I still don’t understand where people are findign these useful AI answers. Every single time I try it seems AI is an acronym for artificial idiocy and I wouldn’t even trust it to tell me the time.

(In fact I just resently tried asking that stupid meta AI in sand-boxed Whatsapp (I still have to keep because of some stubborn examples of humanity) about the time in another time zone… It could tell my local time, in which time zone I was, what timezone I was asking about and what the difference between those zones was. Yet it could somehow not answer the question directly before being led there step by step. And then it still did the math wrong… 🤬)

I have made the completely opposite experience. I tried so many distros and every single time some non-trivial issues came up my search ended in the arch wiki finally explaining stuff and writing out available options in config files instead of just telling my what option in what GUI config tool (that might or might not exist in my distro) I should click, then pray it works (felt very alike to windows actually where you get two dozen guides to solve a problem, each one editing another obscure registry key and trying to find the one actually working with the current version).

So I wasted years listening to the “No, Archlinux is a meme and totally unusable for inexperienced people” before installing archlinux, which is now running for more than 9 years without problems, and will happily point people asking questions for other distros to the relevant parts of the arch wiki that actually spell stuff out properly.

Shush! They are not supposed to know that the AI–Anti-Ai fight is fabricated bullshit with both sides being equally stupid (like people arguing based on ideological zeal always are…). And that it’s just a show so that the majority is occupied with watching the mud fight so they don’t think about the actual problem.

how it affects the temperature

positively… 🔥

Are you sure about that?

When I open up the import function in KeePassXC I can pick 1Password(.opvaul), Bitwarden(.json), Proton Pass(.json) and a couple of other file formats.

PS: Oh, wait. That only works for the passwords while passkeys simply get ignored? Okay, that’s dumb.

Because of this discussion (and because I hadn’t looked at passkeys for quite a while), I did some testing…

And passkeys integrate seamlessly into my keepassXC to get backed up with all my regular passwords. So software- instead of device-based passkeys that can be properly transfered, synced or backed up work…

The problem is that tech-minded people that use password managers and think about security and backups are not the primary target group that passkeys should protect from every-day phishing attempts in the first place. And when it’s supposed to protect the common user effectively and conveniently/frictionless but then instantly destroys the effect by advising to set up another login method it makes no sense.

Yes I can backup a software one. But that’s not the point. Passkeys are advertised as the future for common people as they eliminate the biggest issues: phishing.

But then they don’t advise people to use software passkeys, back them up and keep them save. Instead they tell them to configure an alternative/recovery login alongside the passkey should it be lost or damaged.

They take a security feature, instantly remove the additional security and make it into a “you don’t need to remember and type your password”-convenience thing. Yeah, great. A password manager could’ve already provided that convenience.

So in the end those more technically-minded that will look at this and decide to use a software passkey so they can back it up will get some additional security they need much less (they are not the primary target group for phishing), and some convenience they already had (because they are already using a password manager).

Passkeys aren’t controversial because they are bad. They aren’t. They are controversial because the actual way they are used makes zero sense for the purpose of added security. Which raises the question what the actual goal is.

Passkeys are a good idea to prevent phishing. Using passkeys but then require a second method to login as a backup to prevent lockout when you lose your key (as many sites do) is epic bullshit. It makes an actual security improvement into some convenience feature so people don’t need to remember/type passwords anymore. Because the phishing will now ask for the alternative/recovery login to fix some alleged problem with your account/passkey…

So it suddenly does not provide additional security anymore above what a password manager would already do.

When you sell somehting as a security feature then instantly defeat the additional security to make it just about convenience the question about the actual goal feels natural…

It’s mainly controversial because the actual use contradicts its purpose. Passkeys are phishing-resistent, which is still the main risk for password in real world scenarios, and are a good idea.

But the websites supporting it put out big warnings when you don’t have another method to login configured. And they don’t actually advise you how to backup your passkey and keep it safe, but instead want you to set up an alternative way to login or recover your account. Which totally defeats the purpose in the first place.

Quite the contrary: “there is a problem with your passkey/account, please use the recovery method you set up” even makes for more convincing phishing. So why are they pushing for passkeys when it isn’t for security reasons?

A passkey is cryptographically signed by the server when it’s created.

