Posts by lizjohnson

The ultimate Pi 5 arrives carrying 16GB ... and a price to match

$120, but you still need to get a case and the rest

My current desktop is a Lenovo Tiny M900 i7 which I picked up with 32GB for $100. I replaced the drive in it, but I would need to get a disk if I wanted to use a Pi5 as a desktop replacement, but also a case and a PSU as well. Its getting harder and harder to justify picking up a sbc especially as a desktop replacement once I realised you can just pick up 2nd hand enterprise kit for a fraction of their original price and in many cases cheaper than the sbc equivalents when factoring in the tco. Same goes for any of my server projects too.

The only home project that I have that has survived getting virtualised into a kvm vm has been my pikvm box that allows me to remote control my other M900 that runs all my servers. With the advent of all those tiny kvm products, if it dies I'll prob get one of those as they are a fraction of the price of my pikvm (I'm running it on pi4 with usb hdmi and old school usb splitter).

China's Honor debuts laptop with bonkers removable camera that lives in a little slot

Nice camera idea

Not only can you be sure that it isn't on, but you can easily upgrade it too! I wonder can/will they provide a wired caddy so you can point it around without needing to do acrobatics with your laptop? TBH I just end up using my phone if I want to take a picture/video nowadays.

In Debian, APT 3 gains features – but KeepassXC loses them

Just some additional info about "plugins" and security from the horses mouth (aka the FAQ on their site):

"Does KeePassXC support (KeePass2) plugins?"

"No, KeePassXC does not support plugins at the moment and probably never will. KeePassXC already provides many of the features that need third-party plugins in KeePass2, so for most things you don't even need plugins, nor should you ever want them. Plugins are inherently dangerous. Many KeePass2 plugins are barely maintained (if at all), some have known vulnerabilities that have never been (and probably never will be) fixed, and none of them are as thoroughly tested and reviewed as we test and review code that goes into our main application. We find that encouraging users to install untested (and often quickly-abandoned) third-party plugins is inherently incompatible with the security demands of a password manager.

If you really need external functionality not available in KeePassXC, you can look for "plugins" that use the KeePassXC-Browser API, which is a much more secure way of sharing passwords with third-party applications than loading those applications as plugins directly into KeePassXC."

So the KeePassXC devs go to all this effort to reproduce a lot of useful functionality as native functions in their app, just to get judged as wasting their time and having it stripped out of the primary package. When people talk about demotivating FOSS developers, this defo feels like a prime example of it!

Re: Agree to disagree

From the github response of Klode:

"I'm afraid that's not going to happen. It was a mistake to ship with all plugins built by default. This will be painful for a year as users annoyingly do not read the NEWS files they should be reading but there's little that can be done about that.

It is our responsibility to our users to provide them the most secure option possible as the default. All of these features are superfluous and do not really belong in a local password database manager, these developments are all utterly misguided.

Users who need this crap can install the crappy version but obviously this increases the risk of drive-by contributor attacks."

Lets break this down.

- "I'm afraid that's not going to happen. It was a mistake to ship with all plugins built by default. This will be painful for a year as users annoyingly do not read the NEWS files they should be reading but there's little that can be done about that."

-- Knows that it will impact people but ¯\_(ツ)_/¯

- "It is our responsibility to our users to provide them the most secure option possible as the default."

-- SystemD? keepass2? keepassx?

-- We know that they can rename/fork apps when it suits them e.g. Waterfox

- "All of these features are superfluous and do not really belong in a local password database manager, these developments are all utterly misguided."

-- Its not his project, if he doesn't like the direction of it, fork it and user adoption will show who is misguided.

-- This is an attack on the KeePassXC dev team, hey they also have feelings and are also FOSS devs, do some FOSS devs get more rights than others???

- "Users who need this crap can install the crappy version but obviously this increases the risk of drive-by contributor attacks."

-- An attack on users who choose to use a feature rich password manager.

-- Blinkered view on security, supply chain isn't the only attack. Clipboard, phising, lack of MFA on the password DB are compromised from his change.

The attack on the KeePassXC devs and users is why I personally see this as ego. I don't need to know someone to look at their response that they posed on a public forum on the projects github and just be totally shocked at how toxic it is.

KeePassXC doesn't have actual plugins, this is a legacy term from KeePass, KeePass2, KeePassX and so on. For KeePassXC these are functions built into the app, which the package manager removed during compilation time. I've noticed there is no keepass2-full or keepassx-full and these packages actually does have plugins!

