Skip Navigation

InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)U

utopiah

@ utopiah @lemmy.ml

Posts
4
Comments
1401
Joined
4 yr. ago

  • Passkeys

    Jump

  • Yep. To give you some example I login to my self-hosted forge this way. I also use PAM on my desktop to login this way. I also sudo this way. Unfortunately I don't use this on my phone anymore as I switched to GrapheneOS which requires GooglePlay Services for this kind of auth mechanism (with possible work around https://codeberg.org/s1m/hw-fido2-provider that I didn't try yet).

    Please note I'm no security expert but to clarify few things are important precisely when you are not a professional :

    • does it support standards? Basically acronyms like TOTP, FIDO, U2F, are what you should be looking for
    • is it supported without additional software by supporting standards? can you use e.g. PAM on Linux with it or does it need a companion "app" somehow?

    If the answer to either is "maybe" then I recommend before buying you search online and insure it does work with your specific setup. If the answer though is yes to standards and no to additional software then you are, unless there is a weird bug basically, pretty sure to be able to use it however you want, wherever you want.

    Sidenote that it's the same heuristic for IoT. If you buy a "brandname smart thing" then you probably need their idiosyncratic stack whereas if you rely on standards, e.g. Zigbee or ZWave, then you are nearly guaranteed a smooth experience.

    Hope that helps. I know that navigating acronyms can be tricky but IMHO here it's worth investing a tiny bit of time to recognize them.

    Finally as we are talking about open hardware and security I would also add 3rd party audits. I don't have the competency to insure that the hardware and software implementation are cryptographically safe. I can test that it does in some case what it claim to do, e.g. lock after 3 failed attempt, but could some kind of weird collision hash or bad pseudorandomness be used to practically limit the pool of potential keys or passwords? I don't have the knowledge for that. I also can't trust that NitroKey did it right based on the claim of their website. So... audits help bridge that gap in trust. If I can't trust the vendor and I don't have the expertise despite being entirely open then I look for others who did verify on my behalf.

  • Passkeys

    Jump

  • Yes precisely because I don't rely on Microsoft or Google to handle that.

    I have my own physical keys. I started like most with YubiKey, including a YubiKey Bio, then learned about NitroKey https://www.nitrokey.com/ thanks to NLNet https://nlnet.nl/project/Nitrokey-3/ so now I have passkey that I could verify https://certification.oshwa.org/list.html?q=nitrokey as they are certified and audited https://www.nitrokey.com/news/2015/nitrokey-storage-got-great-results-3rd-party-security-audit

    That being said... IMHO your doubt raises an interesting question, why? Why do you NOT trust them? Do you imagine they have your data? Do you think an interactive explanation where one exchange data would help to understand why no trust is required or maybe better, where it matters?

  • How to remove DRM from lcpi file?

    Jump

  • NoPeek - free open source Android app that detects nearby Meta Ray-Ban glasses and VR headsets via Bluetooth

    Jump

  • Well fairness is pretty much a left-wing principle whereas excluding others from the inner group is a right-wring principle... so it makes sense.

  • NoPeek - free open source Android app that detects nearby Meta Ray-Ban glasses and VR headsets via Bluetooth

    Jump

  • Good question, seems newer but rely on the same mechanism.

  • NoPeek - free open source Android app that detects nearby Meta Ray-Ban glasses and VR headsets via Bluetooth

    Jump

  • FWIW I think detecting VR with Meta Quest, Apple Vision Pro, Pico VR is quite funny. It's like ... hard NOT to detect such devices. You see a huge slab of plastic on the face of someone potentially looking in your direction and the cameras are numerous and visible.

    So... for Meta Ray-Ban and Oakley Meta definitely because they are designed to look like traditional glasses and that's IMHO very wrong. For others like Snap Spectacles or TCL RayNeo it's quite obvious but still, OK makes sense.

    Sadly as 404 media and others reported a lot of abuse came from wearing sneakingly such glasses then coercing people with the footage. I hope people who do abuse those tools do get prosecuted properly.

  • Is Debian on 256 MB RAM no longer possible?

    Jump

  • Alpine in container is typically considered the smallest one can conveniently use (not going through LinuxFromScratch or writing your own OS). I did some tinkering a while back ending up with 14.29MiB memory footprint.

  • How Google Tracks Everything You Do and How to Stop It

    Jump
    • there is more content on PeerTube already that you can watch during your lifetime
    • monetization exists on PeerTube exists and is not based on advertising (which has terrible side effect on privacy)

    So I think if one is looking for PeerTube to be a copy of YouTube in terms of both content and monetization they will be disappointed... but also maybe that's the problem in itself. YouTube monetization is damaging (forcing to be a popularity contest) and bring poor content in. Sure some very few content creator are still on it but a lot already moved away. The assumption though is that there is a link between popularity and quality. It's time to reconsider.

