My experience with ente was that it is horribly slow. It also lacks any feature to upload a large number of photos at once. I just never bothered uploading my 10k pictures I have taken over the last 15 years because it would have had to transfer them to a phone and then have the app open for a few weeks. No rclone or any other reasonable way to upload from a computer other than browser (which just doesn’t work for more than a few images)

Podman is pretty mutch a drop in replacement for docker but it runs in user context instead if root.

All docker commands work with podman by just replacing the name including podman compose.

(You do have to specify docker.io as a repository if you want to pull images from docker hub but that is literally the only difference In usage I ever noticed)

1. is there a reason you don’t use podman instead of rootless docker?
2. can you run patchmon inside of docker and mount the socket to the original path inside of the container?
3. the symlink has the file permissions of the file it points to. If the socket is owned by a user, so will the symlink, even if you used root/sudo to create the link. (technically the symlink will be owned by root, but the permissions on a symlink are ignored and the permission of the target are used)
4. as long as you don’t change any permissions on /var/run or on the docker.sock to be more permissive than they are now, there is functionally no difference in security
5. If you or someone else on the system tries to run docker with a different user/root, the symlink will likely cause issues

Yeah precice phrasing ia hard sometime. I was refering to delete/modify of files as “changes to the fs”. Not sure how changing the actuall fs would be relevant to the backup question.

OP needs a restricted shell that can take backup data and write it to disk but not be able to modify anything that is already there. Nano and rsync can both do that.

Nano and rsync are 100% designed to modify the filesystem. But yes the idea is correct.

Same with got over ssh, you restrict the connection to the got shell that can only do the things you want.

That’s just not true. Bottles are made from 4 different plastics that all have to be separated for recycling (bottle, label, cap+ribbon, soft part inside the cap to make a waterproof seal). The ribbon part the cap is attached to is also present in bottles where the cap is not attached and it has to be removed anyway. So nothing really changed there except the part that has to be removed is bigger now.

Despite what right wing nuts that have to be against every progress say, there is literally no downside to this law.

But the biggest improvement is from nature cleanup crews that previously always found the bottles but never the caps.

In the EU bottle caps have to be attached to the bottle so they stay together when thrown away. Everyone working in recycling and especially people working in stuff like river cleanups praise how this is a gigantic improvement. It is universally a good thing.

Even Coca Cola used it in advertising to sell how environmentally friendly they are (by not breaking the law). However they are only doing it in countries where it is legally required and nowhere else.

No the point of this discussion is about having one single yes/no question about the standard or a list of features.

Then no browser will be “up to” the last 15 years of the standard as none implement all features.

The problem is that the standard is fucking huge and maybe your browser supports every feature of version 5xx but is missing a feature related to authentication using guinea pigs introduced in v369. So it would only be allowed to advertise compatibility with v368 even though it can do everything except Guinea pigs.

Realistically you would trim the standard to a core set and advertise compatibility with a version of that and then advertise optional extensions. And that’s optional bits if you ask me.

It can not exist. Microsoft can and will bring it back if they want to. Unless you are also disabeling all windows updates, the computer will never be under your control. And disabeling windows updates … lets just say there hasnt been a month without a 9-10/10 security vulnerability in a microsoft product in a long time.

Why though? How does this force anybody to do anything? They will fine anybody 2500$ for handing this to a kid and call it a day. Maybe even move closer to the maximum fine because it is a deliberate breaking of the law.

You are asuming the cost of a network card and a microchip is higher than the profit they expect from the ads. Many smart TVs are cheaper than an equivalent dumb TV

Windows will break your bootloader in a few updates time. It will literally check all drives in your PC and put a windows bootloader on it, overwriting any others that are already there.

With a tiny bit of offsec you can make pretty bulletproof setup.

Work only exists inside of a Win11 VM. It never touches the underlying system! All files associated with that VM (most importantly the virtual disk) live on a separate partition, or better separate drive. That partition is not mounted in fstab. So under normal circumstances it should never be mounted. So any fuck up they do to their Linux system will leave that partition untouched. If worst comes to worst that can boot a live iso from USB and run their work VM from there.

I would trust that setup infinitely more than having windows as a base system.

For smaller (indie) studios it can make sense. If the game costs more money to developed than the developer has, preordering is indistinguishable from crowdsourcing like kickstarter. It removes the need for the developer to take a loan and investors, possibly giving up creative freedom.

Anything backed by a (big-ish) publisher should never be preordered!

Terminology: revoked means the issuer of the certificate has decided that the certificate should not be trusted anymore even though it is still valid.

If a attacker gets access to a certificates key, they can impersonate the server until the validity period of the cert runs out or it is revoked by the CA. However … revocation doesn’t work. The revocation lists arent checked by most clients so a stolen cert will be accepted potentially for a very long time.

The second argument for shorter certs is adoption of new technology so certs with bad cryptographic algorithms are circled out quicker.

And third argument is: if the validity is so short you don’t want to change the certs manually and automate the process, you can never forget and let your certs expire.

We will probably get to a point of single day certs or even one cert per connection eventually and every step will be saver than before (until we get to single use certs which will probably fuck over privacy)

One reason for the short certs is to push faster adoption of new technology. Yes that’s about new cryptography in the certs but if you still change all your certs by hand maybe you need to be forced …

You don’t need something ever. Sometimes you just want something because the alternative is realy bad. I don’t need to eat. I want to eat because I don’t want to starve.

I want to watch a movie with my partner at the agrees time because otherwise they will be mad. I want to access my digitalized documents to send a letter in time because otherwise I will have to pay late fees. I want to access my gameserver because that’s the one time a week I get to have fun with my friends from my college time.

There are many situations where I’d rather do the thing I want instead of doing maintenance.

There is still a good reason to know about problems early. Without any monitoring you will find out about problems exactly in that moment when you what to use the service that doesn’t work. Sometimes you need something quick and you don’t have time to debug and fix in that moment. If you get an alert early you can decide to fix it right away or in a few hours or tomorrow.