jcgl

14 ms·

181.
by jcgl 9mo ago
That's basically my understanding too. But since you can still boot any shim-supported distro, Secure Boot + shim practically gains you nothing. An adversary can simply boot their own own copy of shim with whatever OS they like.
182.
by jcgl 9mo ago
> If you try to install a different operating system, your computer will not boot. That does not follow. That would only very specifically happen when all of these are true: 1. Secure Boot cannot be disabled 2. You cannot provision your
183.
by jcgl 9mo ago
Agreed in general. But regarding secure boot, it's not like shim actually helps with real security either afaiu, right?
184.
by jcgl 9mo ago
Immutable, signed systems do not intrinsically conflict with hackability. See this blog post of Lennart's[0] and systemd's ParticleOS meta-distro[1]. I do agree that these technologies can be abused. But system integrity is also a
185.
by jcgl 9mo ago
I don't personally find it as disturbing as you do, I think. Which isn't to say that I don't think it should be fixed, etc. etc. I'm sure the project would accept a documentation patch to amend this discrepancy. At the e
186.
by jcgl 9mo ago
That seems like a fair point about the documentation! As far as I can see, you're right.
187.
by jcgl 9mo ago
Standardizing that approach is one thing that the systemd project has been working on. They've built various components to help with that, including writing specifications (via the UAPI group) on how that should all fit together. Parti
188.
by jcgl 9mo ago
> Pulseaudio also completely denies existence of people trying to do music on Linux, there is no real way to make latency on it be good. I don't care much about PA at this point tbh and don't know much about the inner workings;
189.
by jcgl 9mo ago
That's entirely defined by whatever units order themselves before network-online.target (normally a network management daemon like NetworkManager or systemd-networkd). systemd itself doesn't define the details; that's left up
190.
by jcgl 9mo ago
I'm not sure I understand why you think the solution proposed there is so bad. The question in that issue is around the semantics of time-sync. target . Targets are synchronization points for the system and don't (afaik) generally
191.
by jcgl 9mo ago
I think you misunderstood the tooling I was asking about. This is what was mentioned: > at my last job code review was done directly in your editor (with tooling to show you diffs as well). That's not covered by git itself. And it&#
192.
by jcgl 9mo ago
Not exactly. Desktop environments (or whatever the program is that launches the application) decides to use systemd to run each application in its own cgroup. Systemd is certainly relevant to the Linux desktop as a whole, especially regardi
193.
by jcgl 9mo ago
Maybe to some degree that's true. But let's take an example: GNOME is the only (afaik) desktop that requires client-side decorations. They've been like that for years, but nobody else is following them on that. Yes, the too
194.
by jcgl 9mo ago
> it doesn't have Android-like separation — a feature no one really wants. It's certainly a feature I want. Pretty sure I'm not alone in wanting isolation between applications--even GUI ones. There's no reason that va
195.
by jcgl 9mo ago
Good to know about its existence. I think I'll have to do my own sleuthing though, since I'm a (neo)vim user who dislikes GitHub.
196.
by jcgl 9mo ago
Jujutsu too[0]: > Jujutsu keeps track of conflicts as first-class objects in its model; they are first-class in the same way commits are, while alternatives like Git simply think of conflicts as textual diffs. While not as rigorous as sy
197.
by jcgl 9mo ago
That sounds great. Was that proprietary tooling? I'd be interested in some such thing.
198.
by jcgl 9mo ago
> I see this over and over again, wish there was some way to bet on it. One can play with bond markets and various ETFs or other derivatives, depending on what you envision. But even if your bet is qualitatively correct (that trust in th
199.
by jcgl 9mo ago
Fwiw (in case it hadn't occurred to you already), there's no technical requirement to run your NAT64 on your router/modem/CPE. You could run the NAT64 on a Raspberry Pi or some other little device for instance.
200.
by jcgl 9mo ago
See my reply to your sibling commenter. My comment was not about NAT in general, i.e. I was not denying the very real existence of stateless NAT. Rather, I was disputing the usefulness of the NAPT solution proposed above as a solution to pu
201.
by jcgl 9mo ago
The general context here is about NATting to the public internet at large, not between particular segments. And the parent of my comment was talking specifically about NAPT, which is different from the non-port-based NAT that you're ta
202.
by jcgl 9mo ago
And that kind of NAT effectively doesn't exist in practice, so that's quite beside the point. Such a NAT doesn't scale to more than 24 devices behind it.
203.
by jcgl 9mo ago
That router thing seems crazy. I'm all for having options that are available . But not having, at the minimum, some blessed implementations for basic stuff like routers seems nuts. There is so much ecosystem power in having high-quali
204.
by jcgl 9mo ago
Yeah, as a solo dev quite new to frontend, that made me nope out of React almost immediately. Having to choose a bunch of critically important third-party dependencies right out of the gate? With how much of a mess frontend deps seem to be
205.
by jcgl 9mo ago
Not only did it provide that background pressure, but desktop software is a complex domain. So it often pushes the bounds of Linux software overall. Systemd is the example I have in mind here, but I’m sure there are others too that I’m not
206.
by jcgl 9mo ago
IIRC, that limitation of Jool can be avoided by running instances in different network namespaces. Some examples here: https://nicmx.github.io/Jool/en/usr-flags-instance.html Jool’s site also has really great arti
207.
by jcgl 9mo ago
This is really insightful, thanks. I hadn't understood that there was room in the vector space that you could reserve for such purposes. The response from tempaccsoz5 seems apt then, since this injection is performed/learned durin
208.
by jcgl 9mo ago
I assume "harness" here just means the glue that feeds one model's output into that of another? Definitely sounds expensive. Would it even be effective though? The more-privileged rings have to guard against [output from unpr
209.
by jcgl 9mo ago
The model only sees a stream of tokens, right? So how do you signal a change in authority (i.e. mark the transition between system and user prompt)? Because a stream of tokens inherently has no out-of-band signaling mechanism, you have to e
210.
by jcgl 9mo ago
Don't get me wrong, I like secure boot and securing the boot chain more generally. Was just trying to respond on the merits here. How would you envision the opt-in process for the unlocked second stage bootloader?

More ›