3 ms·

This is a non-issue for me, as I use LUKS2 (the recent version of LUKS which is much better). If I need to use Windows, for whatever reason, I jail Windows in a

This is a non-issue for me, as I use LUKS2 (the recent version of LUKS which is much better). If I need to use Windows, for whatever reason, I jail Windows in a VM typically to use certain software that has no Linux equivalent. I don't trust Bitlocker. Read somewhere Bruce Schneier uses Bitlocker for his daily computing, but I still don't trust it. After all, this is Microsoft we're talking about, who are in cahoots with the NSA, and Redmond has NSA on speed-dial. Avoid Bitlocker if you really want to protect sensitive data. (If you are going to use LUKS, use LUKS2 with a seven word passphrase). Currently this is the state-of-the-art for encrypting disks.

Already__Taken 3y ago
luks2 and Tang+Clevis is a pretty tidy solution. I have a host boot that I connect into the VPN and unlock the inner container volumes of code. I would like if it was built upon less shell scripts.
NoZebra120vClip 3y ago
Reality check. If US-based Big Tech is undoubtedly pwned by USGov interests, why should you think that non-US-based tech is any different? Do you really think that MI5/6 leaves Canonical alone? Red Hat is IBM and US-based too. Are the Finnish/Scandinavian authorities just patting Linus on the head and saying "do whatever you want bro!" I think that it takes significant leaps of logic, yeah even with pervasive F/OSS, that non-US intelligence is somehow weaker or less interested than US-based ones. In fact, your typical Linux supply chain and SBOM is far, far more complex than anything Windows can serve up. There are so many juicy opportunities in there.
lostmsu 3y ago
Fun stuff. I only ever use Linux under Hyper-V precisely because I could not find a reliable way to set up disk encryption that does not ask for password while giving the same protection as Bitlocker (e.g. you can keep your system automatically updated, and as long as your TPM and OS login screen are not vulnerable nobody can steal the machine and decrypt the drives). Even Fedora (which I think is in the better shape than most) does not set that up by default and the only tutorials I found require you to manually reconfigure TPM on every kernel update.

Already__Taken 3y ago

luks2 and Tang+Clevis is a pretty tidy solution. I have a host boot that I connect into the VPN and unlock the inner container volumes of code. I would like if it was built upon less shell scripts.

NoZebra120vClip 3y ago

Reality check. If US-based Big Tech is undoubtedly pwned by USGov interests, why should you think that non-US-based tech is any different? Do you really think that MI5/6 leaves Canonical alone? Red Hat is IBM and US-based too. Are the Finnish/Scandinavian authorities just patting Linus on the head and saying "do whatever you want bro!" I think that it takes significant leaps of logic, yeah even with pervasive F/OSS, that non-US intelligence is somehow weaker or less interested than US-based ones. In fact, your typical Linux supply chain and SBOM is far, far more complex than anything Windows can serve up. There are so many juicy opportunities in there.

lostmsu 3y ago

Fun stuff. I only ever use Linux under Hyper-V precisely because I could not find a reliable way to set up disk encryption that does not ask for password while giving the same protection as Bitlocker (e.g. you can keep your system automatically updated, and as long as your TPM and OS login screen are not vulnerable nobody can steal the machine and decrypt the drives). Even Fedora (which I think is in the better shape than most) does not set that up by default and the only tutorials I found require you to manually reconfigure TPM on every kernel update.