𝒍𝒆𝒎𝒂𝒏𝒏

Hey! Please contact me at my primary Fedi account: @lemann@lemmy.dbzer0.com

https://lemmy.one/u/lemann@lemmy.dbzer0.com

  • 2 Posts
  • 271 Comments
Joined 1 year ago
cake
Cake day: June 6th, 2023

help-circle

  • Flash drive hidden under the carpet and connected via a USB extension, holding the decryption keys - threat model is a robber making off with the hard drives and gear, where the data just needs to be useless or inaccessible to others.

    There’s a script in the initramfs which looks for the flash drive, and passes the decryption key on it to cryptsetup, which then kicks off the rest of the boot mounting the filesystems underneath the luks

    I could technically remove the flash drive after boot as the system is on a UPS, but I like the ability to reboot remotely without too much hassle.

    What I’d like to do in future would be to implement something more robust with a hardware device requiring 2FA. I’m not familiar with low level hardware security at all though, so the current setup will do fine for the time being!


  • If MIT AppInventor is still kicking around, you should be able to use it for this… although sadly you won’t have access to the source code since it’s a Scratch-like way to create apps.

    By default the Android voice assistant uses Google tech AFAIK, if you’re after a truly source-available solution then there’s ”Futo voice input" to handle STT, and “RHVoice” to handle TTS - though these would still need a HTTP API bridge to do what you want


  • I think so, assuming these malicious packages are all primitive enough to just look for the single file in a user’s home folder lol. The only downside here is needing to provide the keyfile location to ssh every time you want to connect… Although a system search would pretty much defeat that instantly as you mention

    SSH keyfiles can be encrypted, which requires a password entry each time you connect to a SSH server. Most linux distros that I’ve used automatically decrypt the SSH keyfile for you when you log in to a remote machine (using the user keyring db), or ask you for the keyfile password once and remember it for the next hour or so (using the ssh-agent program in the background).

    On Windows you can do something similar with Cygwin and ssh-agent, however it is a little bit of a hassle to set up. If you use WSL i’d expect the auto keyfile decryption to work comparably to Linux, without needing to configure anything











  • I’m sorry to say this but, your way of picking software is wrong. You should always look for the open source software first, then use proprietary software.

    I agree here, this is what I generally do nowadays. The exception for me is only software that I’ve been using for years, such as Plex and Niagara - finding an open source alternative for a proprietary solution is the easy part, the hard part is actually making it fit into your workflow.

    This is why I’ve settled on just jumping ship to an open source option when the existing proprietary option is no longer fit for purpose (hackable, “transparent” etc) because of the time sink.

    Niagara to Kvaesitso was really easy though, thanks to that developer and contributors absolutely knocking it out the park with the amazing search and UX.

    But using Plex when Jellyfin exists is just wrong. I personally have a jellyfin instance, and there’s nothing jellyfin can’t do when compared to Plex.

    Jellyfin is great, particularly for us and tech enthusiasts. For non-techies though, the first hurdle of different clients for mobile/desktop/insert-platform-here is a very tough sell (each with a slightly different UX, rearranged settings etc) and is even trickier when there are no apps available for games consoles and some smart TVs. I share my Plex server with my partner and parents, so moving to something else seems like more trouble than its worth at the moment.

    Regardless I do have my eye on Jellyfin (and particularly the music apps like Finamp, since that is my personal primary use case for Plex) - for TV libraries and Movies the gap is closing fast, I believe the only major thing that is missing is the “Skip intro/outro” on some of the clients, but for music sadly the gap is only widening. It’s very much a watch-this-space type thing though as the community catches up, but I feel the sonic analysis in Plexamp and the many features built on top of that are going to take a lot of volunteer time to replicate

    Encouraging proprietary software makes them stronger and erodes our rights. Like using chrome instead of Firefox is voting for a future where remote device attestation and forced DRM is a normal thing. Do you want the corps to eradicate your free will?

    I agree.

    With remote attestation sadly we are already there on Android: most apps require GMS even when they don’t need it, and some paranoid non-banking apps unnecessarily call Google’s attestation API, and subsequently block some actions if your device doesn’t pass.

    I personally run a rooted device for full control over app backups, my device’s BMS, and various other stuff - where possible I pretty much use open source& source-available apps, as well as browser shortcuts and PWAs, where I have the freedom to perform any desired action without being restricted by any attestation. My partner has a very keen interest in the freedom offered and is actually very annoyed at the state of things on modern Android - but sadly the attestation issues and Samsung Knox in particular are big showstoppers (I use an FP3, so no “security void” hardware fuses here)



  • Free google play credit, I usually get an email every year for it

    But I do pay for Plex, despite Jellyfin being a thing. If I like something and it’s worth it to me personally, why not 🤷‍♂️… but you will never find me defending their kinda crappy decisions like the new Discover feature, removal of “All Songs” from the plex apps in favor of moving people to Plexamp, removing the Gallery sync a few years ago etc.

    Some people want their software to be 100% FOSS all-eyes-on-the-codebase, others just do a balancing act based on their personal values.

    I value my software to be “transparent enough” in how it operates, “just work”, and hackable to some extent - if I really wanted to I can swap out the ffmpeg binary that Plex uses for transcoding to something else (doesn’t remove the Plex Pass limitation for those curious), I can hook into the server API to change ambient lighting colour based on the cover/background of whatever media is playing, I can create speakers running a Linux board to cast Plex media to, etc. But once that hackable ship sails, then I will look to FOSS alternatives.

    For Niagara, everything “just worked”. No noticeable bugs, fast search, consistent feel and design, useful contextual info (e.g. next calendar event shows under the clock), and gestures that made sense for its overall UX. Using it felt less like you were using a “launcher”. The yearly sub was cheap enough that I wouldn’t mind covering for it if I didn’t get credits, and having a single person working on software usually comes with a high level of attention to detail (particularly in performance and UX) but it does have the downside that the experience may be more opinionated and closed compared to if it was a community-driven FOSS project instead IMO.

    Alas, google didn’t send credits this year, Niagara made less sense for value/worth-it compared to Kvaesitso, so I abandoned it.

    For me, Kvaesitso does everything in a slightly different, much more customizable way, and being FOSS was one of the things that made it particularly attractive as a replacement




  • Edit: sorry, I may have misunderstood your post - free email != email masking.

    My original post below…


    Curious why you consider email address masking services as for those with “drastic anonymity” requirements?

    I personally don’t think so: they are pretty much just a digital P.O. box, and are typically not anonymous in any way (subpoena/court order to the provider). They are built-in to Firefox too, it will automatically create new ones OOTB as you sign up on websites, if you click the autofill.

    They are however IMO one effective tool out of many to restrict the ability of data brokers and hacking groups (aggregated breach datasets) alike from making money from your online presence without your consent.

    In almost all cases this data is freely searchable for law enforcement and private investigators, allowing them to avoid going through the legal system to investigate and possibly detain you for things you’re not guilty of