• 10 Posts
  • 109 Comments
Joined 1 year ago
cake
Cake day: June 10th, 2023

help-circle



  • I mean, OK, it’s a vulnerability and there are interesting implications, but this is hardly significant in any pracitcal sense of the word.

    the potential victim has to run their system without a firewall, has to print to the printer they’ve never interacted with before and then the attacker can run shit with whatever the printing system’s user id is, which shouldn’t be an issue on any reasonably modern distro.

    I routinely remove cups and friends from any system I run because I have no need for printing and it bothers me to see it constantly during every system upgrade.



  • I wanted to write the same thing. have the notes app do the notes thing and handle encryption elsewhere.

    as to apps, I suggest QOwnNotes. it’s markdown, highly configurable so you can make it minimalistic AF, stores notes in invidual files and folders. it also has a bunch functionality like syncing to nexctcolud and such, but I’d advise against it, just use it as a notes editor. you don’t have to selfhost anything, make it use the e.g. Documents/Notes folder and you can use syncthing to securely replicate it to other devices.











  • if they run hardware that’s not cutting edge, by all means, that’s the best solution as a first distro.

    ubuntu is important as a stepping stone. myself and everyone I know that’s on Fedora et al started with Ubuntu. we learned what’s what and how to go about doing things and after hitting the ceiling one too many times, we tried other stuff, found better havens and finally abandoned it forever.

    so I’d caution against any action aimed at hurting it. leave it be and know that it’s still the most user-friendly solution out there and the one that’s most likely to “just work” for most people. it’ll convert people over, whether from Windows or MacOS. once they’ve crossed over, they’re more likely to wander further.


  • a combination; some have swap as a btrfs subvolume, some as a swapfile in root and those are encrypted, when the system boots it requests the encryption passphrase, regardless if it coldboots or restores. restores from swap are way faster than coldboot plus all your stuff is how you left it.

    on some systems I have a separate swap partition outside of luks2/btrfs and that one’s unencrypted. when it restores from there, it doesn’t request the passphrase and the boot is even faster. that’s obviously less secure but my threat model is a lost/stolen laptop, I seriously doubt someone’s gonna forensic the shit out of my swap, it’s more likeky it’s gonna get wiped and sold.

    to fully utilise this tech, it’s essential to set up suspend-then-hibernate, another awesome feature that’s way too cumbersome to set up. the laptop suspends for like 60 minutes and if it’s not woken up, it hibernates to disk.


  • I’ve made it work on arch, debian and fedora, on a T420s, T480s, T14 AMD, MBPr 2012, each on luks2 + btrfs with systemd-boot, and it works flawlessly on all of them. the setup is super-involved and cumbersome though but it’s easily accomplished once you get the hang of it.

    the links posted here along with the arch wiki is what I used. it helps if it’s not your primary and only device, so you have time to retry until you get it right.



  • because Telegram’s UI/UX is second to none; possibly iMessage or whatever it’s called is close, albeit with way limited functionality. Signal and friends look like a PoC from 2015 in comparison. also the apps, on mobile and on desktop, have a low memory footprint with no bloated electron crap, the cross-device sync is phenomenal and there’s the virtually unlimited cloud storage. if an addon could piggyback off of that, that would be spectacular.

    however, OP’s insight as to this being against ToS is obviously a deal breaker. seeing as how they’re adamant about leaving all your shit unencrypted in the cloud I’m looking for other havens, begrudgingly; I’ve been a user from the early days.