[-] lemann@lemmy.one 27 points 10 months ago

Flash drive hidden under the carpet and connected via a USB extension, holding the decryption keys - threat model is a robber making off with the hard drives and gear, where the data just needs to be useless or inaccessible to others.

There's a script in the initramfs which looks for the flash drive, and passes the decryption key on it to cryptsetup, which then kicks off the rest of the boot mounting the filesystems underneath the luks

I could technically remove the flash drive after boot as the system is on a UPS, but I like the ability to reboot remotely without too much hassle.

What I'd like to do in future would be to implement something more robust with a hardware device requiring 2FA. I'm not familiar with low level hardware security at all though, so the current setup will do fine for the time being!

[-] lemann@lemmy.one 5 points 10 months ago

I saw the picture and initially thought this was a Newcommunities post about a radio controlled car community 😭 not about an ACTUAL car omg

[-] lemann@lemmy.one 2 points 10 months ago

Chuck a fiberglass walk-in bed cover on the back of that thing and you have a 12-seater bus!

Funny thing is, a Toyota Hiace bus has 17 seats, spacious interior, and is way smaller compared to this oversized thing

[-] lemann@lemmy.one 2 points 10 months ago

Steroids? They've done a complete speedrun lol

Imagine if it was a more mundane issue, let's say the air line in a carriage has blown out and none of the doors work under their own power. Roll the train into the third party workshop to carry out the fix... a copyright notice flags up on the panel screen and now you've got a long 20 ton dead brick in your workshop

Imagine this happened with cars, that would be outrageous man

[-] lemann@lemmy.one 4 points 10 months ago

With the fake parts scandal for airplanes I wonder if this should be mandatory for parts that impact public safety for public transport like trains, buses, planes and so on.

Airplanes are vastly more complex though. Four engines, flying at extremely high altitudes at hundreds of km/h, fully airtight, powerful onboard generators, food prep areas, bathroom etc, extensive ethernet networking for the small IFE units and WiFi access points, list goes on...

Whereas a train doesn't have anything close to that, even the high speed ones with all the bells and whistles, so I think it would be a bit unreasonable to expect them to be held to the same standards as an airplane.

The only train I'd suggest an exception for would be a maglev though - OEM parts only there please, especially for traction and em equipment 😳

Dont get me wrong, I want a full right to repair enshrined in law and using a system like this just to prevent it is clearly wrong, but if it could be adapted to allow for critical parts to be made under license by third parties and helped prevent fake parts then may be a small amount of good can come from this shitty practice.

Some independent validation of the manufacturing materials, their grade and assembly quality could work well here, since I'm not too sure if blindly trusting the parts manufacturers would be a great idea as long as they have profits in mind

[-] lemann@lemmy.one 3 points 10 months ago

The door. Now. 😂

[-] lemann@lemmy.one 2 points 10 months ago

In this asklemmy comm specifically?

There are two very popular asklemmy communities and they both are run differently 🤷‍♂️

!asklemmy@lemmy.ml
!asklemmy@lemmy.world

[-] lemann@lemmy.one 7 points 10 months ago

Free real estate 😂

[-] lemann@lemmy.one 3 points 10 months ago

Salty snacks, fried or baked 😁. Failing that, those tiny 7" pizzas that fit into my Ninja, ready in literally 8 mins

Used to like preparing food, but seems like such a hassle now

[-] lemann@lemmy.one 9 points 10 months ago

Missed one

  • CEO
[-] lemann@lemmy.one 1 points 10 months ago

If MIT AppInventor is still kicking around, you should be able to use it for this... although sadly you won't have access to the source code since it's a Scratch-like way to create apps.

By default the Android voice assistant uses Google tech AFAIK, if you're after a truly source-available solution then there's ”Futo voice input" to handle STT, and "RHVoice" to handle TTS - though these would still need a HTTP API bridge to do what you want

[-] lemann@lemmy.one 3 points 10 months ago

I think so, assuming these malicious packages are all primitive enough to just look for the single file in a user's home folder lol. The only downside here is needing to provide the keyfile location to ssh every time you want to connect... Although a system search would pretty much defeat that instantly as you mention

SSH keyfiles can be encrypted, which requires a password entry each time you connect to a SSH server. Most linux distros that I've used automatically decrypt the SSH keyfile for you when you log in to a remote machine (using the user keyring db), or ask you for the keyfile password once and remember it for the next hour or so (using the ssh-agent program in the background).

On Windows you can do something similar with Cygwin and ssh-agent, however it is a little bit of a hassle to set up. If you use WSL i'd expect the auto keyfile decryption to work comparably to Linux, without needing to configure anything

34
submitted 1 year ago by lemann@lemmy.one to c/datahoarder@lemmy.ml

Saw this posted on !technology@lemmy.ml and thought ideal to crosspost here too

At the end of Q2 2023, Backblaze was monitoring 245,757 hard drives and SSDs in our data centers around the world. Of that number, 4,460 are boot drives, with 3,144 being SSDs and 1,316 being HDDs.

This graph looks at the annual failure rate for drives more than 5 years old. The higher capacity ones look a little bit concerning IMO. This is discussed within a short section later on in the blog post.

84

Following another setback in its legal dispute with Sony Music, Quad9 has decided to block pirate site Canna worldwide. The court-ordered block was initially restricted to Germany but the music label complained that VPNs and a mobile network still allowed Germans to access the pirate site. Quad9, meanwhile, has appealed the underlying court judgment.

Ultimately, Quad9 hopes that the lower court’s blocking order will be overturned on appeal. It will continue to fight the case, even if that takes several years.

This sets a really bad precedent going forward... a bit of a low blow for Sony to go after a non-profit that doesn't have an army of lawyers

1

Links:

YouTube/Invidious/Piped link in description

1

The IAA considers privacy enthusiasts and users who block ads to be extremist.

