Skip Navigation

InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)LA
Posts
0
Comments
309
Joined
2 yr. ago

  • But it's government laws and regulation that is behind. It's not so much of a technical problem (although E2EE email standard would be nice!).

    No. Government had nothing to do with it, these are separate issues. WhatsApp was never approved by the government, yet it's widely used and it has E2E. OTOH, German government accepts email for lots of things. I know of some public sectors requiring email with PGP even.

    The actual problem is that both email and PGP are really bad. This on my opinion describes it very well: https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2020/02/19/stop-using-encrypted.html

  • They want people to use easily tracked TCP. UDP is a simple request, TCP has to establish the connection, QUIC by Google is even worse.

    None of this makes sense (except maybe that TCP is stateful). What "easily tracked" is supposed to mean here I have no idea. Any information you can get from TCP are included in UDP from a privacy standpoint. The concept of a request doesn't exist in UDP. The actual request in the DNS sense is very similar for all protocols. QUIC is UDP from a network protocol point of view, but it adds features commonly found in clients that need secure connections over UDP.

    I prefer DoT

    Which uses TCP.

  • Did you disable CoW for your database with btrfs? E.g. for PostgreSQL, the Arch Wiki states:

    If the database resides on a Btrfs file system, you should consider disabling Copy-on-Write for the directory before creating any database.

  • This is the company that the US government had to tell that data from their cloud service is being syphoned, and they could only know because they bought they expensive E5 package to get the data that Microsoft logs anyways.

    In my opinion, if you use their products for anything but playing video games, you're putting your IT security at risk. Not because their products are inherently less secure than others, but because they sell on popularity and flashy features while trying to get the most money out of you by having you pay premium for features needed for secure operations.

  • Of course. In my opinion, what Docker is used for on Hub is a different model than it was originally supposed to solve. It was designed as a solution for enterprise where the development team had no easy control over the production environment, so the solution was to bundle the platform with the software. However, your production team is usually trustworthy, so leaking secrets via the container isn't an issue (or actually sometimes you wanted the image to include secrets).

    The fact that Hub exists is a problem in itself in my opinion. Even things like the AUR - which comes with its own set of problems - is a better solution.

    nix provides a solution to build clean Docker images. But then again it only works for packages that are either in nixpkgs already or you have written a derivation for, the latter being probably more effort than a quick and dirty dockerfile.

  • Maybe you should have read the entries in the link you posted

    Flatpak currently has a 7.2 vulnerability that has gone unaddressed since 2017.

    Text about the 7.2 vulnerability from 2017:

    In Flatpak before 0.8.7

    That version was tagged in git on July 20th, 2017

  • An old encrypted drive

    All of these use ciphers that are only affected by Grover's algorithm. This basically halves the exponent on your key space (so instead of 2128 keys you only have 264 keys), however this doesn't necessarily mean that the algorithm is faster than a good parallel brute force on classical computers.

    The more problematic algorithms are the ones affected by Shor's algorithm, which are all algorithms in broad use today that involve some sort of agreeing on a shared secret.

  • I haven't done this yet because I didn't need it, but I think you have the option to install newer packages by creating a nixpkgs overlay. If the build process didn't change between versions, it should be pretty straightforward. See https://nixos.wiki/wiki/Overlays, section "Overriding a version" for an example. Better yet create an issue on the nixpkgs bugtracker, or even better file a pull request for the updated package.

    Edit: you could even define a new updated package just for the package that depends on it and then pass that new package as a normal override. No need to update the package systemwide.

  • Yeah, it's almost comical. Facebook has more users than Twitter, more features and more content to manage. Their own product Instagram is basically a superset of Twitter afaik (I use neither though). Even if anything Musk said is true, Facebook/Meta would be fully in the right to hire engineers Twitter just fired; no-compete-clauses are illegal in their jurisdiction. I think.

  • While I do like Excel, its handling of values as dates is also a big issue that has hit a lot of people in the past – the format is just not very portable or exchangeable. It's not just an issue from Excel to other solutions… my point was rather that it's not a "Linux" issue and the way it was worded sounded like the kernel had something to do with it.

  • As someone else has said, on distributions that go for ease of use, the terminal isn't really needed.

    However, I do consider it a convenience feature even for users who are not savvy with it: You can either troubleshoot an issue by giving instructions like "Open application X, navigate to Option, open Tab, press Button, then enter Text, hit OK and repeat for each" or "copy and paste this command into your terminal". The amount of work on both sides is likely lower plus there's less room for error.