• 0 Posts
  • 24 Comments
Joined 2 years ago
cake
Cake day: June 10th, 2023

help-circle
  • It’s easiest to just register a domain name and use Couldflare Tunnels. No need to worry about dynamic DNS, port forwarding etc. Plus, you have the security advantages of DDoS protection and firewall (WAF). Finally, you get portability - you can change your ISP, router or even move your entire lab into the cloud if you wanted to, and you won’t need to change a single thing.

    I have a lab set up on my mini PC that I often take to work with me, and it works the same regardless of whether it’s going thru my work’s restricted proxy or the NAT at home. Zero config required on the network side.


  • d3Xt3r@lemmy.nztoSelfhosted@lemmy.worldDo you encrypt your data drives?
    link
    fedilink
    English
    arrow-up
    38
    arrow-down
    2
    ·
    9 months ago

    This shouldn’t even be a question lol. Even if you aren’t worried about theft, encryption has a nice bonus: you don’t have to worry about secure erasing your drives when you want to get rid of them. I mean, sure it’s not that big of a deal to wipe a drive, but sometimes you’re unable to do so - for instance, the drive could fail and you may not be able to do the wipe. So you end up getting rid of the drive as-is, but an opportunist could get a hold of that drive and attempt to repair it and recover your data. Or maybe the drive fails, but it’s still under warranty and you want to RMA it - with encryption on, you don’t have to worry about some random accessing your data.




  • Why don’t laptops have proper low power states

    Actually, they do, it’s called the “S0” low power state, and it’s part of the ACPI standard. Microsoft calls this “Modern Standby” in Windows (and “suspend to idle” in Linux) , and it’s pitched to do exactly what you’ve described.

    The only problem is, the implementation sucks. Most users actually hate the S0 state because it consumes so much power - on some laptops, even the fans may continue to run on S0, and your laptop may overheat if you’ve closed the lid and chucked it in a bag, and it’s in the S0 state.

    Also, because Microsoft and Intel have been pushing this so much, the “standby” mode now defaults to S0 instead of S3 (which is full suspend-to-RAM). So many users actually actively seek to disable S0 and go back to proper S3 standby, via registry hacks etc.

    So why is S0 so bad? Part of this is due to the limitations, long history and the variable nature of the x86 platform. All the power-saving stuff was implemented as an after-thought - both at the hardware and software levels. Whereas ARM, at least the modern ARM ecosystem, was developed with mobile usage and power saving from ground up. An x86 PC is also made up of components from disjointed manufacturers, and we need all those components to implement the same standards so that it all works well as expected. So for instance, if a particular component isn’t capable of entering a low-power or active standby state, then it won’t - and you can’t do much about that, unless you’re Apple and have a tight control over the ecosystem.

    The second half of the problem comes with the software. All applications must be modern standby / S0 aware, if not, one of two things will happen: that app will keep the system awake, or the app will get suspended by the Desktop Activity Moderator (DAM). Either way, the app must be capable of running in the DRIPS phase (deepest idle runtime platform state), which rules out most Win32 apps (basically almost every app that’s not on the Microsoft Store).

    Finally, the reality is that most PC users don’t care about modern standby regardless - and why should they, when they’ve all got smartphones, which handles notifications well? Also, hardly anyone does large file downloads these days, and the people who do still download, wouldn’t care about doing it while on battery (and if they do, they can take manual actions to lower the power consumption, such as switching to a power saving plan and turning off the display etc).

    Ultimately, most people would expect a laptop to go into a fully suspended state when the lid so closed and they’re on battery, because if they’re on battery the #1 concern for them would be the battery life. So most people actively seek to disable S0 and see it as a hindrance.




  • Desktop users exist

    So do Desktop tools like Flameshot, which can directly upload to image hosts and copy the URL to the clipboard which makes it easy to share images, and there also exists third-party Desktop web-clients such as Photon, which could be updated with that functionality as well. But with Lemmy itself being open source, it wouldn’t take much effort to modify the code to use a third-party image host.

    have a history of deciding to forbid hotlinking

    There are plenty of hosts which do allow hotlinking though, like imgbb.com

    history of suddenly deleting all (e.g. PhotoBucket) or some (e.g. Imgur) images .

    Not a big loss, IMO. Lemmy isn’t an image hosting nor an image-centric site, it’s a text-heavy forum at first instance, and anyone posting images are encouraged to provide text alts for the benefit of blind users, so images not persisting isn’t a big deal.

    If image persistence is really that important, there are other services which are better suited for that, such as Pixelfed. But in the first place, I wouldn’t rely on some random Lemmy server, which is vulnerable to DDoS and other attacks and could go down at any time (also why the importance on decentralization - no single instance is infallible). I mean, when there’s no guarantee that a Lemmy instance will even be there tomorrow, is there really a need to worry about image persistence?










  • There’s always a tradeoff in computing between security v/s performance/overhead, so the value of it depends on your threat model, and the attack vectors you’re expecting.

    Anyways, RAM encryption is generally “available” in various forms, depending on the mobo, CPU, software used etc, but it’s not commonly enabled/used. Most AMD boards (at least, mid-range and above should) have an option in the BIOS to enable Secure Memory Encryption (SME). This allows the OS to selectively encrypt memory pages, making use of a hardware AES engine that sits outside of the CPU.

    There’s also Transparent SME (TSME), which encrypts the entire memory and works completely independent of the OS and software. Usually only high-end/workstation boards have this, and it also requires a Ryzen PRO CPU. TSME also has a much lower overhead, I recall reading somewhere it’s something like only 5%.

    I believe Intel also has something similar, but I never looked into it.

    AMD have a whitepaper available with an overview on how this stuff works, if you’re interested: https://www.amd.com/system/files/TechDocs/memory-encryption-white-paper.pdf