They also criticise Apple's decision to give users the option to opt out of 3rd party tracking in apps. I'm not sure if the IAA realises advertising can still exist without tracking being a part of it!

Synopsis

In this video Louis reads the transcript of a meeting held by the International Advertising Association back in January this year.

YouTube/Invidious/Piped link in comments

202
submitted 1 year ago by lemann@lemmy.one to c/reddit@lemmy.world

Reddit's infamous ModCodeOfConduct has reopened the r/OpenAI community, calling for new moderators.

Just like with the r/HomeAutomation takeover 2 weeks ago, it seems Reddit has yeeted out all the old mods regardless of their stance.

☕🐸

1

Louis has been recieving emails showing a general dislike towards electric mobility, primarily due to the restrictions on how freely people can work on and operate these machines.

In this video he makes the point that electric mobility isn't the problem - companies are choosing to make these machines restrictive.

The primary example cited is VanMoof, an e-bike company that has folded, leaving most users unable to unlock their bicycle or transfer ownership. Unlocking the bicycle usually requires an app & key stored on VanMoof servers. A rival company "Cowboy" released an app that extracts the bike key from VanMoof servers, so owners can continue using their bike until it breaks down.

He makes the comparison to his own ebike built using off-the-shelf parts, choosing products that gave the most autonomy to the buyer. He designed his bicycle to be able to keep up with New York traffic speeds, something that many prebuilt ones cannot do due to either an underpowered motor or speed limiter.

Some criticisms are raised towards prebuilt e-bikes that use speed limiters and proprietary technologies - personally I see no problems with restrictions as long as they can be bypassed with sufficient technical skill, however that can become a slippery slope where artificial limits get normalised, possibly reaching a point where bypassing them is no longer feasible (such as unlocking the bootloader on a modern Android device).

YouTube/Invidious (Piped link in comments by bot)

1

Steam dropping support for Windows 7, 8 and 8.1 means users who purchased games for their PC during that era are SOL if their machine is not capable of running the latest Windows.

Synopsis

In the video, Louis reads a discussion thread between a Steam customer and their support team regarding older Windows versions being dropped. The customer is admittedly a bit salty in their writing. Steam doesn't directly answer the customer's questions, and instead points the customer to Steam's existing statements made about dropping support for older Windows versions.

Louis makes the argument that even though he agrees with Steam's stance on things such as piracy and their general consumer-oriented attitude, if we are dependent on Steam to launch games, especially on older systems where we can't unplug the ethernet and be able to still launch the game, do we really own the game to begin with?

Commenter views

Some commenters mentioned that this is a Chrome issue, as Steam's interface itself is a web browser and if Chromium drops support for older systems, Steam is stuck.

Other commenters mentioned it's a Microsoft issue, as more issues surface in unsupported Windows versions, it would be in Steam's best interests to drop support for these.

Another one mentioned that the DMCA provides an exemption for cracking games that you already own, if it is no longer being supported.

Links

What's your take on this?

Youtube/Invidious (A piped link should be posted by a bot below)

1

Brave Browser has started running "Block this ad" ads on Youtube, following a recent change where Youtube is blocking users that use an adblocker.

Pretty ballsy move by Brave IMO.

Louis has switched over to Brave for unrelated reasons, which was interesting to know! Personally I'll be sticking with Firefox.

YouTube/Invidious

1

It's unsurprising but disappointing that most authorised repair places are bound by policies that kind-of force customers to purchase a new device, especially in cases where their existing faulty device can be repaired on the spot for little cost.

I'm happy this repair shop owner (who decided to stay anonymous, for obvious reasons) carried out the minor repair for the customer despite Samsung not allowing this.

There's some people in the comments also talking about times where they carried out minor repairs for customers in situations where their company policy would have forced an expensive and unnecessary parts replacement.

Right to repair should create more repair options for consumers, leading to a reduction of expensive parts swaps in cases where they aren't necessary IMO

YouTube/Invidious

3
submitted 1 year ago by lemann@lemmy.one to c/reddit@lemmy.world

I don't understand this attitude at all... Some people are better off staying on Reddit IMO

1
submitted 1 year ago* (last edited 1 year ago) by lemann@lemmy.one to c/louisrossmann@lemmy.world

As far as I'm aware it's always been possible to bypass an iCloud activation lock (by directly interfacing with the flash storage) - however now the barrier for entry is so much lower with online services offering activation lock removal with a quick turnaround time.

Louis goes into much more detail in the video, however it's likely an insider at Apple doing this.

My main takeaways are: It's unlikely Apple is going to do anything about this, since these stolen & reset devices are bringing more users into the Apple ecosystem, as well as driving AppleCare sales (theft cover) and purchases of new devices. Also, since no user data is exposed, they aren't necessarily at risk of bad press, since the privacy of the original owner is not compromised.

Do you think Apple will fix the process flaw allowing an insider to unlock these devices with no consequences?

YouTube/Invidious

Edit: Fix typos

1

YouTube/Invidious

This is an interesting take from Louis.

I can't say I fully agree with his view on the moderators blacking out subreddits though - from my perspective, although the users are the primary contributors to the subreddit, the moderators are the ones who curate the community into what it is, keeping spam out and making it an inviting space for everyone.

While it is unfair for regular users to be locked out of their communities due to the blackout, I believe the mods have every right to do so. Some/most of the subreddits participating held a vote in which community members wanted their subreddit to join the blackout too, where those mods could have decided to not allow a vote to begin with.

Personal opinions aside, the rest of the video is informative, but unfortunate. I really am curious as to how Reddit's IPO will go

view more: ‹ prev next ›

lemann

joined 1 year ago