Posts
4421
Following
316
Followers
471
Linux kernel hacker and maintainer etc.

OpenPGP: 3AB05486C7752FE1

Jarkko Sakkinen

#OpenSUSE should probably have umask when mounting /boot/efi:

UUID=1A65-1563    /boot/efi               vfat   utf8,umask=077                0  2

The default 022 umask is incompatible with bootctl.

#systemd

1
2
1
@clementd glad that it works for you :-)
0
0
1
@clementd actually if #speedcrunch had 1:1 terminal clone that would totally work for me. I like it and it is well thought, great desktop calculator.

I tried e.g. #numbat but it does stuff that I don't care. For instance if I proactively do not like calculator to understand any higher level concepts than number systems. For that sort of stuff I rather pick python or similar or wrap bc with a bash script that deals with that. Also fancy features that pile up are also compatibility issue with different calculator tool versions...

So most of the stuff that these promote is a con for my personal taste :-) But yeah speedcrunch is in desktop use super-nice.
1
0
1

Jarkko Sakkinen

I'm a big fan of #linux #kernel #gpu documentation :-) Would make total sense for trusted keys. Especially in crypto seeing code and documentation simultaneously would be an asset.

https://lore.kernel.org/linux-integrity/D05LXJUT7T5Z.39FGAGHVQ6HZH@kernel.org/
0
0
2
@clementd e.g. using English language like syntax to "improve readability" i guess. hurts my eyes tbh looks really convoluted.

not very efficient syntax to write or e.g. embed to a shell script. it looks like from surface that there's probably a shared crate or something that "everyone' uses :-) i stick to bc for now...
1
0
1

Jarkko Sakkinen

tried bc rust alternatives: they seem to improve life by re-inventing the idea with COBOL inspired syntax. #cobol #rustlang

1
0
1
I stopped using KDE after 3.5 and returned when switching to Tumbleweed. Otherwise, it is all good but this "account type" option simply should not exist at all :-)
0
0
0
... and it is also by practical means undocumented security feature.
1
0
0

Jarkko Sakkinen

Edited 1 year ago
I don't get administrator account type in #KDE or who would ever use that for anything. It would be nice if this option could be disabled from settings entirely.

Better stick to sudo, polkit etc.
1
0
0
@monsieuricon right, so it does, thanks!
0
0
0
@liw ok fair enough :-)
0
0
0
@liw https://github.com/Byron/gitoxide i'd presume that you might be aware of it already but just in case
0
0
1
@liw would be interesting to know how gitoxide performs the same task :-)
2
0
0

Jarkko Sakkinen

Edited 1 year ago
@monsieuricon BTW, I must have been doing something wrong at the time but I recall sending my public key for wot and https://www.kernel.org/doc/wot/ does not have it. still i've used signed tags as long as I can remember to past.

I recall that I have required amount of blessings for my key (need to sanity check). I guess I need to re-submit the public key, right?
1
0
0

Jarkko Sakkinen

Edited 1 year ago
@krzk This is true :-) [earlier response that i deleted was for a different person and different discussion]
0
0
0
@duxsco hey i'll check this out thanks! could be useful
0
0
0

@monsieuricon so is there some difference compared to:

gpg --output "$USER-public.pgp" --armor --export $USER
gpg --output "$USER-private.pgp" --armor --export-secret-key $USER
gpg --export-ownertrust > "$USER-ownertrust.pgp"

Not trying to argue against just trying to understand what I’m reading :-)

1
0
0

Jarkko Sakkinen

Edited 1 year ago
@duxsco Then you probably can use your own judgement but we are talking about best practices for kernel maintainers and I have hard time to see how dumping ~/.gnupg to a tar would be such.

If you want to back up public keys it is better idea similarly just export them to a separate file (and also ownertrust has an export command).

For Linux the only thing that matters is that the private master key is never stolen and that should be the only single focus of the instructions.
0
0
0

Jarkko Sakkinen

I think that the single biggest security flaw with Intel TDX and AMD SEV-SNP is the lack of spread who can test the features.

E.g. I still test new SGX features with NUC7. It is the latest and greatest in the area for open source community use.

Features like TDX and SNP are by practical means proprietary and closed features with an open source license. They do not drive any major open source projects because they are completely out of reach for the most.

I think this a real shame. E.g. I could find a lot of use for running local daemons sealed with such extra layer of protection.
0
0
1
Show older