Yes siree, the excitement never stops!

  • 0 Posts
  • 60 Comments
Joined 10 months ago
cake
Cake day: December 7th, 2023

help-circle


  • This person asked if they can make PopOS secure via TPM.

    I am saying that while yes, you can, there isnt much point, because setting up LUKS to work with TPM is inconvenient, easy to fuck up, and basically offers no additional protection against all but extremely implausible security scenarios for basically everyone other than bladed server room admins worried about corporate espionage who are for some reason running bare metal PopOS on their server racks.

    Like the only actual use case I can see for this is /maybe/ having a LUKS encrypted portable backup drive, but even then you can still base the encryption key in the actual main pc’s harddrive without using tpm, though at /that and only that point/ are we approaching parity between the difficulty of using or not using tpm to accomplish this.


  • Oh ok so the use case here is if this casual linux user asking this question has only their harddrive stolen from their pc or their laptop in their home or apartment or workplace, not their whole pc.

    Mhm that seems likely.

    I guess this maybe makes sense if youre running like a server room, but chances are low thats the actual context of this question.

    Why would you run PopOS on a large operation’s servers?





  • Ok… so… if you have TPM… and LUKS…

    You still have a scenario where the encryption key is still on your physical device, LUKS with or without TPM, or … some kind of TPM based Linux encryption solution I have never heard of?

    Does Windows Secure Boot work on Linux via the TPM?

    No…

    Am I missing something?

    Theres no point in involving TPM in securing a linux computer.

    In a scenario where you’ve physically lost your computer, using TPM or not it wont matter if your pc gets into the hands of someone who can attempt to brute force the keys.

    If your pc is remotely compromised to the point it has something on it that can grab your keys, it also will not matter if you are using TPM in some way.

    The only practical use of full disk encryption is if your linux pc and or laptop gets stolen and falls into the hands of a non tech savvy person, and in that scenario, going through the trouble of correctly binding LUKS to TPM will have just been a waste of time.

    Thus, you should probably just use LUKS and not bother routing it through TPM.


  • Sure but you dont need to use TPM at all to use LUKS.

    You can store the encryption key on the harddrive, in the LUKS partition layer.

    Like thats the default of how LUKS works.

    Im really confused why people think TPM needs to be involved in anyway when using LUKS.

    Generally speaking you have to go out of your way to correctly cajole TPM v1 or v2 to actually correctly interface with LUKS.






  • I would just like to point out that being terminally online has almost nothing at all to do with being technically savvy.

    Huge numbers of people who are terminally online are really only adept at using tech at a surface level, and often confuse this /skill/ for things like knowing how back end programming works, understanding what software development entails, etc.

    Actually technically competent people go to great, astounding lengths to make decent software very easy to use for the average person. UI/UX, front end devs, back end devs, database management, and I would say testing paradigms for possible bugs, but the industry seems to have largely abandoned giving a shit about that.

    Even here on lemmy I often find myself in discussions which turn into arguments which turn into me finally realizing that the person I am talking to has absolutely ludicrous ideas about tech, the tech industry or a specific software.

    Such people say and truly believe in obviously nonsensical things, or approach topics from a standpoint that makes it obvious they are really just power users of a particular kind of software, and have developed into basically superficially convincing fanboys or fangirls for it.

    They reveal that they only have knowledge from a bit of experimentation and mostly just following a whole bunch of uninformed discussion about some new tech buzz word, and lack understanding of the important basic concepts, or actually relevant dynamics at play, which they likely would /not/ believe if they had ever actually worked in the tech industry, or developed their own software, or contributed usefully to some open source project.

    A whole key thing about the tech industry is that it is dominated by reverence for impressive sounding tech buzzwords that promise some new and revolutionary feature, when in reality such things are nearly always minor, iterative improvements on something that came before.

    A high number of people are easily bamboozled by such things.

    Basically… you are not immune to propaganda?

    Then tech world has: You are not immune to marketing.

    A great example is the current craze over ‘AI’ generated content.

    OpenAI, Stable Diffusion, these kinds of things?

    None of them are capable of the vast majority of the kinds of processes that describe intelligence, but people will argue vehemently that they do, because they are not tech savvy, do not know anything about how the underlying tech actually works or what its capable of, or even what the word intelligence means.

    It can do cool and neat things, and its branded or marketed as AI, so it is!

    But, its not.



  • Specifically for antiwork:

    Because they are either generally not very well informed or politically well versed and just know that work sucks,

    Or they do not have very much free time to follow meta news about reddit and are unaware of what is going on,

    Or they just have not heard of lemmy yet,

    Or they have had some kind of technical trouble trying to sign up for or use lemmy in the way they would want to,

    Or they are not very not very tech savvy and do not understand the FOSS benefits to a discussion board or why or how thats relevant to capitalism,

    Or they are basically hypocrites who prefer an echo chamber that is comfortable to a somewhat less echo chambery option and are really just into the whole scene superficially and do not really actually care for having non contradictory and inconsistent views + personal actions/behaviors.

    Lots of them probably fall into different categories and many probably fall into more than one.


