused me headaches in the past.

If you want the extra security, go for it. If you don’t care, turn it off.

I use Linux Mint and I disabled it because it was blocking the nvidia driver from initiating. I’m sure I could fix it, but can’t be arsed to.

Secure boot is a good thing. It’s a security feature. You want it on whenever possible, unless it’s a huge trouble (like if you have to start manually signing your own keys and adding them to the bios).

Edit: added the word manually

It’s a layer of security. Keep it on when you can. If you have issues doing something, then turn it off (and see if you can turn it back on afterward).

If you do, then also choose full-disk encryption. It doesn’t make sense to close a small hole only to leave the big one gaping wide open. And yet on Linux FDE is mostly off by default, even in today’s era of encryption, even on laptops. Personally I don’t understand it.

Once you’re encrypted, then Secure Boot (if you even have the option of it) mitigates against the “evil maid attack”. To get access to your encrypted computer, the attacker will need physical access to it twice: first to swap out the bootloader, then to harvest the password you unsuspectingly passed to their freshly installed malware.

For most targets (i.e. you, probably), this would all be far too much trouble. But technically it closes a loophole: it means that you can go to Russia as a spy or a journalist and not have to carry your laptop on your person at all times.

Its main purpose is to prevent malware from booting. In my experience its main purpose seems to be preventing me from booting things I want like ventoy flash drives, nvidia drivers, and Linux distros that don’t support it. Same goes for tpm module. Its main purpose seemed to be the switch keeping win 10 from upgrading. I turned them both off and haven’t felt the strong need to turn them back on yet.

That said, and my bad computing habits aside, you probably should turn them ON. I’m not sure they will do all that much realistically speaking, but if it isn’t getting in your way (and it shouldn’t), then ON isn’t a bad default state to be in.

If you want extra security turn it on or you want windows or any game (looking at you vanguard)to shutup about security boot being off
The only problem with security boot if you care about this is that it’s managed by Microsoft(most of the time)

I was looking for an official documentation entry on this matter to share with OP, ideally something centralized like Fedora’s RPM Fusion or the comprehensive Arch Wiki. While I found various user-created resources, I was surprised not to locate a centralized official documentation page addressing this topic. I’m quite familiar with Linux Mint’s user-friendly approach, so perhaps I’ve overlooked something? I’d be genuinely delighted if someone could point me to such a resource, as it would be tremendously helpful not just for OP but for the community as a whole.

I turn it off during OS install then turn it on after usually. If you want to run VMs sometimed youll have to sign your own keys and annoying stuff like that but you can always just go into BIOS and turn it off anytime anyway.

If your linux OS supports secure boot then it does help improve security.

The differing opinions on it are often because it can cause issues in some set ups and in a default set up its only a marginal security gain.

It will add a layer of security at boot by preventing 3rd party unauthenticated processes / software from running and creates a secure boot chain from your BIOS up to the OS. But the default set up also means other authenticated OSes like Windows can be run, so its not as secure as it could be.

To really secure it you could create your own keys and then only your OS could boot. But as a linux newbie thats likely way more than you need and there are risks if you fuck up, to the point of accidentally locking you out of your own machine

So your choice is really just the default set up being on or off. On is a bit more secure but if you experience any issues then turn it off and don’t worry about it.

@ArchmageAzor secure boot is very low on your priorities. Start with FDE (full disk encryption). This should be the default in all Linux distros

On!

If you aren’t sure, install with secure boot off. If you like adventure, install with secure boot on and see if secure boot causes problem or not. If yes, then install with secure boot off

i turned it on mine. Running linux mint and windows 10 ltsc on seperate hard disk. Havent turn into any problem so far.