• 63 Posts
  • 1.35K Comments
Joined 3 years ago
cake
Cake day: July 7th, 2023

help-circle

  • The security model skews towards convenience versus absolute security, meaning automation is it’s goal, not perfect security. They use a reasonable amount of security to protect unauthorized access, meaning untrusted apps can’t access keys by default, and container apps only have selective access. AppArmor is supposed to be handling some DBUS interactions in the background to prevent any old app from grabbing everything, but again, automation is the purpose here.

    If you don’t have a reasonably trusted system, then sure, it’s about as secure as any other password manager. I remember reading some time ago there was a plan to make a global framework for trusted application.accessnto things like this, but it was shot down for being “oppressive” in the same way as Microsoft’s trust app mess.

    Ideally there would be an advanced mode where each app is granted access to specific keys, and that interaction is controlled by the user. This would never be the default obviously as the user interaction would be an insane annoyance to people who don’t care.






  • Same as you would on MacOS :

    • ditch the .deb package because it’s the wrong tool for the job here.
    • Squashfs image with encryption
    • Set keyring entries and a wrapper script to manage lock/unlock. If you already know the hardware platform of all users, this can even be improved upon

    I have no idea why someone would be using Debian packages to distribute something like this though, if that’s the question. Absolutely not going to work well.




  • You’ll still be running into frequent issues if you go with R-V, so be warned.

    That being said, the Framework R-V board only comes for the 13" format, so you can buy a cheap Framework 13 refurb from their store (fully warranted and everything), and swap the board out for the R-V for $200.

    There are other R-V laptops out there, but I think the build quality is nowhere near the Framework, AND if you feel like it sucks, just swap that board back with the one it shipped with.









  • Having the disks connected externally is the same as having them connected internally

    No, it 1000% is not, especially in the case of USB that I used. Even in the way Linux handles everything as a file and target, it is vastly different.

    No RAID solution I know of would lose the array on a power outage

    Hardware RAID enclosures have batteries on the disk controllers for this very reason. We aren’t talking about those though, we’re talking about software RAID on JBOD, which wouldn’t have those sanity protections. Here’s some random blog explaining deeper.

    Honestly I don’t see how interrupt handling would be any different between internally or externally connected devives, except for different buses/protocols handling it differently intrinsicly

    See above

    Maybe I’m too spolied by using ZFS, but again I don’t think this would actually be a problem

    That’s a filesystem solution to a hardware problem, so yes, probably a bit spoiled there, or at least it’s skewing your understanding of what RAID is and how it works. One of the reasons ZFS exists, actually. It’s nice to have nice things though.