Yo thats awesome. Guess somebody needs to port android auto/ Apple car play to Linux now lmao

Yeah that was my feeling. It seemed unrealistically low.

If btop is to be believed my server pulls a tiny 1.5W on idle. Given everyone else’s numbers I’m wondering if that’s true of btop is confused. It’s an old optiplex 3050.

Regardless my main rig which is regularly running expensive simulations is often ~200W so my server and home labbing is a rounding error

Really there is no way big tech can force me to use their app? Ok so you know how the open standard for TOTP is a six digit code computed from the time and shared secret? Well every student at the university of California and every employee at many companies across the US has to use an Authenticator app called duo which uses a 3 digit code generated by the app at the moment you attempt to log in. How does it do that? No idea it’s closed source. Is it even a formula like the TOTP open standard? Probably not I’d guess duos servers just send a code to both sides when you attempt a login. And would you look at that suddenly we have TOTP that I can’t write myself and I’m forced to use some shitty app.

Now I do recognize the point you’re making but I want to emphasize it’s not about attestation being in the metadata or not. It’s about open standard compliance. As the open standard is written even if you have to have hardware attestation you can build the passkeys yourself (because this is functionality all password managers are quickly starting to have) and frankly having each passkey being device locked is good security practice to protect you from credential stealers and related malware. You’d still be in control and you could still sign in to as many devices as you want. You’d just need to make a new passkey for each one if you don’t wanna sign in the old fashioned way with a password and dual factor and such.

The abuse scenario you describe would require a departure from the open standard. Is this possible? Of course. As I said some companies already do this with TOTP. But I don’t see that as a structural fault of passkeys that TOTP somehow doesn’t have like the article tries to imply. Both only work well for the consumer if the open standard is adhered to.

This is actually a terrible take. Passkeys provide a very large security benefit over passwords and have an open standard.

It’s particularly ridiculous that they seem to think TOTP good passkey bad. They solve the same problem: symmetric persistent encryption like passwords is very weak. TOTP solves this my making it not persisting and passkeys solve this by making it asymmetric. Passkeys are mildly more convenient because you don’t have the copy a code over.

Both also have the same potential for abuse, any service could require you use their specific app. The fact that this article makes it sound like TOTP is a perfect open standard while passkeys are a Trojan horse for abuse is ridiculous. If most services are using the open standard for TOTP why wouldn’t they for passkeys? Also not all services do obey the open standard for TOTP. I’m sure I’m not the only one who was forced to install the duo Authenticator because their institution was somehow sold on their protocol being stronger than the open standard.

TOTP and passkeys are comparable and both with doing.

The web app keeps a local synced copy too btw. Biometric is fair tho

The web interface is hosted directly by your vaultwarden interface so it’s not lockdown-able. The only things that are would be the browser extension and phone apps. Both of which are formally unnecessary because you can always just use the web interface. I’m sure if they ever locked down there’d be community versions in no time as they’re basically just web wrappers anyway.

The “want to learn” is gonna carry a lot of weight here but I think and arch based distro like cachy works well for this. Cachy was my first distro and I really wanted to learn so it gave we a working starting place from where I could tinker and replace parts one at a time until they fit my liking. If I were to reinstall today I’d do plain arch since I know what I want and don’t need Cachy’s defaults anymore. Obviously everyone has their preferences but I think cachy is a really solid approachable distro for beginners, there’s a reason it just passed steamOS to claim the throne of most used distro on the steam hardware survey

Keep it GPL is just keep it free as all it does is maintain further downstream projects also stay free.

Now I guess your comment about enforcement is true that the original licenser has the power to enforce their license. I guess that will make the coming decades interesting as the original licensers of these projects die. Surely when Linux finally kicks the bucket people don’t immediately get free rein to violate Linux’s GPL? Regardless I still don’t see how that gives the owner any power over you besides enforcing you keep it free. You can still do whatever you want with the code.

Fair enough that’s an argument I hadn’t heard. I must admit “Free but you must keep it free” not being free enough for you strikes me as such a dumb argument I can’t fathom it being made in good faith but fair enough I guess.

Now I will say your comment about durable intellectual property ownership is interesting philosophically but I also don’t agree. No one “owns” GPL code. It’s public for everyone and anyone can fork it or whatever. GPL doesn’t give the original owner any power over others it just requires the code which was born free to stay free.

Corporations are by their nature entities with priorities that are not aligned to the good of society. It is natural and obvious that we do everything in our power to compel them to do the best thing for society rather than the best thing for them.

Also while valve tends to be a pretty fair company they don’t need to be proprietary. Their product is selling game licenses and server space for cloud sync, none of that requires a closed source client. So while valve may be my favorite corpo they don’t get a pass from my previous statement about not being sympathetic to wanting to profit of community projects without giving back.

The exact problem you point out is in my view a feature not a bug because it means there is an economic advantage to someone doing what steam does but open source. Which is exactly the sort of incentive that helps capitalism help people.

Hmm you could very well be right. I guess I’m being to reasonable by knowing new rust code is not automatically (and not usually) more secure then old c battle tested c code. Shareholders and CEOs don’t understand that, I wouldn’t be surprised if someone’s been convinced rust is axiomatically more secure and bankrolling the migration over it

Yea know that is a fair point. I guess I struggle to see any other reason to support this? Even though I believe rust is nominally more secure it’ll be a decade before any core utils clone will be as hardened as the original just by virtue of the original having decades of bug finding and fixes done already.

I don’t think canonical would go through the effort under normal circumstances but I think they’re just taking the opportunity in front of them to ride the rust hype into a less copyleft ecosystem.

This actually ties into a broader complaint I have that the rust ecosystem is built around MIT due to influence of the corporate backers of the rust foundation. Which is unfortunate because I actually really love rust as a language.

I actually an agree an independent rust project would be really cool. If it was also GPL. I have yet to encounter any argument against GPL that doesn’t boil down to corpo boot licking.

You say “Even if it ends up being in a proprietary program, it’s better than not being able to use the code”. This is a bad faith argument. Everyone can use GPL code freely, the restriction is only that you must also publish under GPL if you publish. I’m sorry your favorite corporation can’t profit off community projects without giving back to that community… not. If GPL was a real problem BSD would have overtaken Linux ages ago. But it didn’t because GPL is good not just for the community but for the project. The only people that don’t stand to gain from GPL are corporations that want to monopolize the technology.

Uh call it whatever you want but canonical pouring money and resources into development of corporate friendly licensed clones to existing tools so they can avoid copyleft restrictions in the future is not good. I never understand when people feel the need to defend corporations obviously harmful behavior.

Because Canonicals real goal is to move Ubuntu entirely to corporate friendly licensing under the pretense of migrating to rust. Obviously they leave the original untouched, it’s a matter of adoption. Without the oxidization argument nobody would have gone along with Ubuntu just deciding to do a clean room implementation of gnu tools in corporate friendly licensing, by making it about oxidation they are able to manipulate a large portion of the rust community into contributing/supporting their license laundering.

As a developer I love rust but canonical can fuck all the way off with this shameless license laundering.

What kinda dependency hell? I’ve been running my jellying server with it installed via pacman for over year and never had any problems. I admit I’ve also not messed with docker much in general but I assumed that would be more annoying cuz it would have to be updated separately and such

Why is docker an upgrade?

Cool project idea! Some questions:

It seems the project currently exclusively watches docker related stuff. Is there any plan to watch services more broadly? Most of my stuff is running directly on the machine as a systemd service without any container (probably bad practice sue me). I’m not sure how feasible it would be to chase down everything that’s supplying a local host endpoint tho.

What’s your AI workflow like? What model, what harness etc