[–] 12 points 19 hours ago

Generally GrapheneOS is looking for sufficiently secure hardware it seems.

Non-exhaustive list of requirements for future devices, which are standards met or exceeded by devices starting from Pixel 8 (shiba) through Pixel 10a (stallion):

Support for using alternate operating systems including full hardware security functionality
Complete monthly Android Security Bulletin patches without any regular delays longer than a week for device support code (firmware, drivers and HALs)
At least 5 years of updates from launch for device support code with phones (Pixels now have 7) and 7 years with tablets
Device support code updated to new monthly, quarterly and yearly releases of AOSP within several months to provide new security improvements (Pixels receive these in the month they're released)
Linux 6.1, 6.6 or 6.12 Generic Kernel Image (GKI) support
Hardware accelerated virtualization usable by GrapheneOS (ideally pKVM to match Pixels but another usable implementation may be acceptable)
Hardware memory tagging (ARM MTE or equivalent)
Hardware-based coarse grained Control Flow Integrity (CFI) for baseline coverage where type-based CFI isn't used or can't be deployed (BTI/PAC, CET IBT or equivalent)
PXN, SMEP or equivalent
PAN, SMAP or equivalent
Isolated radios (cellular, Wi-Fi, Bluetooth, NFC, etc.), GPU, SSD, media encode and decode, image processor and other components
Support for A/B updates of both the firmware and OS images with automatic rollback if the initial boot fails one or more times
Verified boot with rollback protection for firmware
Verified boot with rollback protection for the OS (Android Verified Boot)
Verified boot key fingerprint for yellow boot state displayed with a secure hash (non-truncated SHA-256 or better)
StrongBox keystore provided by secure element
Hardware key attestation support for the StrongBox keystore
Attest key support for hardware key attestation to provide pinning support
Weaver disk encryption key derivation throttling provided by secure element
Insider attack resistance for updates to the secure element (Owner user authentication required before updates are accepted)
Inline disk encryption acceleration with wrapped key support
64-bit-only device support code
Wi-Fi anonymity support including MAC address randomization, probe sequence number randomization and no other leaked identifiers
Support for disabling USB data and also USB as a whole at a hardware level in the USB controller
Reset attack mitigation for firmware-based boot modes such as fastboot mode zeroing memory left over from the OS and delaying opening up attack surface such as USB functionality until that's completed
Debugging features such as JTAG or serial debugging must be inaccessible while the device is locked

https://grapheneos.org/faq#supported-devices

  • source
  • [–] 1 point 1 day ago* (last edited 1 day ago) (3 children)

    I just checked my main PC which I use for playing games and development (Android and Rust), and it uses 45GB for /nix just after nh clean all which deletes all profiles but the current one. 50GB might be a bit tight during a rebuild where you inevitably have two copies of the software, but outside of that, it seems good enough.

  • source
  • parent
  • context
  • [–] 1 point 1 day ago* (last edited 1 day ago) (5 children)

    I suppose you are aiming for impermanence? 50GB seems good enough if you're not installing too many tools. If you haven't already, take a look at nix.* options because they have some storage optimisation options. That and CLI tool called nh, which cleans stuff up for you.

    {
      nix = {
        settings = {
          auto-optimise-store = true;
        };
        gc = {
          automatic = true;
          dates = "daily";
          options = "--delete-older-than 10d";
        };
        optimise = {
          automatic = true;
          dates = [ "weekly" ];
        };
      };
    }
    
  • source
  • [–] 3 points 6 days ago* (1 child)

    Does fediverse have automatic content propagation across instances? Because from what I have seen, content preservation is not the strongest suit of the fediverse unless it's a major instance, in which case we're just back to rebranded AO3.

  • source
  • [–] 17 points 1 week ago (3 children)

    Ah that explains it. But why would they bother with the dots? Perhaps to make it clear to others that the window is compliant? All the information I can find online seems to suggest that it's the dots that makes the window visible to the birds.

  • source
  • parent
  • context
  • [–] 7 points 1 week ago* (1 child)

    OP is def not from UK or Australia

    I'd go with "literally". Its usage makes me wonder if it really is the case or it's just exaggeration. Except people are using it in series contexts.

  • source
  •  

    Hello. I created a community that is intended to replicate a subreddit I always enjoyed going through. This community is intended to be a more specialised version of asklemmy where you ask questions for which the answers are (hopefully) heavily dependent on where you're from. We do allow politics for now, but it cannot solely focus on a single country. ("Who is the most hated president in your country" is allowed, but "what do you think of <a politician>" is not)

    https://sh.itjust.works/c/AskTheWorld

     

    My first language is Korean, and one rule no one gets right is the spacing. It seems pretty obvious in English and many other languages, but in Korean, there are things that look like a single word but is actually two separate words (and vice versa), particles which needs to be written without spacing, and some other rules that makes it confusing. It's bad enough that one of the former director of the National Institute of Korean Language confessed he's not confident about it either.

     

    I've just been to Ilsan comic world event, and holy shit there were SO MANY OF THEM! There was at least one Miku stuff at just about every single stall, and choosing which to buy was really hard. A lot of high quality cosplayers too, and I took photo with them too. I did dress a bit too as Kagamine Len, but I really got to work on makeup. A lot.

    One of the stalls was selling her ID card alongside many, many other people 😭 literal identity theft

     

    I've been playing ARC Raiders, and seeing people playing music into their microphone got me to find a way to do that on Linux. Fortunately, it doesn't take much to set it up, but it took me couple of days to piece that commands together. I wrote a post about it, and I figured people here may find this useful.

    TLDR: Bind these scripts to a key

    Setup Script

    src=alsa_input.usb-Samsung_Samsung_USB_C_Earphones_20160406.1-00.analog-stereo; # Sets the microphone name
    pactl load-module module-null-sink sink_name=Combined sink_properties=device.description="Combines-real-mic-with-sound-effects"; # Create a virtual device
    pactl load-module module-loopback source=$src sink=Combined; # Make microphone play sound into the virtual device
    

    Toggle Microphone Script

    dev=alsa_input.usb-Samsung_Samsung_USB_C_Earphones_20160406.1-00.analog-stereo
    vol=$(pactl get-source-volume $dev | grep -o '[0-9]\+%' | head -n1 | tr -d '%')
    
    if [ "$vol" -eq 0 ]; then
        pactl set-source-volume $dev 100%
    else
        pactl set-source-volume $dev 0%
    fi
    

    Play Sound Script

    # Optionally add "pkill paplay" so that sound can never overlap
    paplay --device=Combined --volume 30000 <Path to the file you want to play>
    # Optionally repeat the same command but without the --device flag so you know what's being played in the microphone
    

    Kill All Sound Being Played

    pkill paplay
    
    view more: next ›