There’s other approaches to automatically unlocking. For example, you can combine Clevis with Tang to use Network Bound Disk Encryption, which lets you automatically decrypt only when on a trusted network.

You can have multiple different LUKS keys, and any of them can be used to decrypt the disk. This lets you automatically unlock via a network server when your system is at home, while still prompting for an unlock password when not at home.

At my workplace, our laptops have two LUKS keys - one for me and one for IT / tech support. It lets IT boot the system (eg if I send it in for repair) without having to know my LUKS password.

Bitlocker stores the key required to boot the system in the TPM.

You can do that on Linux too if you want to, using Clevis or systemd-cryptenroll.

As far as I know, Bitlocker uses two keys to boot: There’s a key in the TPM, that’s used to decrypt a key stored on the drive, that’s used to decrypt the data. I think some data (maybe just user-specific data?) is encrypted with a user-specific key too, that isn’t unlocked until you log in. I’m not 100% sure about the specifics of its design.

cost of AI going up

The highly subsidized Anthropic and OpenAI subscriptions will go away, but open weight models are getting much better over time - GLM-5.2 and Kimi K3 are both very good.

The most expensive part by far is training the model. That’s why OpenAI and Anthropic are losing so much money (well, that and the subscriptions).

With an open weight model, someone has already trained it, and you just have to cover the cost of inference, making it a lot cheaper. Any company (or individual!) with powerful enough equipment can host the model, which means there’s competition in terms of price, compared to something like Claude Opus where the only four hosts (Anthropic, Amazon Bedrock, Google Vertex AI, and Azure AI Foundry) use Anthropic’s pricing.

I agree that AI slop is bad, but I don’t really agree with their method of determining if an app is abandoned (no updates in 2-3 months).

Sometimes apps don’t need updates. Some Linux apps don’t receive major updates for years. I used backupninja (https://0xacab.org/liberate/backupninja) for long time even though sometimes there’s 2-3 years between releases, because it did what I needed. (I switched to Borgmatic at some point though).

I didn’t update one of my apps for over a year because it already did everything I needed, and I wasn’t receiving any major feature requests. There’s still some bugs I need to fix but I just haven’t gotten around to it yet.

Ahh, interesting, thanks for the info.

It would require either every app developer on F-Droid to comply as well

Has this been mentioned anywhere? I haven’t seen it.

That’s a separate thing. As far as I know, there’ll be no difference between third-party app stores installed via Google Play vs third-party app stores installed via APK in terms of the apps in the store itself.

IIRC they’re going to force verification for all apps but have an opt-out that you just need to do once, and wait 24 hours after enabling it.

It would increase visibility of F-Droid (people that might have never heard of it might start seeing it in the Play Store) so I think they’ll give in to Google’s requirements even if they oppose them…

You currently have to install F-Droid manually via APK. This change will allow F-Droid to be listed in the Google Play store.

Nice! That’s a great idea.

The IPTV provider should provide the EPG, either as a URL or via “Xtreme Codes” (which is essentially just a base URL for an API that provides both the playlist and the EPG).

Try set up the stream directly on an IPTV app on your TV, instead of using Dispatcharr. If you have a device with Android TV (either built-in to the TV or a steaming box like the Nvidia Shield or Onn one), try Tivimate.

The IPTV apps on non-Android platforms aren’t as good. On your computer, you can try tuning in to a channel using VLC or a web UI (if your provider has one) and see if it works better.

The best IPTV providers are hidden from the public (no public website or social media presence), and you need to be invited by an existing user. Unfortunately the one I use closed signups a few years ago, otherwise I’d invite you.

And I don’t ever know if it’ll get better because you need to know why you want to build something someway.

The major issue I’m seeing with junior (and even intermediate) developers is that they trust that the AI will always do things the correct way and don’t question its approach, and they don’t develop proper debugging skills and just rely on the AI to attempt it.

To get decent quality output out of an AI model, you need to have critical thinking skills, at least basic knowledge of the overall architecture for whatever you’re trying to build, and enough knowledge to question the model when it does something wrong.

Blindly trusting AI is why so many old security issues are coming back - stored/reflected XSS, SQL injection, exposing databases directly to the internet with no password, things like that. Newer frameworks mostly got rid of them, and now AI is bringing them back. It’s a fun time for red teams at least.

In Italy, the “Piracy Shield” system misfired so badly that an erroneous order took Google Drive offline for over 12 hours in October 2024.

A lot of ISPs have a three strike rule for piracy: if you get caught pirating content three times, they’ll disconnect you.

These “piracy blocking” services should be subject to a similar policy. If they cause outages for major service providers (Google, Akamai, Cloudflare, AWS, whatever) three times, they’re not allowed to activate the block any more until they fix the systemic issues causing the outages.

This is a tricky statement, though. You could argue that sorting popular posts to the top is an attempt to maximize engagement, since you’re probably more likely to click on and/or comment on top posts. Lemmy just has less data to use to make the decisions as to what you’d like, but it’s still trying to do it.

Lemmy has algorithmic feeds though, unless you’re just using the new, old, or top feeds. https://join-lemmy.org/docs/contributors/07-ranking-algo.html

Does Patchmon not have a setting to look for the Docker socket in a different location?

I could be wrong but I don’t think there’s any security issues making a symlink to a socket, since permissions/ACLs on the socket would still apply.

My Epyc 7702 does have onboard TPM, but my supermicro H11DSi-NT doesn’t pass it through to the OS, for some reason

Huh… That’s interesting. At my workplace we have Linux EPYC servers with working TPM (it’s mandated that all computers, both clients and servers, must have TPM 2.0), but I’m not a hardware person and don’t know exactly how they’re configured.

This is good to know. I haven’t had issues with using a USB drive though, since it doesn’t receive many reads or writes - the system is copied to a RAM drive on boot and runs off that rather than the USB.

I assume this means I’d need another drive to boot it from? My current setup is that I have 2 x 22TB drives in a ZFS mirror for data storage, and 2 x 2TB NVMe SSDs in a ZFS mirror for things like VMs, Docker containers, documents, etc.

I had to get a Supermicro AOM-TPM-9665V TPM chip for my motherboard

How old is your CPU that it doesn’t have onboard TPM? It’s been a standard feature for quite a while now