So it does not only has your credentials encrypted which are then used to login to a server, but it also carries information about the server and only that server can request the credentials from the passkey. So unlike a password a passkey is resistent to phishing attempts as you can’t actually give your credentials away to anyone but the actual server it was created for.

Passkeys fix a different problem.

In my eyes the problem is that passkeys do not fix a problem. They just shift it to another layer…

I can backup a password however I like. I can backup a TOTP authenticator (or specifically the secret that works with every one of them) however I like.
I can not however backup a hardware device with my passkey.

And the websites supporting passkeys obviously know it and explicitly warn when you don’t have an alternative way of logging in configured as it’s possible that simple hardware damage or loss locks you out of your account. Thus the “fix for a problem” is now relegated to a shiny new way of conveniently pressing the button on a key instead of typing and remembering passwords, while the actual attack surface is still there but now sitting in alternative login/account recovery instead.

I want a key I can backup, even emulate if I want too

This actually seems possible… https://codeberg.org/r4gus/PassKeeZ

Also keepassXC works with passkeys for quite some time.

AI is a hideous abomination tainting everything with its existence or our lord and savior that will soon™ solve all of humanity’s problems. There is no middle-ground anymore.

And the notion that a tool can be useful for one thing if properly handled, not so useful if used carelessly, and absolutely stupid when used for a purpose it cannot actually fullfil is somehow (magic? collective brain-dead?) deemed crazy now.

PS: The only thing more insane than the discussion itself are the arguments about AI-use being unethical as it is trained on stolen data usually made by the very same copyleft guys that claim that no copyright should exist, all data should be free, and copying something is no theft!

That’s what the documentation says. I don’t know if/when that changed as I barely use docker.

Well… it’s the default iirc (192.168.65.0/24). So that’s what docker uses if there is no explicit configuration you could find.

the 192.168.65.1 address that manifested out of nowhere

Or it’s indeed the internal virtual lan your docker config uses…

Is that an actual problem or are you really just trying to fix the logs? That should be doable via headers so the real origin is preserved independent of proxying.

And as with every other of these browser lists some flavor of the month new firefox-based one wins. One that might or might not still exist in that form in another year (here it’s one that only exists as firefox release-based for a year - before that is was a fork from some old firefox version or even based on chrome at some point). 🥱

If you use the shortlived profile and your key is compromised, you benefit from the short lifetime.

Maybe I’m just too stupid to understand how those certificates work.

But in what scenario is my key compromised but not my server? Because someone getting control of my server can just get an new long-term certificate. That was my actual point in the comment above. I understand the argument of added security if they only issue short-term certificates. But where is the benefit of my short-term certificate when someone compromising my server can just get a new long-term one in seconds?

Also we are talking about self hosting. I understand the issue of revoking certificates when you have a massive userbase where some might miss the revocation for quite some time. Not so much with the dozen max family and friends.

As of the manpages systemd-sleep looks for:

The main configuration file is loaded from one of the listed directories in order of priority, only the first file found is used: /etc/systemd/, /run/systemd/, /usr/local/lib/systemd/, /usr/lib/systemd/.

Also

The default configuration is set during compilation, so configuration is only needed when it is necessary to deviate from those defaults.

So yes, you can use any existing file from another computer as your template (root:root 644 would be the default owner/permissions for it).

PS: I tried on my PC and setting AllowHibernation=no in the config file produced a different “hibernate is disabled by config” error. Only if I remove the resume=<swap location> kernel parameter do I get the “not set up” error you mentioned but I’m not at home and only have my old (encrypted and able to hibernate) bios laptop with me. So I can’t check this for modern UEFI where systemd-sleep should automatically pick a suitable swap space and save the location in an EFI variable without any additional configuration.

You can however set the resume=UUID=<your swap's UUID> kernel parameter anyway. Even the automatic systemd/uefi setup accepts this as a way to manually select a location. So maybe you try that. If your problem is decryption of the swap at startup you should not get an error when initiating the hibernation as you do now but instead get problems when you try to restart from swap.

OP seems to use the systemd hooks anyway. And with them all disks get decrypted with the first given password (or at least try and only ask for additional passwords if that fails). So it’s not neccessary anymore to have everything on the root partition. Several encrypted with the same password will do. (For example I unlock a classic swap partition and 3 differently sized disks creating one btrfs raid1 for root with one password.)