I think this is a reference to how giant security products often have very basic security vulnerabilities themselves.

Fortinet firewall path traversal: https://www.sentinelone.com/vulnerability-database/cve-2026-59839/

Cisco firewall path traversal: https://www.sentinelone.com/vulnerability-database/cve-2026-20018/

Big IP firewall path traversal: https://cvefeed.io/vuln/detail/CVE-2025-26427

All discovered in the last year

Everything that was luks encrypted is unrecoverable once you overwrite the luks header. Trying to guess the master key takes longer than the lifetime of the universe.

Just make sure that is gone and you are good. If you deleted all partitions and installed another (unencrypted) OS on the drive there is a very good chance the luks headers are gone for good.

Not much probably. Its the same as losing/getting your phone stolen. Its encrypted at rest and if it was set up using a backup it should also already have a password set.

Honestly… in a world where code is written by AI and not humans, most frameworks SHOULD go away. They were designed to make a task easier for humans not for a machine. AI should not write “react on node using vue”

My experience with ente was that it is horribly slow. It also lacks any feature to upload a large number of photos at once. I just never bothered uploading my 10k pictures I have taken over the last 15 years because it would have had to transfer them to a phone and then have the app open for a few weeks. No rclone or any other reasonable way to upload from a computer other than browser (which just doesn’t work for more than a few images)

Podman is pretty mutch a drop in replacement for docker but it runs in user context instead if root.

All docker commands work with podman by just replacing the name including podman compose.

(You do have to specify docker.io as a repository if you want to pull images from docker hub but that is literally the only difference In usage I ever noticed)

1. is there a reason you don’t use podman instead of rootless docker?
2. can you run patchmon inside of docker and mount the socket to the original path inside of the container?
3. the symlink has the file permissions of the file it points to. If the socket is owned by a user, so will the symlink, even if you used root/sudo to create the link. (technically the symlink will be owned by root, but the permissions on a symlink are ignored and the permission of the target are used)
4. as long as you don’t change any permissions on /var/run or on the docker.sock to be more permissive than they are now, there is functionally no difference in security
5. If you or someone else on the system tries to run docker with a different user/root, the symlink will likely cause issues

Yeah precice phrasing ia hard sometime. I was refering to delete/modify of files as “changes to the fs”. Not sure how changing the actuall fs would be relevant to the backup question.

OP needs a restricted shell that can take backup data and write it to disk but not be able to modify anything that is already there. Nano and rsync can both do that.

Nano and rsync are 100% designed to modify the filesystem. But yes the idea is correct.

Same with got over ssh, you restrict the connection to the got shell that can only do the things you want.

Hitchhikers guide to the galaxy. Movie or TV series. 42 is the answer to “the Ultimate Question of Life, the Universe, and Everything”

Its the funny number of gen alpha. Like 42 for millenials. But there is no meaning behind it. Its just six seven. That’s it.

Eh I think its fine. Its just

clean hair --condition

or

clean body --moisturize

And its not like literally any cleaning product on the market isn’t just a wrapper around libclean anyway

Edit: libclean is deprecated, now its all either libsoap or its newer fork libpid

If you do not set a master password for the browser (that you have to type before the saved passwords are filled in), the despite what others have written, the passwords are not really encrypted. They are, it just doesn’t matter. Because they are encrypted with the password of you OS user. So they are unreadable if someone steals your device or to any other users on your system, but any malware that runs in your user context has full access to the passwords any time you are logged on to the machine.

Of course if you have malware on your system they can also log your master password as you type it, same with any other password manager. If you unlock the password save, it is available to malware in that moment.

Also if you use passwords for anything other than websites you should have a password save for those passwords as well so why not have one single save instead of one in your browser and one outside of it.

Tl:dr saving passwords in your browser is fine but you should absolutely set a master password. External password manager can be more pragmatic compared to browser only.

Why though? How does this force anybody to do anything? They will fine anybody 2500$ for handing this to a kid and call it a day. Maybe even move closer to the maximum fine because it is a deliberate breaking of the law.

License? I never mentioned licenses.

Selling drugs is illegal because drugs are illegal. If a OS without age verification is illegal, then (depending on how stupid the laws are) having a site where you can download such a OS could also be declared illegal.

Basically force all providers of OSs to include verification or block downloads to those states, or face fines for “distributing illegal software”.

I am saying, if they are stupid enough to do X they might be stupid enough to try the even more stupid thing to achieve X.

They will make it so that “allowing users from California to download the OS (or code) from you is already a crime”. So for example canoical will have to geoblock californians from downloading ubuntu and any peer-to-peer downloads will be illegal anyway because fuck you.

Windows will break your bootloader in a few updates time. It will literally check all drives in your PC and put a windows bootloader on it, overwriting any others that are already there.

With a tiny bit of offsec you can make pretty bulletproof setup.

Work only exists inside of a Win11 VM. It never touches the underlying system! All files associated with that VM (most importantly the virtual disk) live on a separate partition, or better separate drive. That partition is not mounted in fstab. So under normal circumstances it should never be mounted. So any fuck up they do to their Linux system will leave that partition untouched. If worst comes to worst that can boot a live iso from USB and run their work VM from there.

I would trust that setup infinitely more than having windows as a base system.

Yeah standard bash Ctrl+r is just so painful. I much rather use “history | grep searchtearm” than that awfull search. fzf is a whole other level. But nowadays I just use fish shell which IMO has even better search than fzf