I have watched it and just seeing the meme has gotten Lain’s theme stuck in my head.

And their business practices as well. Bringing store exclusivity to the PC games market and paying publishers to delay launches on other stores is not something I want to support.

If you want a bunch of stuff that’s not in core or extra and you don’t want to intensely babysit the AUR, you could try Chaotic-AUR. It hosts prebuilt packages for a bunch of AUR packages which are actively maintained by the Chaotic team.

I consider it to be more secure than the AUR proper since they actually care for their packages and review nontrivial changes. For instance, the recent takeover attacks didn’t hit Chaotic-AUR builds since the changed packages didn’t make it past the review.

It’s still an unofficial third-party repository and closer to the AUR than to extra but I consider it a major step up.

I have to disagree on side details: OS X did have version numbers starting with 10. I used it between Panther and Yosemite and I can remember Tiger being called version 10.4; it was literally printed on the installation disc.

Yes, that means “Mac OS X 10.0” had two tens right after one another. Apple aren’t Microsoft silly when it comes to names but they can be silly.

Also, it wasn’t introduced as OS X. It was “Mac OS X” until 10.7, then “OS X” until 10.11, and “macOS” since then.

Not to my knowledge. They did block a few of these because they got auto-flagged for manual review.

Reformatting isn’t going to change how your SSD is electrically connected to your mainboard. Do you actually mean NTFS?

I suppose a distro might ship without NTFS-3g or the ability to install it, although Bazzite should be able to at least read NTFS.

Not a hardware issue; Linux handles NVMe and SATA drives just fine. They probably encrypted everything with BitLocker. Of course Linux can’t access an SSD encrypted using a proprietary Microsoft software with keys that may no longer be accessible.

Too much typing. Real men just press Alt+SysRq+L.

A Backstroke of the West screenshot is definitely an inspired choice for the “keep above others” feature.

In my comment, '“cracking” referred to finding a password that matches the hash. That’s common nomenclature. The found password doesn’t have to be the original password but it’s rather likely at the string lengths involved, especially since Kaspersky used a dictionary to back the attack.

Also, you wouldn’t use a hashing function where a large number of inputs of a usual password length turn into the same hash. That would just make all passwords weaker. The point of hashing a password is to store something that (ideally) uniquely matches the correct password but can’t be used to easily derive the password.

The factor of 1000 I gave was a very rough ballpark number. I couldn’t find any good comparison between the actual throughput of MD5 and bcrypt or Argon2. And yes, a single round of SHA256 would be cracked quickly; it’s much less work-intensive than Argon2 and even has dedicated hardware acceleration in modern CPUs. Argon2 with a high work factor is vastly more resistant than MD5 and SHA256.

Also, salting doesn’t protect against brute force and enhanced dictionary attacks. The salt is stored with the password so the attacker knows it. It only protects against rainbow tables. Pepper protects against offline cracking.

As does Arch AFAIK. It’s still very niche, though.

The difference in speed between MD5 and something like bcrypt or Argon2 is massive. We’re talking orders of magnitude. That adds a layer of security – if hashing takes e.g. 1000 times longer than with md5, the 20 minutes to crack the least secure passwords suddenly turns into 14 days. Still not astronomical but a lot slower. The more secure algorithms also require more memory to run, leading to less effective parallelization.

Besides, MD5 is prone to collisions, which reduce the number of attacks needed. The attacker doesn’t need the real password, just one that hashes to the correct value.

While they did do a more sophisticated dictionary attack, they also talk about rainbow tables, which only work if the hashes are unsalted. A more modern approach with salted passwords is immune to rainbow table attacks. An actually modern approach with salted and peppered Argon2 hashes makes the kind of offline attack Kaspersky did unfeasible in the first place.

For some reason Kaspersky never bothered to point this out. I’d expect a reputable cybersecurity company like them to at least include one line that urges developers to make use of a modern approach and gives pointers as to what that might be. But I suppose “we recommend passwords to be salted, peppered, and hashed with Argon2i or Argon2id with a sufficiently high work factor” wouldn’t fit their narrative.

(I also just noticed that the advice part of Kaspersky’s article is littered with references to the password manager they sell. Yep, it’s an underhanded ad that just happens to contain some good security advice.)

You see, that’s just inaccurate. GNU/Linux is not equivalent to GNU+Linux. That would be addition; this is division. The bigger Linux gets, the smaller GNU/Linux becomes.

That’s why they’ve developed GNU/Hurd. Hurd is unlikely to ever amount to much, meaning that GNU/Hurd will never evaluate to a small value. And that is cold, hard mathematical fact.

I’d use at least one more: The one that unlocks your device shouldn’t be the one that unlocks your password manager. Other than that, yes. Use a password manager, let it generate per-service passwords for you, and make sure you have a backup plan.

For example, I use a KeePass database shared across my devices via a self-hosted NextCloud. Each of my devices plus the server effectively holds a backup copy so I’d have to lose all of my devices plus the server before my password database becomes inaccessible. Since the server lives in a datacenter it also serves as a remote backup.

If your password manager is SaaS, you might want to investigate how to protect yourself from scenarios like the service being down or you losing access to the account.

I think Gunner means a biometrically unlocked second factor like a Yubikey or a smartphone’s user attestation. Given how badly written the entire article is, I wouldn’t be confused if that’s what he originally said before they condensed his statement beyond comprehension.

