From there, curate the info that will help you. Break available info into pieces. [Analyse] unknown unknowns … Show your work …

This is a perfect illustration of, “I decide to obtain more complete information.”

Thank you for confirming I’m not the only person who does this!

I fully agree with you that there are situations where some people are just impatient, and corners are cut

👍

a lot of neurotypicals often don’t like those people too

Unfortunately, that is not my experience.

the question isn’t “do I think this person will without a doubt be our top employee” or “WILL this person succeed” … the question is “Given the information at hand, do I think there is a higher likelihood of the person succeeding or struggling?” […] If I say yes, and they hire the person, and they don’t fit at the company, I can still just point to “they answered all the interview questions properly” and it’s not my fault things went poorly.

This is an instance of your case 1, which is not really what this thread is about.

Your list of cases can be paraphrased thus:

• Case 1: information known is incomplete, but sufficient.
• Case 2: information known is complete, and sufficient.
• Case 3: see case 1.

Yes, those cases are easy to deal with, even on the spectrum.

Hard cases are where information is insufficient, and consequences of the decision are serious.

Neurotypicals (& ADDers) facing genuinely insufficient information often prefer a decision regardless - instead of admitting they cannot yet make a sound one. They prioritise impatience over correctness; short-term over long-term.

That bias is a factor in much social, environmental, and economic harm.

Relevant David Revoy cartoon: https://thebrainbin.org/m/comicstrips@lemmy.world/t/1848750/authenticity-problem

Plenty of shallow people in the world, sadly, enjoy vicariously living even shallower lives than their own.

IPMI/BMC have been known problems since 2015, if not before.

Matthew Garrett: IPMI - because ACPI and UEFI weren’t terrifying enough

I feel the same way, but can you explain how a VPN would help achieve that in the face of Google’s proposed developer verification scheme?

How would that help you?

The article says, “unverified apps will only be easily installable in the sanctioned countries where verification doesn’t exist.”

So even if you used a VPN to trick Google into thinking you live in a sanctioned country, you wouldn’t be able to distribute apps to those countries without breaking sanctions.

Progress report 1

• I’m ruling out HMAC-SHA1, because:
  • Plain vanilla HMAC-SHA1 uses a shared secret. I don’t want the PC/server to have a copy of the credential. May also be susceptible to MITM/relay attacks.
  • Rolling-code HMAC-SHA1 only partially solves those problems.
  • Encrypted rolling code HMAC-SHA1 solves those problems, but I haven’t found a reliable source for using it with LUKS.
• If using systemd, pick FIDO2:
  • Avoids flaws of HMAC-SHA1.
  • Native support in systemd, so “future-proof”.
  • Wider support than OpenPGP. More HST vendors to choose from, including cheaper options than NitroKey or Yubikey: useful if each sysadmin (or colleague, or relative) needs an HST.
  • Compatible with QubesOS.
• Otherwise, OpenPGP:
  • Like FIDO2, solves HMAC-SHA1 flaws.
  • However:
    • smartcard-key-luks seems unmaintained on GitHub and on GitLab.
    • LUKS with OpenPGP isn’t well-documented for non-Debian-based distros.
• TBD: Clevis/Tang:
  • Remote/network-based unlocking.

Thank you for this! That thread is helpful in itself, and also links to other relevant resources - including by Lennart Poettering (controversial guy, but the canonical source on systemd).

This coverage has a better headline: Trump blames Minnesota governor for cyberattacks against the state. Cites no evidence.

Funding restrictions and denialism, plus starting a war against a cyberattack-capable nation, made infrastructure attacks inevitable.

Security researchers have been publicly raising the alarm about SCADA vulnerabilities for 20+ years.

If it’s a server for self hosting you definitely don’t want anything that requires interaction at boot.

Depends on use-case. If you only plan to boot it when you’re physically present, it’s fine.

i believe a much better secure layer is something similar to what Novacustoms, Purism attempt to do: verify if somebody else not you try to access the laptop.

You’re thinking of Heads, which I agree is ideal for supported motherboards.

tang

Thanks. TIL about Clevis/Tang.

I read them before writing my OP. I’m still not sure what you’re getting at.

I would be grateful if you could say what you mean, instead of initiating an oblique guessing game.

Yes. Here are some common self-hosting scenarios:

• Home server containing family files: scans, photos, device backups, …
• Office server containing business files: sensitive documents, device backups, …
• Web or email server containing websites, Fediverse instances, emails, etc

In all those cases, full disk encryption (FDE) is a sensible precaution to protect the data in case the server is physically stolen.

Linux is probably the most common OS kernel for self-hosting. On Linux, LUKS (Linux Unified Key Setup) is probably the best FDE system. It’s mature and reliable. But anyone self-hosting a Linux server with LUKS FDE is faced with the question of where to store the keys.

Hardware security tokens (HSTs) are widely considered a safer place for keys than SSDs, HDDs, or USB storage. They follow the smartcard principle: a private key can be written to an HST but not read from it (security vulnerabilities excepted). Instead, they implement cryptographic algorithms to prove possession of the private key. So, anyone self-hosting a Linux server with LUKS FDE should strongly consider storing their private key(s) on an HST.

However, there is more than one way to do that. Hence the question in my OP.

Which of the 4 recipes I posted are you referring to as “this”?

I’m sympathetic to many parts of the despair you shared. As for naming it as a whole:

Gnosticism? (Belief in a malevolent deity…)

Nihilism?

Fatalism?

Misanthropy?

As you said, though, “there is room for human connection even in a gulag”. Positives can be found in life. Look for the good bits. Play to your strengths. Help others when possible. Maybe look for charities or state agencies that can help you with the job-hunt? Stay healthy.

For plain text & Markdown, you don’t even need Collabora. Since 2019, NextCloud has a built-in collaborative text editor.

it’s the only way!

TBF I was trying to follow the docs, aber ich spreche kein Deutsch.