𝒍𝒆𝒎𝒂𝒏𝒏

Hey! Please contact me at my primary Fedi account: @lemann@lemmy.dbzer0.com

https://lemmy.one/u/lemann@lemmy.dbzer0.com

  • 2 Posts
  • 28 Comments
Joined 1 year ago
cake
Cake day: June 6th, 2023

help-circle


  • Flash drive hidden under the carpet and connected via a USB extension, holding the decryption keys - threat model is a robber making off with the hard drives and gear, where the data just needs to be useless or inaccessible to others.

    There’s a script in the initramfs which looks for the flash drive, and passes the decryption key on it to cryptsetup, which then kicks off the rest of the boot mounting the filesystems underneath the luks

    I could technically remove the flash drive after boot as the system is on a UPS, but I like the ability to reboot remotely without too much hassle.

    What I’d like to do in future would be to implement something more robust with a hardware device requiring 2FA. I’m not familiar with low level hardware security at all though, so the current setup will do fine for the time being!

















  • Oh wow the comments on Phoronix for this one are bonkers.

    From what I understand (because it wasn’t clear to me from either of the TLDRs posted here) Nvidia’s proprietary graphics driver has been calling parts of the kernel that they shouldn’t be, because their driver is closed source.

    These seem to be parts of the kernel that another company may own patents to, but has only licensed it to the kernel for free use with GPL open source code only, i.e. closed source/proprietary code is not allowed to use it.

    Nvidia seems to have open sourced a tiny communication shim to try and bypass this restriction, so their closed source driver talks to the shim, and the shim talks to the restricted code in the kernel, that Nvidia does not have a license to use. This is a DMCA violation, hence why the Kernel devs are putting in preventions to block the shim, as far as I can see.

    I don’t understand the small minority of commenters there defending a la soulless corp Nvidia, who is blatantly in the wrong here. Some commenters have gone as far as to call the Linux kernel maintainers “zealots”, would not be surprised if they are alts for Nvidia devs…

    Edit: typo