Arnavion

44 ms·

781.
by Arnavion 3y ago
Create a veth pair. Move one end of the pair into a network namespace. Bind the untrusted service on that end. Have your proxy service connect to the other end.
782.
by Arnavion 3y ago
As the section at the end says, socket fds work even if the process doesn't have access to the underlying network interface that they were bound from. A good use of this fact is that it's okay to set `PrivateNetwork=yes` for socke
783.
by Arnavion 3y ago
The leaked key in question has nothing to do with Secure Boot keys. The leaked key in question affects you even if you have your own Secure Boot keys.
784.
by Arnavion 3y ago
The processor has to verify the signature, which means the public key needs to be embedded in the processor. It makes sense that the processor manufacturer creates the keys and distributes them. If it was the other way around, then a) fifty
785.
by Arnavion 3y ago
The question is whether you have any mandatory UEFI drivers or not. If they're in the ESP you can just look there to check, but UEFI drivers can also be loaded from PCI cards or baked in the firmware itself. If you're using a TPM
786.
by Arnavion 3y ago
>unless you replace all the manufacturer-signed firmware modules with your own ... of which there might not be any. Eg none of my half-dozen SB-using systems (desktops and laptops) have anything in the ESP other than the booloader and UK
787.
by Arnavion 3y ago
Secure Boot keys are unrelated to the leaked key in question. The Boot Guard key is used to verify the firmware itself that the CPU executes on boot. What the firmware happens to do afterwards, say it's a UEFI firmware that implements
788.
by Arnavion 3y ago
Which system?
789.
by Arnavion 3y ago
Is there any platform using Intel CPUs with Boot Guard where Secure Boot can't already be disabled?
790.
by Arnavion 4y ago
The lack of warning is from returning `Box<dyn Future>`, which `#[async_trait]` emits. ( https://news.ycombinator.com/item?id=35834091 ) With async-fn-in-trait that flooow linked to (and more generally type-alias-impl
791.
by Arnavion 4y ago
It's actually very easy for rustc to raise a compiler error if you have recursion inside an async fn. It naturally falls out from the way async is implemented, because the resulting Future type would be infinitely sized. An `async fn`
792.
by Arnavion 4y ago
Firefox. My phone runs Linux (postmarketOS).
793.
by Arnavion 4y ago
>1. That link is dead ("Access Denied") Works for me. >2. The bug is not in Devuan, it's in something called refractainstaller, which is used for Devuan live-ISOs. If you just install Devuan that doesn't happen. Fr
794.
by Arnavion 4y ago
Put in uBO "My filters": news.ycombinator.com##.athing:has(.titleline):not(:has(.votelinks)) news.ycombinator.com##.athing:has(.titleline):not(:has(.votelinks)) + tr news.ycombinator.com##.athing:has(.titleline):not(
795.
by Arnavion 4y ago
Now keep reading on to literally the next sentence. The article's point is that the `if-else` behavior is inconsistent with `match`. And based on the part about double quotes in comments, the parser seems to be fucked up something fier
796.
by Arnavion 4y ago
I run Steam in a Docker container of Ubuntu 22.04 for reasons like this. Also my actual system isn't polluted with 32-bit libs, Steam can't rm-rf my home directory and games can't steal files from my home directory (homedir i
797.
by Arnavion 4y ago
To be precise about the "now": Fedora switched to btrfs by default a couple of years ago. OpenSUSE has been using btrfs by default for at least a decade.
798.
by Arnavion 4y ago
Also that wouldn't have let him do the animation at the end of the video.
799.
by Arnavion 4y ago
FWIW I've been using btrfs for the root partition for a decade without any (observed) corruption problems. This is across multiple installs of OpenSUSE Tumbleweed on laptops and PCs, HDDs and SSDs and most recently an SD card. Back in
800.
by Arnavion 4y ago
TOTP can also be safe against an impostor website if the TOTP implementation validates the domain name of the request before filling out the TOTP code. KeePassXC's browser extension does this, for example. Of course, if the impostor ha
801.
by Arnavion 4y ago
At the OS level, the amount of money spent on developers will not be satisfied by a small number of individual users paying $300/year. At that level the funding comes from enterprise customers. You're welcome to use that $300&#x2F
802.
by Arnavion 4y ago
I'm not asking you what they don't support. I'm asking you what they do support.
803.
by Arnavion 4y ago
Services support Yubikeys through U2F / WebAuthn, not anything Yubikey-specific, right? If you're using services that don't support that, I take it the apps you do use are using TOTP?
804.
by Arnavion 4y ago
Thanks. TIL about CONFIG_INITRAMFS_SOURCE.
805.
by Arnavion 4y ago
>The ESP too small? It's just a partition and filesystem. I was just relaying what I've read about the reason that the concept of the XBOOTLDR partition was invented in the first place. Eg: https://wiki.archlinux.org
806.
by Arnavion 4y ago
The rest of their post makes it clear that they consider any keys that are not backed by their TPM to be undesirable.
807.
by Arnavion 4y ago
>Be aware that in the case of Bitlocker specifically Microsoft "conveniently" saves your encryption key on their "cloud", so you don't really need the TPM to decrypt stuff, which of course goes completely against
808.
by Arnavion 4y ago
Even with newer versions, some (many?) distro installers still default to using LUKS 1 for the root partition anyway. As the article also says, while grub2 does support LUKS 2 now it still only supports pbkdf2, so having root be LUKS 1 make
809.
by Arnavion 4y ago
I can't find any documentation about how to do that with CONFIG_EFI_STUB. Arch wiki, Gentoo wiki and the kernel docs all talk about specifying the initramfs as an ESP file path. Are you sure you didn't make a UKI (the second metho
810.
by Arnavion 4y ago
>Does that support verification of the initramfs? https://news.ycombinator.com/item?id=35615911 >And UEFI implementations have undocumented size limits of what they can boot. If the problem is that the ESP is too smal

More ›