It’s a *feature*

There exists shims that are signed by Microsoft and were not revoked. Normally this would be fine but these shims had weaknesses that allowes hackers to load any code using them. Normally the shims should only run other signed/trusted code. These vulnerable shims can be used to bypass secure boot by replacing your existing bootloader with the shim and then running rootkits/hackerOS/whatever and bypass bitlocker using TPM or just running a level 0 virus that can’t be detected by the OS on any PC which trusts Microsoft’s keys (99% of all PCs)

To prevent this you’d have to not trust the vulnerable shims by either adding them manually to the exclusions list or using your own secure boot keys which would only trust the few bootloader files your pc uses and no other files.

Worst case: it behaves as if secure boot wasn’t on. Without secure boot you wouldn’t need this exploit cause then you can replace the bootloader with whatever you want anyways. With or without secure boot you need administrative permission to replace the bootloader so this is only an issue after your PC is already compromised or if someone had physical access to your PC.

tldr: Either use your own keys or don’t trust secure boot.

I have a Server with ~16 podman services, each their own user, network namespace and uids. This is managed using NixOS and Home manager (which supports quadlets) but I am changing my setup to a single node k3s cluster with user namespaces because that seems simpler to manage. Here a snippet for how the subuids/subuids are defined:

users.users.<username> = {
        subUidRanges = [{
            startUid = 100000+65536*( config.users.users.<username>.uid - 999);
            count = 65536;
        }];
        subGidRanges = [{
            startGid = 100000+65536*( config.users.users.<username>.uid - 999);
            count = 65536;
        }];
        home = "[...]";
        isNormalUser = true;
        linger = true;
        group = "users";
        openssh.authorizedKeys.keys = config.users.users.root.openssh.authorizedKeys.keys;
    };

This is the year of the OpenAI bankruptcy.

https://youtu.be/tU48ouWNr8E

Fair enough, I meant consumer demand as in not ai and data centers

Ram demand expected to drop another 40-50% in Q3?

How are you running podman? As a rootful systemd service or as a rootless user systemd services?

If you have an openwrt compatible router then you can use that as the tang server.

Also you can tell clevis to use both tpm and tang and require both to work.

All things are solved by lowering your standards far enough.

Straight to jail

See also “The human condition” and “It’s a canon event!”

Using a lot of words to say “It won’t affect this quarter”

If you delete a still opened file on Linux then the file will disappear for all processes which didn’t already open it, all programs that did already open it can still read and write to it and the file on disk will never be overwritten (as in, used for other files) as long as there’s still a process with the file open.

Simplifying how it works: The file you see is a link to the actual file(inode), when a program opens a file using this link they get a copy of the link. As long as one link/copy of it still exist the file won’t be deleted. When a program closes all its links get cleaned up so on shutdown all files which only have processes referring to them get marked as deleted.

I use bitwarden send, all my devices already have access to my password database and i can save and download files or text though it. You can also use the URL to let other devices access it if you want.

Maybe try an atomic distro? It’ll still break but you can roll back and deal with it later.

How about a dislike button? Maybe even a rating system where you can vote how good a video was on a range?