I actually just did this recently with a BTRFS subvolume using a swap file and LUKS encryption.

The old Fedora magazine article has the overall steps required and someone also made a guide for secure boot on I think the spiceworks framework forum.

The catch is that secure boot will only allow signed images to be loaded which includes the hibernation swap image, meaning you have to use a customized kernel that allows unsigned hibernation images to load.

I’ll share both links when I get a chance.

EDIT:

Fedora Magazine guide: https://fedoramagazine.org/hibernation-in-fedora-36-workstation/

This is slightly outdated as Fedora now uses a proper zram.swap definition with systemd, so you can also do a systemctl edit to disable and enable zram0 with post/pre start on the hibernate service directly instead of using swapon/swapoff. I’ll make a second edit with my example I’ll have to dig out of some poorly documented notes lol.

https://community.frame.work/t/guide-fedora-36-hibernation-with-enabled-secure-boot-and-full-disk-encryption-fde-decrypting-over-tpm2/25474

This is the full forum post guide for FDE + TPM + secure boot. I’m not entirely sure of the kernel patch specific but it seems that the hibernate swap image is technicallly signed because if the bootloader process, but the kernel lockdown mode rejects it regardless by default because there’s no guarantee that the swap image was configured with FDE and not tampered with, which would be a vulnerability.

Quick glance at the kernel patch makes it seem like it’s just a flag check to allow hibernate in lockdown mode, so I assume the secure boot signature check is still completed.

lockdown_hibernate [HIBERNATION] Enable hibernation even if lockdown is enabled. Enable this only if your swap is encrypted and secured >properly, as an attacker can modify the kernel offline during hibernation.

He actually offered to return to the US if they accepted that he would be given a public trial and not a military trial.

Obama’s administration rejected the idea and said that their only guarantee they would give was that they wouldn’t torture him.

Just to add my 2 cents: the list of countries that the US can’t extradite is not that long, especially when you exposed government corruption of the highest degree and you are considered a traitor.

EDIT:

Just to add my 2 cents: the list of countries that the US can’t extradite is not that long, especially when you exposed government corruption of the highest degree and you are considered a traitor.

Just to add, Snowden also indirectly exposed the US’s leverage in several countries that you would otherwise assume would not cooperate with the US in any capacity.

The fact that he ended up in Russia was because he couldn’t proceed to Ecuador which was his original planned location of asylum after leaving to Hong Kong.

There are really very few countries the US can’t realistically coerce or run a black ops mission to go after him. China didn’t want the political baggage for no gain and Iran can’t even protect its own leaders from strategic bombing.

That leaves basically Russia and its less than ideal former soviet allies.

Don’t worry guys, we’ll get a RISC-V device that blows Apple ARM out of the water any second now.

Annnnyyy second now…

Passkeys and 1FA were always just a duct tape solution for users resuing basic passwords without having to set a stronger password requirement or relying on users to use a strong password.

I think Chrome and Firefox should have decided on making an API for their builtin password generation and filling functions, that way any password manager would be able to integrate with foolproof functionality out of box.

People already use browser auto gen passwords for the reason that its faster and usually has an account sync built in. Now it would work with any 3rd party solution as well which covers enterprise and security minded users as well.

Users won’t use a password manager if it means you have to manually make an entry everytime you make an account.

The most junk hack I ever did (that somehow worked) was replacing a Tensorflow 1.x library set with the Tensorflow 2.x library set and keeping the original 1.x symlink so that the software using it would think it’s still the 1.x. .so file lol.

I presume the API had some deprecated fallback for poorly migrated software, which is why it worked without complaints.

Also bazel is by far the worst build system I have ever used.

I read the OP which is why I asked the question, not the entire thread just to figure out that you don’t want to use containers.

What about podman quadlets?

Dunno about immich, but photoprism also has a bunch of CUDA libs that would otherwise be a pain to maintain specific version sets on the host.

I don’t want to run a separate database or anything complex, so things like Immich or Photoprism are not an option.

Why not just use podman and let it handle itself? Unless you’re planning on hosting like maybe several million photos, I doubt you would ever need to manually set up a DB.

Just download the compose file, add your photo directory paths to it, and let it start and never think about it again until you feel like updating for some new feature months later.

It is a war crime to locate a military facility near civilians.

Have you been on basically any homeland military base ever?

Is there functionally anything different had they done the same thing without AI?

Its not like this is the first time the US bombed a bunch of civilians. I could easily see this headline slip into a DNC candidate promise to ban AI for military use as soem sort of “improvement”.

Even though this is obviously anthropic marketing bait, I thought it was still funny

I tried it again recently as a comparison to Tor and I much prefer the “everyone is a node” system + full TCP and UDP support, but the main downside is throughput/bandwidth.

It’s excellent if you’ve got time but I wish they would bump the default node share limits so thst the network runs faster.

If its internal network traffic only, you can just use stalwart and add the DNS records to your network so that stuff can use SMTP.

Otherwise, (also with stalwart or your preferred software), you will want to use an SMTP relay so that outgoing messages will be delivered without the hassle of getting your domain reputational enough for sent messages not getting junked by the big email providers.

I’m extra lazy and haven’t set this up, so I just have a public mail server that only receives messages because my outgoing SMTP port is blocked by my ISP.

It’d only work if someone did it with some PITA dependency that no company wants to actually throw resources at, but it would be hilarious to see Intel or Amazon make a big hissy fit over a random MIT project used in millions of systems getting revoked lmao.

Bonus if it affects Amazon because they already refuse to use AGPL software lol.

If this was still like 2010 I actually would have thought this is pretty nice but office went to complete garbage just likee everything else MSFT has touched this past decade.

Even on windows I’ve seen random people using libre office instead.

The last time I opened excel it actually died trying to handle my copy paste of a simple list.

I mean, I’m pretty sure this excuse for a distro shipped with multiple critical bugs lol.

It really should not be receiving funding when compared to the handful of other arch packs thst actually have a functioning security model.

Dunno how well zswap handles at that size, but the point is that is compresses swap into RAM, so it would use a max of 819.2M for a total of 2457.6M of swap space. If you need more, then by all means, use a swap file or partition lol.

Actually linux easily supports multiple and tiered swap mounts, so you could even go zswap + ssd swap + hdd swap, or a cheapo “burn at your own risk” usb flash swap lol.

Yeah okay pack it in boys, the antichrist is gonna be an AI chatbot that convinces people to worship it.

Shouldn’t even have been surprised, I’m pretty sure star trek did it multiple times already.

Ah didn’t realize it came preinstalled lol.