  • Yeah… what this likely means is one or both of two things, for this Portal Demake and the Source 2 TF2 thing mentioned by another below:

    1: Valve is still quite protective of their IP and may be working on their own new releases of some kind in these IP franchises.

    and/or

    2: Valve is still quite protective of these IPs and may have identified something like serious misconduct regarding something about these particular projects, or the people working on them… or they just are not looking to be even good quality games, and Valve does not want their actual games to be associated with or confused with games they expect to be of low quality.

    I realize option 2 there is a bitter pill for many to swallow, but we are talking about a gaming company that is fairly well known for taking actually good mod ideas and at least attempting to hire or in some capacity work with the devs to create what often turned out to be successful games.

    They are notorious for high standards in their own IPs. You’ve got Black Mesa and I think theres one HL2 mod that focuses on you as Commander Shepard from Opposing Force that were both actually greenlit to be sold, for money, as games on Steam, as well as a large number of successful HL2 mods that were not cancelled and are distributed for free by Steam, including Entropy Zero 1/2 and MINERVA.

    Its actually pretty uncommon for Valve to DMCA Cease and Desist over mods… theres probably more at play here than just Valve are big meanie heads.


  • That is a neat story, thanks for sharing!

    Best I’ve got doesn’t have to do with Godot, but I think its neat.

    The year is 2003 or 4, and I am beta testing the 0.5 release of Project Reality, which later more or less evolved into Squad.

    I know nothing about coding at this point being still in middle school.

    What I do possess is apparently pattern recognition.

    We are in a last minute waaay overextended beta testing session trying to iron out a mystifying bug:

    The whole new feature of implementing squad specific kit bags that are only obtainable at certain in game locations is working.

    But… sometimes it is not. At all. Sometimes you can grab an unlimited number of kits without restriction, sometimes you cant and have to follow the newly coded rules that limit kits by being in a squad, and having a total pool of requestable kits per squad and per your whole team.

    We get in vehicles, we get out of vehicles.

    We go to different parts of the map.

    We die then respawn via suiciding.

    We die then respawn via being shot, killed as infantry with different weapons, killed inside different vehicles.

    We join and leave amd create and disband squads.

    We die on the water, we die on the land.

    We die on islands, we die on beaches.

    We shall never surrender!

    Er, well the goof off testers wont, the devs are getting frustrated.

    Absolutely none of this has any discernable effect on the problem.

    After what must have been about 3 hours… we are basically just fucking about as testers as the actual devs including the one who actually coded the new system is in despair, we are gonna have to push back the massively advertised release date of about 8 hours from now.

    Fucking about a bit and watching random zany attempts at most impressive suicides with those who we are at this point joking are just the chosen ones able to spawn unlimited specialist kits with c4 and anti tank weapons…

    Something clicks.

    I hold down the tab button to bring up the scoreboard with player names.

    I start telling a few of the testers who have not already left to try spawning kits at various locations.

    Everyone goes sure man why not.

    After doing this with myself and 5 other people… I have a theory.

    Everyone who has non alphanumeric characters in their name is able to break the kit limitation rules, everyone else is bound by them.

    The lead dev is skeptical, but checks the code again anyway.

    About a minute later he screams over the mic on teamspeak.

    About 10 minutes later, he has fixed what was probably a really simple but easily overlooked bug in how early python parses string values and passes them to other functions or data types.

    The server is back up, everything works correctly now, and Project Reality 0.5 is released only a few hours behind schedule, instead of the next week or two when the team would be able to organize another large scale testing bout.

    Lol and thats the story of how i saved a mod release date wooo!


  • Ding ding ding, winner winner chicken dinner.

    Sure if you are a bigger entity and have more money to throw around, there are other engines that’ll probably be a much better fit.

    If youre a broke ass indie dev, I am not really seeing a better choice than Godot right now, as youre not gonna be able to afford a more expensive engine without /usually/ pulling some kind of asset flip scam type thing.

    Sure there are some very good more niche 2D only development engines, but even with a lot of them youve still got some kind of liscensing to deal with.

    That basically leaves Unity and … OGRE, as far as I am aware for possibly good choices for a 3D game.

    Unity is currently self destructing, and OGRE, at least as far as I have tried, is pretty hard to get a native dev environment working on linux. Maybe I missed something or got confused, but I kept running into error after error trying to set up its more advanced features, which seem to require windows specific dependencies.

    I guess you could run it in a VM but that seems basically insane, and even if I was to set up a dedicated Windows machine just to develop on OGRE, it is far more clumsy to work with than Godot.


  • Whew, wont lie, I am getting tired and I had to reread that a few times till it clicked.

    SystemD… and Linux gaming.

    I am far from an expert on systemd and its alternatives, but so far all what I at least think I know is:

    SystemD is not as efficient as other paradigms could be,

    It could potentially be a massive security vulnerability, or maybe not, or maybe so, or no one seems to agree on this and then everyone starts yelling,

    I am reasonably confident that at least currently there are not any existing alternatives to SystemD that allow one to play much less develop basically somewhere between any to most games that involve 3d graphics.

    Again, I could be completely wrong about all of this, absolutely beyond my experience and skill set to comment much more than:

    A systemd alternative that would allow for modern kinds of multiplayer 3d online games would be really neat, but it seems like it would take a massive amount of effort that is at least nearly certainly beyond my ability to contribute to in any meaningful way.