I’d agree that a hardware solution would be best. Something designed specifically to do it. I’ve been eyeing up the biometric yubikey for a while.

I do this for ssh keys, VPN certs and pgp keys. My solution is pretty budget, I generate the keys on a LUKS encrypted USB and run a script that loads them in to agents, and flushes them on sleep. The script unlocks and mounts the LUKS partition, adds the keys to agents, unmounts and locks the USB. The passwords I just remember for the unlock and load into memory, but they’re ripe for stuffing in to keepass-xc - I need to look at the secret service api and incorporate that in to the script to fetch the unlock passwords directly from keepass.

I have symlinks in the default user directories to the USB’s mount points, like ~/.ssh/id_ed25519 -> /run/media/<user>/<mount>/id_ed25519. By default, when you run ssh-agent, it tries to add keys in the default places.

The way it works for me is:

• plug the USB in to the laptop after a restart or wake-up
• run script
• enter passwords for luks key, ssh-agent, gpg agent etc.
• Unplug USB.

I keep break-glass spares in a locked cabinet in my house and office, both with different recovery keys

I do this because it’s my historical solution, and I haven’t evaluated the hardware options seriously yet.

I have never understood this fork argument. All it takes to make it work is a clear division for the project.

If you want to make something, and it requires modification of the source for a GPL project you want to include, why not contribute that back to the source? Then keep anything that isn’t a modification of that piece of your project separately, and license it appropriately. It’s practically as simple as maintaining a submodule.

I’d like to believe this is purely a communication issue, but I suspect it’s more likely conflated with being a USP and argued as a potential liability.

These wasteful practices of ‘re-writing and not-cloning’ are facilitated by a total lack of accountability for security on closed source commercialised project. I know I wouldn’t be maintaining an analogue of a project if there were available security updates from upstream.

They’ve snapified coreutils too, and rewritten them in rust (uutils). It’s proving to be a challenging transition…

Edit: While the article mentions rust’s vaunted memory safety as a driver, I can’t help but notice that uutils is licensed MIT, as opposed to GNU’s coreutils license being GPL v3.

While snapd is licensed GPL v3, it’s important to note that despite the ‘d’ suffix, it’s barely a daemon. It’s mostly a client for the snap backend - which is proprietarially licensed and only hosted with Canonical. The snapd client could be replaced at any time.

Everything’s a trade off, as you already know. I still use lets encrypt, despite the fact that I know attackers watch CT logs, and they’ll know as soon as I mint a cert.

Also, according to the propaganda model, in developed democratic societies, the propaganda is assumed to be true, and if you’re not on board with that, you’re not part of the debate.

You know what sideloading is, masses do not. It’s easy to generate negative connotation with a word that has less context.

Everyone knows what install means to them already, and no one hates sideloading as a word. It’s about fighting a disinformation war and trying to get you to join in, just without explaning it.

Fair enough, I did assume the target audience was selfhosters based on the question.

As for provider backups - well, you’d hope. But M$ doesn’t do user available backups, so I’d be surprised if that was bundled by the average SaaS provider.

And if you don’t know what database you’re running, how are you backing it up?

If you don’t know what database you’re running, are you bothering to do a full shutdown before backups? Are you doing backups at all…

Don’t worry about him, he’s just an anti-Lemmite

I’m on hyperland, and I’ve configured ydotool to do some of this work. It can move the mouse, enter keyboard shortcuts and do a bunch of things that autohotkey can, however it is by no means a complete solution, or one that comes with sensible defaults. It’s just a daemon and client, and you’ll need to set it up to do what you want.

As far as I know there’s no record and replay function, though you could likely script one.

Also, for triggering the scripts, you’ll need to set your Desktop’s keybindings to point to them.

For me, it filled the requirements that it was launchable by systemd unit, as the user on login.

I use it for a vairiety of tasks, but the primary one is typing out my clipboard as if I had pasted something. I rebound alt + shift + p to that, so I can paste windows login passwords or whatever in to Teamviewer/other stuff that doesn’t accept a paste command.

The answer as always is, it depends.

Not all implementations rely on shim.

if you set up secureboot without doing anything more than instaling the OS… yeah probably it is true. Edit: e.g. GRUB2 generally relies on shim. sysemd-boot doesn’t

I haven’t checked the specific key that signs shim to confirm the expiration date, but there generally is a date, as we’re talking about certs and keys here.

Edit 2: Basically what this article is saying is that the machines will need a new platform key (mited in 2023) enrolled in the tpms, with often comes from the firmware (when tpms are wiped for initial enrollment of a new install/setup, they tend to enroll whatever platform keys from microsoft are baked in to the uefi firmware).

So basically, if you haven’t had a bios/uefi firmware update since 2022, there’s no way for you to have have the new key trusted by your tpm, and the whole chain of trust falls apart when the key you do have expires. So you’ll need to disable secureboot. If you use shim and/or the microsoft platform key in someway.

Oh wait- I seem to recall…

Hang on though, if it’s web stats, how many of those impressions are ai bots scraping training data claiming to be Firefox users?

Don’t those likely read as Linux from how they fingerprint on TCP connections?

I haven’t tested the spouse approval factor, but once Radicale is setup, you don’t have to do anything other than create new calendars through a caldav app, or through the web front end.

Android can use DavX to sync if you’re in to foss stuff

I pretty much only use it for tasks and a maintenance calendar, but I’ve had zero problems with it so far

All I need is for them to fix the public collection RSS feed bug where they embed “https,http” in the feed xml if you’re behind a reverse proxy - which breaks parsing

Muppet Treasure Island, and “Spider-Man and his Amazing Friends Ep.16 - A Fire Star is Born!”

On VHS, of course!

and has integration for Oxidized, smokeping, greylog and more

Thanks for the feedback - It was a systemd issue. Something caused it to continue generating slices for espanso until the machine locked up - probably spawned with each terminal. It happened on out of date fedora install 36 (when 41 was out) with gnome on it.

Since then I’ve moved to a window manager for all my machines and would likely invoke it the same way - perhaps now it’s time to revisit!

I used eapanso for a few years, but kept running in to issues with it spawning hundreds of versions of itself.

I really miss it though. Would you say it has matured?

We’re everywhere!