Vogtinator

5 ms·

1.
by Vogtinator 20d ago
In the beginning, Flatpak was seen as savior for the Linux desktop ecosystem by making more applications available for more distributions, possibly packaged by the upstream maintainer, but they didn't realize that Flatpak resp. Flathub
2.
by Vogtinator 5mo ago
> If, for example, a company wants to issue fleet computers to workers or school to students, you want to have secure boot on those devices to prevent tampering. Secure boot makes it so that physical access is not the end all of security
3.
by Vogtinator 6mo ago
AFAIK that's just when plugging in a USB 3 device into a USB 2 port or using a USB 2 cable.
4.
by Vogtinator 6mo ago
With https://github.com/thkukuk/account-utils (not the default yet), it's meanwhile possible to run openSUSE Tumbleweed (package based) with NoNewPrivileges= as usual.
5.
by Vogtinator 1y ago
> For example, Aeon (of openSUSE MicroOS vintage) looks like all KDE Linux is aiming for, just with Gnome as DE. And Kalpa is that just with Plasma as DE.
6.
by Vogtinator 1y ago
swapfile on linux must be directly mapped, bypassing any filesystem level checksums (see https://btrfs.readthedocs.io/en/latest/Swapfile.html )
7.
by Vogtinator 1y ago
ctrl-c sends SIGINT.
8.
by Vogtinator 1y ago
errno is in thread-local storage (TLS)
9.
by Vogtinator 2y ago
> Apps on Android have no access, or ability, to directly call kernel functions. That is nonsense.
10.
Microsoft/WSL pull requests taken over by malicious GH action(github.com)
8 points by Vogtinator 2y ago|1 comments
11.
by Vogtinator 2y ago
That's the design with sdbootutil in openSUSE ( https://en.opensuse.org/Systemd-fde , https://github.com/openSUSE/sdbootutil ).
12.
by Vogtinator 2y ago
> You can mitigate this by including PCRs that sign the kernel and initrd. No, that's not an effective mitigation. The signed kernel+initrd would still boot into the impersonated root. > however it means whenever you update you n
13.
by Vogtinator 2y ago
For multiple users on the same server it was IMO well designed. Everyone had their ~ and could place whatever libraries/binaries/etc. in there and do whatever they wanted. Package managers are way more modern than that and their d
14.
by Vogtinator 2y ago
For x86 cores this is visible in Agner Fog's instruction performance tables: https://agner.org/optimize/#manuals The latency shows after how many cycles the result of an instruction can be consumed by another, whi
15.
by Vogtinator 2y ago
Can wine do ARM64X resp. ARM64EC to mix native aarch64 code with emulated x86(-64) code in the same process for better efficiency?
16.
by Vogtinator 2y ago
https://duktape.org is in a similar ballpark.
17.
by Vogtinator 2y ago
My envy x360 has that button as well and it even puts a physical shutter in front of the webcam in addition to disconnecting USB.
18.
by Vogtinator 2y ago
Cargo.lock has 8750 lines. Is that normal for something like this? For comparison, QEMU basically just needs glibc, glib and zlib for basic functionality.
19.
by Vogtinator 2y ago
> you do you, but watch your market share always be niche. As long as I can use the OS I like and how I like, I don't care about metrics like market share.
20.
by Vogtinator 2y ago
> That said, it does require more care when you do OS updates or UEFI updates to remember to update the TPM sealed secret with the new measurements. Windows and Linux both have the former automated so it should generally be fine. Yep, th
21.
by Vogtinator 2y ago
> 1. This is interesting. So in a measured boot scenario, you wouldn't be able to boot the main OS, but it would give you access to sort of a minimal initramfs environment for debugging? It's a good idea for personal computers,
22.
by Vogtinator 2y ago
Measured boot > trust chain through signature verification: With measured boot, components in the boot chain tell some trusted component (e.g. a TPM, possibly in FW) about all of their input and only if the hashes at the end match, $some
23.
by Vogtinator 2y ago
Would that actually have a positive effect? Running malicious software in the only user's context can already cause maximum damage: https://xkcd.com/1200/ This would just result in more UAC prompts and thus annoye
24.
by Vogtinator 2y ago
I'm using Tumbleweed with btrfs snapshots, systemd-boot and transparent disk encryption (using TPM + measured boot), works fine. Currently this needs to be set up semi-manually (select some options in the installer, then run some comma
25.
by Vogtinator 2y ago
iwd is an alternative to wpa_supplicant, not NetworkManager. NM has support for iwd.
26.
by Vogtinator 2y ago
I did something similar some time ago: Booting from an RPM repository on a Tumbleweed installation DVD. My initial goal was to write a fuse filesystem for mounting RPM packages, but I wanted to see how far it goes. Turns out, pretty far ind
27.
by Vogtinator 2y ago
The Pi 5 is still not supported mainline. Proper mainline support for older models was contributed by third-parties, not the RPi foundation, which just care about their kernel fork.
28.
by Vogtinator 2y ago
Doesn't work either: To establish the secure connection, you need some way to verify the other end (through public keys, certificates). That verification happens before any measurements can be done securely, so it can be bypassed.
29.
by Vogtinator 2y ago
Only recently. It started out as soldered to the main board.
30.
by Vogtinator 2y ago
Not shown: "systemd-run --shell" asks for the root password (or whatever set up for polkit authentication). That some other process of the same user can influence that session with elevated privileges isn't really an issue. I

More ›