  • How Google Tracks Everything You Do and How to Stop It

    Jump

  • Peertube and others are not nearly anp viable option yet

    Can you please clarify why not?

  • HP has become the third premier sponsor of the Linux Vendor Firmware Service (LVFS) and fwupd, joining Dell and Lenovo in contributing $100k+ annually to support firmware updates on Linux.

    Jump

  • I'm not sure you're understanding my perspective so I can make it explicit : I took their comment as snarky, not helpful, trying to make their view as objective without helping me and others understanding why their position was better.

  • HP has become the third premier sponsor of the Linux Vendor Firmware Service (LVFS) and fwupd, joining Dell and Lenovo in contributing $100k+ annually to support firmware updates on Linux.

    Jump

  • Thoughts on privacy focused smart glasses?

    Jump

  • HUD, head up display, being able to have information displayed on the move without using your hands.

  • Thoughts on privacy focused smart glasses?

    Jump

  • There are some already, e.g. https://docs.brilliant.xyz/ with firmware you can replace or https://mentraglass.com/ and I even made one by sticking a RPi with its tiny camera on 3D printed frames https://twitter-archive.benetou.fr/utopiah/status/1449023602079240194/

    I'm not saying it's a good idea or that it's private enough, just that it's not a theoretical questions, alternatives to Meta or Google Glass do exist already and some of them are not cloud dependent.

    IMHO what's important is to be explicit about usage, understand how it's used and have informed consent. If you use them to be sneaky and hurt others, even if they are "privacy focused", fuck off.

  • Waydroid is now available in Debian

    Jump

  • I always liked the potential of Waydroid... but in practice never used it.

    If you actually use it, what do you use it for?

  • HP has become the third premier sponsor of the Linux Vendor Firmware Service (LVFS) and fwupd, joining Dell and Lenovo in contributing $100k+ annually to support firmware updates on Linux.

    Jump

  • Were you not condescending? Don't you believe you started this?

    You could have said :

    • Revenue is not precise enough, operational profit would be a better metric
    • Operational profit is more representative of the situation and for HP it's [insert value]

    or basically anything that prompts a discussion by kindly clarifying.

    Instead you basically said "Apples are not oranges" and now you are saying replies are toxic.

  • HP has become the third premier sponsor of the Linux Vendor Firmware Service (LVFS) and fwupd, joining Dell and Lenovo in contributing $100k+ annually to support firmware updates on Linux.

    Jump

  • earnings before taxes was 3 279m so 100k is well nothing.

    Genuinely confused now, are you saying "your nothing" is different from "my nothing"?

  • HP has become the third premier sponsor of the Linux Vendor Firmware Service (LVFS) and fwupd, joining Dell and Lenovo in contributing $100k+ annually to support firmware updates on Linux.

    Jump

  • Damn, sounds like a wild guess though, how about revenue? /s

  • YSK: you can buy (email) accounts anonymously using darknet markets

    Jump

  • Why all that version over using the public access computers of your local library?

  • HP has become the third premier sponsor of the Linux Vendor Firmware Service (LVFS) and fwupd, joining Dell and Lenovo in contributing $100k+ annually to support firmware updates on Linux.

    Jump

  • Right... which... is why I wrote revenue and not operational profit? Was I unclear? What should I have shared instead? Please feel free to clarify directly with whatever you believe would be better and why, we can all learn.

  • HP has become the third premier sponsor of the Linux Vendor Firmware Service (LVFS) and fwupd, joining Dell and Lenovo in contributing $100k+ annually to support firmware updates on Linux.

    Jump

  • lol, $100k+... HP revenue in 2024 was $53,559,000k.

    Dell same year $88,000,000k and Lenovo $69,000,000k, so ~$50B to $90B

    I let you calculate the percentage but... I'd guesstimate it's approximately nothing.

  • Technology @lemmy.world
    utopiah @lemmy.ml

    ‘They’ve pickled each others’ brains’

    sf.gazetteer.co /theyve-pickled-each-others-brains
  • Privacy @lemmy.ml
    utopiah @lemmy.ml

    39C3: Power Cycles - media.ccc.de

    media.ccc.de /c/39c3
  • Privacy @lemmy.ml
    utopiah @lemmy.ml

    I made 3D printable cryptography bracelets, cipher/decipher on the go!

  • Technology @lemmy.ml
    utopiah @lemmy.ml

    How China has ‘throttled’ its private sector

    www.ft.com /content/1e9e7544-974c-4662-a901-d30c4ab56eb7