Linux server admin, MySQL/TSQL database admin, Python programmer, Linux gaming enthusiast and a forever GM.

  • 9 Posts
  • 580 Comments
Joined 3 years ago
cake
Cake day: June 8th, 2023

help-circle



  • That would rely on the contact of that user using the admin’s public key. In most systems I’ve seen that’d result in a big flashing warning that the user’s key has been changed. So, dangerous for people contacting you for the first time, much more obvious if the 2 users have been talking before that point.

    Other people have raised the much more interesting and potentially dangerous point that it’s very difficult in this context to make sure that a particular public key corresponds with a particular user. I’m way more used to sysadmin style issues where you have a small number of known keypairs, while in this context it’s a large number of mostly unknown keypairs, so you need some way of confirming that. I’m starting to understand why this is a much thornier issue than it appears on the surface.



  • As long as the admin doesn’t possess the private key, that solution still prevents the latter issue. If the admin swaps out your public key for one they control, they could technically impersonate you and read messages after the swap, but not read any messages from before. The user would be unable to use E2EE as soon as the key is swapped, so the only real issue here is impersonation.

    An admin could theoretically take over a user’s account today, so there’s not really a new vulnerability here. And with E2EE, there’d be a big clue about something funky happening with the public key changing.

    EDIT: Oh.

    These aren’t encapsulation keys (a.k.a., asymmetric or “public key encryption” keys). Encapsulation keys belong to the MLS KeyPackages, which are NOT planned to ever be logged in a key transparency system. The KeyPackages will be signed by the keypair whose public component is stored, however.

    That seems… strange? Not sure why that approach was chosen.





  • Cat bites are really nasty, like losing a limb or worse

    Not that bad, but yeah. Cat scratches heal just fine. Cat bite? Instant course of antibiotics, and also a rabies shot if it’s not your own cat.

    The next time, throw a glass of water into the fight or slam some pot lids together to make a scary noise to interrupt the fight

    Absolutely. Throwing water at fighting cats is a great method of getting them to disperse. By far the safest and most reliable method.

    The vast majority of that final paragraph is just good advice for cat owners generally, not even specifically for cats that hate each other. Neutered cats have much better health outcomes as there’s just less that can go wrong. Giving them plenty of routes to move around the room just generally results in more active, happier cats. Also, scratching posts are mandatory if you don’t want them attacking your furniture. They have a physiological need to scratch, give 'em somewhere to do it.


  • The way some US citizens engage with their government really reminds me of the good tsar, bad boyar phenomenon common in Russia.

    Trump/the tsar couldn’t be doing the thing that’s hurting me, he just doesn’t know about the situation! If only the state governor/boyar wasn’t so horrible, corrupt and hiding the situation from the federal government, then Trump/the tsar would obviously step in and fix the issue.








  • In general, it’s true that Linux doesn’t need to restart for most updates. However, if you get a power cut right in the middle of an update, that could leave your OS in a really bad state. Therefore, for safety reasons, some distros (apparently including CachyOS) do updates in a ‘safe mode’ on boot, so that if there’s a power cut it just rolls back cleanly.

    In short, how exactly distros approach updates differ slightly. A tradeoff between safety and convenience.