If you are worried about someone breaking in to your house and replacing the bootloader while leaving your drives in place I probably wouldn't use the TPM auto unlock even if in theory secure boot should be able to handle this.
But in reality that will never happen and the only actual attack you need to be worried about is junkies breaking in and flogging the drives on facebook marketplace. For which, this level of security is fine.
I run my cheap hosting box with a cleartext boot setup that uses ssh to automatically grab the key for the real root from my home server (or an alternate at my MILs house). Using FreeBSD, but similar concepts.
A previous hoster once gave me someone else's drives without wiping them. I don't want random customers snooping around on my data if a similar mistake happens with my disks.
For home use, I run without disk encryption. If I ever need to do data recovery, it's not going to be possible with encrypted disks and one point of a centralized NAS is to have stable long term storage.
> What about /boot - encrypted and tamper proof? Resists evil maid attack?
> Rabbit hole, I know, but so fascinating if you solved it all :)
Encrypting `/boot/` is the wrong thing to do. One can just replace it with something that logs the encryption key instead (and sends it off to somewhere). You actually need to verify that what you expect to be there is actually there and a encryption isn't gonna do that for you.
A reasonably secure boot chain looks roughly as follows: bootloader is checked by the UEFI (read secure-boot), bootloader chain loads a signed UKI which also uses secure boot verification (or just skip the bootloader if you only have a single kernel with no fallback), this then loads a signed dm-verity `/usr/` which brings you to the login screen. Root is just data (e.g. mounted `noexec`) and is encrypted using e.g. PCR 11 so that it only unlocks if the UKI is the one that is expected (with some other backup unlock method).
This is basically #2 of the "Design Goals" of Poetterings "Fitting everything together"[0]. It's a good read if you are looking to designing your own Linux image and are looking for some inspiration. There is ParticleOS[1] which somewhat dogfoods this kind of system, though I don't think it is anything remotely considered for a production system.
It all started when they took a stand against DoD on autonomous weapons and domestic mass surveillance usage. Feb 2026.
After that details don't matter, they've shown their "enemy" colours, once is enough. This is just punishment and it will continue, until they bend the knee.
While Anthropic publicly claims to refuse to help the MIC with warfare and surveillance, behind closed doors, Anthropic actively deploys its engineers and models to assist the NSA with espionage and offensive cyber warfare. Just look at the many contradictions:
* Anthropic secretly sent its own engineers directly to the NSA to deploy its (at that time unreleased) model "Mythos"[2,7]
* While the Pentagon has publicly labeled Anthropic a "supply-chain risk", the Trump administration has simultaneously been working hand-in-hand with Anthropic behind the scenes to secure its upcoming initial public offering (IPO)[1]
* If the U.S. government truly believed Anthropic was a national security threat, it would completely isolate the company. Instead, the Trump administration has actively encouraged major American banks and financial institutions to use Anthropic's models[1]
* Anthropic is heavily embedded within Palantir, the foundational data platform of the Military-Industrial Complex[3][4]
* Ukraine’s Ministry of Defense operates hand-in-hand with Palantir. Ukraine uses a specialized Palantir AI platform called PRISMA to fight Russian forces. Anthropic's language models power the text and data analysis within this system[4]
* Ukraine uses Anthropic-backed Palantir software in secretive command centers to coordinate its aggressive long-range drone campaign inside Russian territory[8]
* Anthropic’s CEO, Dario Amodei, has stated that the company will not allow its AI to power fully autonomous weapons that take humans out of the loop. However, in Ukraine, the AI functions as a decision-support tool. Because a human commander makes the final choice to press the button or launch the drone, Anthropic's terms of service are not technically violated. This allows Anthropic to protect its "ethical AI" brand while still letting its technology serve as a vital asset for Western-backed military operations[5]
Remember the Minab school attack, where the U.S. Military killed 156 civilians, including 120 schoolchildren[6]? Given all the evidence it's highly likely that Palantir and Anthropic played and still play a major role in perpetrating the war of aggression and all the crimes involved.
Personally, I find it morally unacceptable to use U.S. AI tools, because I do not want to support them financially and thus support the crimes they are involved in.
And despite all this they've still held their two red lines:
- no mass surveillance of Americans
- no autonomous killbots on current models
Those are very reasonable red lines and the fact that (1) other companies aren't holding those lines at all, instead doing "all lawful use", and (2) that the government is willing to destroy the company over these two small carveouts, speaks hugely in Anthropic's favor.
> And despite all this they've still held their two red lines
How do you know? What reason is there to trust a company like Anthropic? It's about money, a lot of money, and from a company's perspective there is no reason to stick to these claims while the competition doesn't care and can train and improve their models on the vast pile of data they receive while mass surveilling U.S. citizens (which clearly is a huge competitive advantage).
With the IPO on the horizon, Anthropic has to show that their models are significantly improving and are far better than other models from the competition while concealing that their business is economically unviable. They solve this conflict by throwing even more hardware resources at their models to upscale their "emerging capabilities" even more. At the same time, this effectively makes their offered services economically even more unviable. So they have to put in some hard limits, which they do by implementing "security guardrails", which incidentally usually kick in in non-security contexts.
Anthropic is primarily burning U.S. based capital and investments, from the administration's standpoint it's simply rational to stop letting non-U.S. actors burn this huge pile of U.S. capital. Of course, it's also a direct support of Anthropic by the administration (they are from the same social class) for their IPO: "These models have huge capabilities and are dangerous, we have to limit access", so that potential investors may conclude that an investment will surely lead to huge gains in the future. Anthropic is really good at marketing after all.
