• 0 Posts
  • 26 Comments
Joined 3 年前
cake
Cake day: 2023年6月26日

help-circle
  • Wait unti you have to upgrade Zorin to a new release. I still haven’t gotten mine to work. Stick with Mint or Bazzite if you want a Windows alternate

    I wouldn’t exactly put up Mint as an example for a smooth upgrading experience…
    Maybe I lack the technical understanding, but it’s absolutely baffling to me, why one has to download mintupgrade. It’s a reasonable setup wizard once it’s running, but why on earth is that not part of the whole Update tool interface in the first place and gets downloaded automatically?









  • Just got a fairphone 4. It feels so much more solid than my old pixel 6a. Its battery lasts for almost 2 days. Same performance that I can see. Spare parts for cheapish on the site. Anyways just wanted to share.

    Running LineageOS on mine. By the way things have been going for the last couple of years, it’s probably the first phone I’ll be using for as long as my old Nokia brick, even though I don’t like its gigantic size.
    I do see a future problem in there being no aftermarket components available, but maybe that will change and official manufacturer spare parts are still better than no spare parts.






  • Thanks, I didn’t know most any of that stuff!

    So the bootloader also gets updated, and new versions of the bootloader need to get signed. So if the BIOS is responsible for signing the bootloader, then how does the operating system update the bootloader?

    Does that happen often? I had, apparently incorrectly, assumed those things were more or less fire and forget.

    Kinda. The problem here, IMO, is that Secure boot conflates two usecases/threat models into one.

    Huh, I think that might indeed be the central problem, good call.

    You must explicitly ask for this setup from the Linux distro installers (at least, all the one’s I’ve used). By default, /boot, where the kernel and drivers are stored, is stored unencrypted in another external partition, and not in the LUKS encrypted partition.

    Wait what, that just seems like home directory encryption with extra steps 🤦 I guess I’ll go back to Veracrypt then.


  • But this breaks automatic updates without entering the BIOS

    Maybe I’m misunderstanding a technical aspect here, but wouldn’t only the bootloader need to be signed? To my understanding a tamper-proof system already assumes full disk-encryption anyway, so any kinds of automatic updates would be happening in a black box anyway, wouldn’t it?

    and is just not feasible except for the PC on your desk at home

    That’s probably a different and more value-based discussion and I’m quite sure you didn’t intend it that way, but it’s hard for me to put into words how much this sentence structure offends me 😅
    A benefit to the users in front of their personal computers can never be an exception, it is (… ought to be) always the point of everything, the end goal. Having a solution that benefits end users and puts other entities at a disadvantage is always preferable over a solution that puts end users at a disadvantage for the benefit of other entities.


  • As almost always the answer is “it depends”.
    From a security perspective you want to make sure that what your system boots is trusted and not tampered with by a third party. If your threat model includes people with physical access or malicious software (root kits) manipulating your operating system, then secure boot can help mitigating if you set it up correctly.
    If that’s none of your concern, then you probably shouldn’t bother with it.

    It’s such a silly system. Could have just had it in a way that automatically trusts only whatever system(s) is/are installed while the BIOS is unlocked so any user benefits from secure boot as soon as they set a BIOS password.


  • Users shouldn’t have to care about jurisdiction if the servers cannot ever read their messages in the first place. Any app that fails to meet this requirement should wholesale be disqualified.

    What madness is this? Surely this is not about the servers reading a message, but about the user having or not having legal recourse against a server abusing whatever it is they can read. Metadata is data. Someone somewhere will know how much and when and in which patterns I communicate with who. And how much control I have over what they do with that knowledge simply depends on the jurisdiction. Technical considerations are irrelevant for that 🤷