I actually just did this recently with a BTRFS subvolume using a swap file and LUKS encryption.

The old Fedora magazine article has the overall steps required and someone also made a guide for secure boot on I think the spiceworks framework forum.

The catch is that secure boot will only allow signed images to be loaded which includes the hibernation swap image, meaning you have to use a customized kernel that allows unsigned hibernation images to load.

I’ll share both links when I get a chance.

EDIT:

Fedora Magazine guide: https://fedoramagazine.org/hibernation-in-fedora-36-workstation/

This is slightly outdated as Fedora now uses a proper zram.swap definition with systemd, so you can also do a systemctl edit to disable and enable zram0 with post/pre start on the hibernate service directly instead of using swapon/swapoff. I’ll make a second edit with my example I’ll have to dig out of some poorly documented notes lol.

https://community.frame.work/t/guide-fedora-36-hibernation-with-enabled-secure-boot-and-full-disk-encryption-fde-decrypting-over-tpm2/25474

This is the full forum post guide for FDE + TPM + secure boot. I’m not entirely sure of the kernel patch specific but it seems that the hibernate swap image is technicallly signed because if the bootloader process, but the kernel lockdown mode rejects it regardless by default because there’s no guarantee that the swap image was configured with FDE and not tampered with, which would be a vulnerability.

Quick glance at the kernel patch makes it seem like it’s just a flag check to allow hibernate in lockdown mode, so I assume the secure boot signature check is still completed.

lockdown_hibernate [HIBERNATION] Enable hibernation even if lockdown is enabled. Enable this only if your swap is encrypted and secured properly, as an attacker can modify the kernel offline during hibernation.

Don’t worry guys, we’ll get a RISC-V device that blows Apple ARM out of the water any second now.

Annnnyyy second now…

Passkeys and 1FA were always just a duct tape solution for users resuing basic passwords without having to set a stronger password requirement or relying on users to use a strong password.

I think Chrome and Firefox should have decided on making an API for their builtin password generation and filling functions, that way any password manager would be able to integrate with foolproof functionality out of box.

People already use browser auto gen passwords for the reason that its faster and usually has an account sync built in. Now it would work with any 3rd party solution as well which covers enterprise and security minded users as well.

Users won’t use a password manager if it means you have to manually make an entry everytime you make an account.

I read the OP which is why I asked the question, not the entire thread just to figure out that you don’t want to use containers.

What about podman quadlets?

Dunno about immich, but photoprism also has a bunch of CUDA libs that would otherwise be a pain to maintain specific version sets on the host.

I don’t want to run a separate database or anything complex, so things like Immich or Photoprism are not an option.

Why not just use podman and let it handle itself? Unless you’re planning on hosting like maybe several million photos, I doubt you would ever need to manually set up a DB.

Just download the compose file, add your photo directory paths to it, and let it start and never think about it again until you feel like updating for some new feature months later.

It is a war crime to locate a military facility near civilians.

Have you been on basically any homeland military base ever?

Is there functionally anything different had they done the same thing without AI?

Its not like this is the first time the US bombed a bunch of civilians. I could easily see this headline slip into a DNC candidate promise to ban AI for military use as soem sort of “improvement”.

Even though this is obviously anthropic marketing bait, I thought it was still funny

I tried it again recently as a comparison to Tor and I much prefer the “everyone is a node” system + full TCP and UDP support, but the main downside is throughput/bandwidth.

It’s excellent if you’ve got time but I wish they would bump the default node share limits so thst the network runs faster.

If its internal network traffic only, you can just use stalwart and add the DNS records to your network so that stuff can use SMTP.

Otherwise, (also with stalwart or your preferred software), you will want to use an SMTP relay so that outgoing messages will be delivered without the hassle of getting your domain reputational enough for sent messages not getting junked by the big email providers.

I’m extra lazy and haven’t set this up, so I just have a public mail server that only receives messages because my outgoing SMTP port is blocked by my ISP.

If this was still like 2010 I actually would have thought this is pretty nice but office went to complete garbage just likee everything else MSFT has touched this past decade.

Even on windows I’ve seen random people using libre office instead.

The last time I opened excel it actually died trying to handle my copy paste of a simple list.

I mean, I’m pretty sure this excuse for a distro shipped with multiple critical bugs lol.

It really should not be receiving funding when compared to the handful of other arch packs thst actually have a functioning security model.

Yeah okay pack it in boys, the antichrist is gonna be an AI chatbot that convinces people to worship it.

Shouldn’t even have been surprised, I’m pretty sure star trek did it multiple times already.

Ah didn’t realize it came preinstalled lol.

Saw the title and I already knew IPv6 was still gonna be “not enough adoption” lol.

The overly aggressive lockdown from NAT is not entirely misplaced though. Windows is already notorious for default hosting an atrocious level of protocols that are anywhere between “I can get your NetNTLMv2 hash for free” to “gg ez RCE as SYSTEM user”.

Linux and Unix were also not magically protected either, like every FTP server implementation has had several RCE vulns and it was so bad that Linus himself pointed out how easy it was to abuse buffer overflow vulns even after the addition of NX mem protection with return to libc, several years before ASLR finally landed in Linux and Windows.

Seriously, the early 2000s was the wild west of vulns because everything was still written in C++ so you could just waltz into any binary, find some stack/heap overflow, and you’re on your way to an RCE.

NAT (and firewall) most definitely did prevent millions of users from getting rekt by a metric ton of malware that operated on the ability to connect to those services.

I feel like this has to be made up, downstream repack distros almost never show up on the top 10 usage stats. You will always see Ubuntu way ahead of Kubuntu.

Not to mention 1Password is a pretty popular enterprise app and I have yet to see some insane sysadmin actually roll with arch as their distro of choice. Most are probably on RHEL or some other enterprise derivative.

People are forgetting the AI hype train is reliant on the fact that businesses and individuals can’t host the AI themselves, which is rapidly changing.

All that insane power that OpenAI and Anthropic have harnessed is suddenly completely useless when you can just spin up a competing model at home, with HF hosting a crap ton of finetuned models like uncensored/abliterated to do whatever you want with it.

Even Deepseek released their full size models if you happen to have 400Gb (or 1.5Tb) of VRAM lying around.

When the bubble (hopefully) pops, AI will just continue to be a tool that devs use where applicable, and likely not on a massive data center cloud as it migrates into consumer electronics.

*that’s not made by Google’s shitty dev team and is a flip style, not tablet fold

I just want a flip phone that has 3rd party ROM support lol.

We’re like half a decade into the flip scene and we’ve been stuck on OEM slop for too long.