> I still can't believe they killed iTunes. I used to have my entire digital music library in iTunes. Most of that was music I had ripped myself from CD ...
iTunes Match still exists, one of the handful of subs I pay for.
what's the diff between lite and full? i dont even remember what i use on safari, wipr or something. mostly use firefox but sometimes i casually just let things launch in safari
Why do people say crap like this... Safari was the first browser to completely remove mv2. From all the major browsers Safari has the worse adblocking experience and support for adblocking extensions...
1. Third-party cookie blocking by default — 2003 (Safari 1.0); industry first.
2. Intelligent Tracking Prevention (ITP), using on-device machine learning to identify and limit cross-site trackers — 2017; industry first.
3. Storage Access API prompts for embedded third-party content (e.g., social login widgets) — 2018 (ITP 2.0); industry first (co-developed by WebKit, later adopted as a web standard).
4. Full third-party cookie blocking (no exceptions) — 2020 (ITP in Safari 13.1); industry first for a major browser.
Apple only does things to progress their own business model. Apple failed at becoming an ad business so they pivoted to subscriptions and app revenue. Now they are building an ad business. Just look at their ad revenue.
Send it to Tim Cook email. It worked for me fixing DisplayPort DSC bug. After Catalina, later MacOSes lost ability to drive monitors at higher than 60Hz refresh.
Apple support tortured me with all kinds of diagnostics, with WontFix few weeks later. Wrote email and it got fixed in Sonoma :)
I don't expect emails to get through to busy CEOs of huge companies like Apple unless you're really lucky and they make it through some automation, but I have dropped him an email just in case. I guess you never know.
This was maybe 20 years ago. I was looking for a job as a recruiter and just called him. He referred me to an HR rep and I did get an interview from it. Didn’t get the job, but hey, I got a shot!
I think you'd want to offer morethan a problem statement when taking CEO time. Yes it's broken because shareholders demand M$ products have AI feature so that the share price has the 'AI' multiple.
It's pretty hard to justify the stock price, even with the current, high earling from the cloud so they are looking for hte next golden goose
I did it once, I'm pretty much sure Tim did not read the email, why would he, someone in his team did. I had an awful experience with AASP, no computer, no fix, no timelines (and money was tight), tried to escalate as much as I could and failed. Wrote to Tim Cook, explaining my situation and attaching all references... Got a call from Apple within like 2h, got a brand new Mac in a day. Those emails do work.
Tim rarely reads the emails. There's an executive team that reads them and handles them.
I got nowhere with Apple Support and emailed "Tim" and had a very helpful executive team member reach out and arrange to get things fixed and see it through to resolution.
I once had a terrible experience dealing with my local Apple Store and then a hostile call with an Apple Retail manager after I left critical feedback.
I emailed Cook, mostly just to shout into the void. Within a week I got a call from Apple Corporate, they gave me an appointment the next day and my hardware issue was suddenly solved over-night.
Fucking with DP 1.4 was how they managed to drive the ProDisplay XDR.
If your monitor could downgrade to DP 1.2 you got better refresh rates than 1.4 (mine could do 95Hz SDR, 60Hz HDR, but if my monitor said it could only do 1.2, that went to 120/95 on Big Sur and above, when they could do 144Hz HDR with Catalina).
I would be absolutely unsurprised if their fix was to lie to the monitor in negotiation if it was non-Apple and say that the GPU only supported 1.2, and further, I would be also unsurprised to learn that this is related to the current issue.
Ahh, true, I now have 120Hz top, but it's fine, why I said fixed :) I now recall in Catalina I had full 144Hz and VRR options! Monitor is Dell G3223Q via Caldigit TS4 DP.
I was using 2 27" LG 27GM950-Bs (IIRC), that could do up to 165Hz and VRR on a 2019 cheesegrater Mac Pro, wasn't the cables, or the monitors, or the card.
People at the time were trying to figure out the math of "How did Apple manage to make 6K HDR work over that bandwidth?" and the answer was simply "by completely fucking the DP 1.4 DSC spec" (it was broken in Big Sur, which was released at the same time). The ProDisplay XDR worked great (for added irony, I ended up with one about a year later), but at the cost of Apple saying "we don't care how much money you've spent on your display hardware if you didn't spend it with us" (which tracks perfectly with, I think, Craig Federighi spending so much time and effort shooting down iMessage on Android and RCS for a long time saying, quote, "It would remove obstacles towards iPhone families being able to give their kids Android phones").
Thanks for the recommendation. I didn’t know about forgejo.org.
The main convenience of Github for me is the ability to send preprepared prompts to Claude through its web interface or the mobile app and have it write or revise a batch of dictionary entries in the repository. I can then confirm the results on the built website, which is hosted on Github Pages, and request changes or reverts to Claude when necessary. Each prompt takes ten to thirty minutes to carry out and I run a dozen or more a day, and it is very convenient to be able to do that prompting and checking wherever I am.
When I have Claude make changes to the codebase, I find that I need to pay closer attention to the process. I can’t do that while sitting in restaurant or taking a walk like I do with the prompting for dictionary-entry writing. The next time I start a mostly (vibe) coding project, I’ll look into Forgejo.