So Kaspersky found out that MD5 passwords are unsafe. That’s literally 20 year old news. Actually, Kaspersky found out that brute-forcing MD5 on consumer-grade hardware has become slightly faster than two years ago, which makes me wonder if Captain Obvious’s secret identity is that of a Kaspersky cybersecurity expert.

El Reg concludes from this that we should ditch passwords, which they back up with the opinion of a second expert. This expert immediately tells them they’re wrong, that passwords are perfectly fine if used with MFA, and that a lack of public knowledge about basic cybersecurity is the real issue. They somehow treat this as him agreeing with them.

Actual technological alternatives to traditional password use (such as passkeys or password managers with per-site passwords) are mentioned only as an aside or not at all. It never occurred to El Reg or Kaspersky to mention that MD5 has been considered obsolete since the days of Internet Explorer 7 and that more secure hashes like bcrypt have been around since the late 90s. For that matter, the Kaspersky source talks about rainbow tables without using the word “salt” even once.

Finally they conclude with a call to action to “improve that user security stack”, arguing that passwords are inherently unsafe due to their “complex requirements and hashed storage”. That’s so deep into la-la land that I’m not even sure what it is they’re trying to say or who they’re even talking to.

That’s an amazingly badly written article.

What impresses me the most is that the Kaspersky article they’re talking about is just as asinine as El Reg’s confused stammering. The most sense I can make out of it is that they’re making a bad faith argument (“we can brute-force MD5’d passwords with a 5090 so you should use MFA”) because they’re trying to get nontechnical people to do the right thing and hope they can scare them into compliance if they bullshit hard enough.

Edit: I just noticed how often Kaspersky’s article refers to the own password manager they sell. So their bad faith argument is really just in service of an ad that happens to contain some decent security advice.

Mind you, on my own Linux machine I can become root while on Windows all I can be is someone with admin rights (but subordinate to SYSTEM).

Go with the times. Make a version where they fall into The Receiver’s gaping colon for 10,000 years. Make Hampster Dance start playing after 5,000 years just to fuck with them.

I have. Never had your machine just sit there and refuse to boot because a network share is down? Or because the wifi isn’t connected yet?

I absolutely have. The solution wasn’t found in the init system, though, but by giving my NFS mounts the nofail option in /etc/fstab. Filesystem handling isn’t init’s job.

Overall I haven’t had significantly more or less issues with systemd over OpenRC. I’m not a particularly big fan of their approach to things but their init system is perfectly serviceable.

There are 3 or 4 total sentences in the whole thing and the very first one is laying out that this whole thing is about workstations. I don’t know how much more I could do other then literally plan for this argument that you started.

The problem lies with the closing sentence: “sure, but its down there with arch as a usable OS in anything outside of an LTT video.” That implies that both Pop and Arch are not very useful for anything. That is the broad statement that people are arguing against. You may not wanted to have made a strong statement there but you did.

As far as not mentioning nontechnical users, fuck right off with that, all users are nontechnical unless otherwise stated. Anyone who has had to set a computer up for anyone other then themselves knows this. I did not make the comment assuming that someone would get bent out of shape and look for any “win”.

Nobody knows how many people work in your shop and what kind of shop it is. That’s the part where you come in with a premise that is unknown to everyone else. There’s a huge difference between a chain of three computer stores in a 10 km radius, a chain of three hobby stores scattered across a country, and a chain of 100 anything stores operating as part of a major LLC.

Nobody knows if setting up workstations involves you walking over and configuring everything by hand, you pushing preconfigured images over PXE, or (as seems to be the case) you shipping unmodified live USBs to people along with a set of instructions. I assumed the first one, for instance.

We didn’t even know what your workstations are and do. When I hear “workstation” I think of a beefy PC doing things that require a lot of processing power and are typically given to power users. But they could also be thin kiosk systems that only ever need to display a single website. Or they could manage the POS system. Or a million other things. Depending on what those workstations are, the requirements could be anything from a hyper-specialized setup to “here’s a desktop with Chrome; you know the rest”.

So while it was obvious to you that “one of my stores workstations” implies “a general-purpose computer maintained and operated by a nontechnical user in a remote location”, it wasn’t obvious to anyone else.

The stores are 250 kms apart, you can not in good faith tell me arch is appropriate unless you have an administrator on site (and if I was that administrator I would likely strike you).

Given your use case, Arch is indeed a bad fit. I wouldn’t even argue for an Arch derivative (where usually the setup is done through a bog-standard Calamares installer). But that’s like complaining that nobody ever needs a semi truck because it doesn’t meet your needs of being compact and fuel-efficient. Like Arch it’s simply a tool for a different job.

There is no situation where you are setting up workstations for users that are not Linux-averse outside of a Linux development environment, in which case those users will not like that you set up arch for them, as if they are arch fans they will also want to do their own configurations.

Those users also don’t want to deal with any other Linux distro or Windows or macOS. They want their computer to work and someone else to make that happen. And if someone else does make it happen they generally couldn’t care less about what’s under the hood as long as their workflow isn’t impeded.

(Also, there definitely are people who prefer Linux outside of Linux development. Just because my company issued me a Windows desktop doesn’t mean I have to like it.)