Re: Agree to disagree

The thing about security is its dependent on an individuals security model. Imposing your security model on everyone else isn't security its gate keeping and can end up reducing someones actual security. Read up about security theater vs actual security, for example how our beloved politicians have such a boner in regards to putting a back door into encryption....

So how does that affect Klode's decisions in crippling KeePassXC to make a "less crappy" version. KeePassXC from the very first page of their website is described as "Let KeePassXC safely store your passwords and auto-fill them into your favorite apps, so you can forget all about them." a little bit down the page it is described as modern. I dunno what your idea of modern is but something that has less functionality than its predecessors KeePass and KeePassX isn't mine.

On the same page it describes support for Passkeys.

All of these functions are removed from the Klode's version of the package, so any user who installs KeePassXC without realizing it may end up logging a call with upstream causing wasted time for the devs or even worse it just gets dismissed which may allow a real issue to be dismissed due to the devs being desensitized to bug reports involving Debian derivatives. Remember going forward this isn't edgy tech savvy bleeding edge test users, but your average Debian derivative users. I'm hoping Clem's team will realize how stupid this is and will sensibly link keepassxc to keepassxc-full and keepassxc-min to keepassxc in someway.

If Klode followed what I think is the spirit of open source he would have either forked KeePassXC to a different project which incorporates his ideas or just created a keepassxc-min package as suggested very early on in this whole mess, but you know ego!

Re: KeePassXC change was backwards . . .

Ugh whilst they are called plugins, this is a legacy term from its parent application, KeePassXC doesn't actually have plugins, these are functions built into the application. The functions were actually removed from the package when it was compiled to produce the "less crappy" version. I noticed that both KeePass2 and KeePassX don't actually have -full version of them and these actually do have plugins!

I'm guessing you only read the headlines, but do you think that Yubikey support and auto type is "network support"? But let's just focus on the security aspect of this action. Is disabling auto type actually a good thing? It promotes the use of the clipboard to store passwords. Whilst the browser plugin could arguably be considered network support, without that again another avenue of not using the clipboard to transfer the password is lost. The anti phising feature of the browser plugin is lost and ofc the Passkeys support is no longer available.

No before you say "just install the full version", isn't this about sane defaults? Isn't the sane default to provide access to the majority of normal users a modern password manager rather than what basically could be considered an encrypted spreadsheet? Shouldn't the more paranoid user be the one to install the "less crappy" version of the software as they would be the ones more motivated and prbly with the knowledge to do so.

It feels to me this is just some ego elitism gate keeping going on here. Some of the people who respond defending the decision to make the crippled version the primary version feels like to me be the type of person who brags about using Kali as their daily driver coz its "more secure"....

The ThinkPad X1 Carbon Gen 10 as a Linux laptop

xx30 series is my go to....

I've been using a T430 and a W530 for many years with Linux Mint, but recently I've picked up a P50 with 64GB of memory for a couple hundies. Maybe one day I'll treat myself to a brand new Carbon X1 as I am jelly over the weight, but for now I just can't beat the robustness and cost effectiveness of a second hand enterprise lappy!

Is it decadent that I use four different computers each day, at different times?

Just my PCs....

T430, X230 and X230 Tablet... The X230 is my daily driver (email, notes and all that), the T430 is my main work horse and the tablet is what I use in bed and when I need to use the pen. My bae might have gotten me a W530 for Xmas, not that I sneaked a peak :)

Reviving a classic: ThinkPad modder rattles tin to fund new motherboard for 2008's T60 and T61 series of laptops

The chiclet keyboard may not be that awful...

My X230 and X230T have the original UK chiclet which are really good. Whilst they are not as good as the KB from the X220 they are not awful. What is awful is the "new" keyboard replacements. I've tried 2 so far for my T430 which came with a US keyboard and they feel terrible compared to the originals. I tried different resellers but it looks like they came from the same place. I also tried a refurbed keyboard which had the original feel, but that didn't work and was DOA. I tried swapping the ribbon cable but no joy. What I did find out was when I tried to swap the key caps to see if that improved the feel, is the new keyboard uses different cross switches and the original keyboards have much better gubbins.

Huawei dev flamed for 'useless' Linux kernel code contributions

Re: Who's the student here?

Isn't this an auditing vs efficiency issue?

For example if they submit 100 fixes as a single patch that touches 100 different components then whom ever is analysing that patch would have to check multiple components and some which they might not be familiar with. I guess in terms of efficiency it might be easier to check a single patch with multiple fixes (esp trivial), but in terms of an audit trail that patch just touched multiple components and that seems bad to me.

I have no idea what is actually going on with this story and it seems that there is a lot of hearsay going on.