Coolio, but I won’t be using it at least until it hits Debian Testing. Hopefully this can be in Trixie - looks like the freeze hasn’t happened yet.

I don’t know that I’ve used enough handheld Linux devices to say. The only major one was I had Debian on my Surface Go 1. Power management never worked quite right - after a few suspends, I’d get these weird graphics glitches and have to reboot.

Also, I kind of hated the keyboard- it wasn’t very sturdy and often flexed, causing accidental trackpad clicks.

I still have the device, but when I need a portable Linux machine, I just go to my Thinkpad these days, which other than installing the backports kernel for Wi-Fi support and then adjusting the modprobe.d entry because it was Realtek pretty much just goes brrrr - even my desktop gave more of fuss, as I used to be in a room without ethernet and needed a card that worked with Windows, Linux, and Hackintosh (from before I got rid of my Windows install and my Hackintosh SSD conked out, leading me to switch to virtualization).

Looks like it’s fixed. Yippee!

MariaDB for the win!

He also is oddly enraged about Debian including slightly old versions of Xscreensaver in stable. I get his reasons - dumb people will submit bug reports for things that might already be fixed - but also, Debian has a promise to keep and is well within their rights since the software is FOSS.

Not quite. Upon a Google, it looks like they are hacks, but Wayland doesn’t support programs (like the Xscreensaver daemon) blanking the screen and would need a standard to do so.

However, these screensavers are just individual binaries that the daemon executes, so although they won’t pop up automatically, you should still be able to run and enjoy them as fun little graphics demos.

Cool. In a little over a month, I hit 3 years.

If it doesn’t simulate a connected monitor, it looks like there are little HDMI shims that do called EDID emulators that are available for relatively cheap.

(Note: Anything I say could be B.S. I could be completely misunderstanding this.)

Clevis isn’t too difficult to set up - Arch Wiki documents the process really well. I’ve found it works better with dracut that mkinitcpio.

As for PCR registers (which I haven’t set up yet but should), what I can tell, it sets the hash of the boot partition and UEFI settings in the TPM PCR register so it can check for tampering on the unencrypted boot partition and refuse to give the decryption keys if it does. That way, someone can’t doctor your boot partition and say, put the keys on a flash drive - I think they’d have to totally lobotomize your machine’s hardware to do it, which only someone who has both stolen your device and has the means/budget to do that would do.

You do need to make sure these registers are updated every kernel update, or else you’ll have to manually enter the LUKS password the next boot and update it then. I’m wondering if there’s a hook I can set up where every time the boot partition is updated, it updates PCR registers.

I got a response to my e-mail; they say it’ll be fixed by Monday.

JavaScript be like that sometimes…

That is so me sometimes.

You’re somewhat right in the sense that the point of disk encryption is not to protect from remote attackers. However, physical access is a bigger problem in some cases (mostly laptops). I don’t do it on my desktop because I neither want to reinstall nor do I think someone who randomly breaks in is going to put in the effort to lug it away to their vehicle.

Clevis pretty much does TPM encryption and is in most distros’ repos. I use it on my Thinkpad. It would be nice if it had a GUI to set it up; more distros should have this as a default option.

You do have to have an unencrypted boot partition, but the issues with this can at least in be mitigated with PCR registers, which I need to set up.

It’s a smidge more difficult on Debian if you want to use a non-ext4 filesystem - granted for most people, ext4’s probably still fine. I use it on my desktop, which doesn’t have encryption.

Yes, fellow OpenTTD player.

I’m using LVM. The BIOS solution would be a bad idea because it would be more difficult to access the drive on other systems if you had to; LVM allows you to enter your password on other systems to decrypt.

Do your servers have TPM? Clevis might be the way to go; I use it on my Thinkpad and it makes my life easy. If the servers don’t have TPM, Clevis also supports this weird thing called Tang, which from what I can tell basically assures that the servers can only be automatically decrypted on your local network. If Clevis fails, you can have it fall back to letting you enter the LVM password.

Sent! Although I just realized it’s not like only one person has to send an e-mail; multiple would make it clearer that these images are important to some people.

Well, it was worth a shot.