@ricecake - eviltoast
  • 4 Posts
  • 1.21K Comments
Joined 1 year ago
cake
Cake day: June 11th, 2023

help-circle
  • Depends on the vendor for the specifics. In general, they don’t protect against an attacker who has gained persistent privileged access to the machine, only against theft.
    Since the key either can’t leave the tpm or is useless without it (some tpms have one key that it can never return, and will generate a new key and return it encrypted with it’s internal key. This means you get protection but don’t need to worry about storage on the chip), the attacker needs to remain undetected on the server as long as they want to use it, which is difficult for anyone less sophisticated than an advanced persistent threat.

    The Apple system, to its credit, does a degree of user and application validation to use the keys. Generally good for security, but it makes it so if you want to share a key between users you probably won’t be using the secure enclave.

    Most of the trust checks end up being the tpm proving itself to the remote service that’s checking the service. For example, when you use your phones biometrics to log into a website, part of that handshake is the tpm on the phone proving that it’s made by a company to a spec validated by the standards to be secure in the way it’s claiming.


  • Package signing is used to make sure you only get packages from sources you trust.
    Every Linux distro does it and it’s why if you add a new source for packages you get asked to accept a key signature.

    For a long time, the keys used for signing were just files on disk, and you protected them by protecting the server they were on, but they were technically able to be stolen and used to sign malicious packages.

    Some advanced in chip design and cost reductions later, we now have what is often called a “secure enclave”, “trusted platform module”, or a general provider for a non-exportable key.
    It’s a little chip that holds or manages a cryptographic key such that it can’t (or is exceptionally difficult) to get the signing key off the chip or extract it, making it nearly impossible to steal the key without actually physically stealing the server, which is much easier to prevent by putting it in a room with doors, and impossible to do without detection, making a forged package vastly less likely.

    There are services that exist that provide the infrastructure needed to do this, but they cost money and it takes time and money to build it into your system in a way that’s reliable and doesn’t lock you to a vendor if you ever need to switch for whatever reason.

    So I believe this is valve picking up the bill to move archs package infrastructure security up to the top tier.
    It was fine before, but that upgrade is expensive for a volunteer and donation based project and cheap for a high profile company that might legitimately be worried about their use of arch on physical hardware increasing the threat interest.



  • Minimum wage means minimum livable wage, and “livable” isn’t the same as “survivable”.

    Anyone working should be able to afford the amenities we call living, not just scraping by. Children, transportation, food, healthcare, reasonable recreation, savings, retirement, self development and actualization. All of it.
    People not working should be able to survive, and we should do everything we can to get them to that “living” point as well. Disability or a bad labor market shouldn’t close someone off from eating, having children or going to the doctor.



  • So, kinda. The ruling did have more nuance than a lot of people take from it, but it’s still not a good ruling by any means.

    The president has absolute personal immunity for core constitutional acts, and the presumption of immunity for official acts.

    That means that you can’t sue Biden for vetoing a bill, or other things defined in the constitution. That doesn’t mean you can’t sue the office of the president, but that you can’t sue the individual.
    The next part is that the courts need to assume that there’s immunity for anything done “as the president” unless the prosecution can argue that not having immunity couldn’t possibly infringe on a power of the president, and you can’t use the presidents motivation to make that case.

    So the president talks to the justice department about what they can do to sway the election for him: you can only talk about the impact of holding the president liable for talking to the justice department about elections.

    You can’t talk about the president assassinating a political rival because that introduces their motive. “Would the office of the president be hindered by holding them personally liable for using the constitutional power to command the military to target a threat to the country”.

    Trumps family could sue, but Biden wouldn’t be liable, only the executive branch.





  • Certainly. I’m not saying soap is bad by any means. It’s a tool for bathing just like any other. Not using soap to wash your body doesn’t imply unhygienic anymore than not using a scrub brush makes you unhygienic.

    What matters is that you wash regularly, get rid of grime, dirt, excess oils and dead skin buildup.
    There’s many paths to hygiene. For most people, the one with soap is the easiest and the only downside is “now moisturize”.

    Persistent advertising from cleaning product companies since the 50s have heavily pushed a level of cleaning and perfuming well beyond what’s actually necessary for hygiene.
    My body wash company would like me to use a silver dollar sized portion. I get better results from a dime sized portion and a moderate firmness silicone brush.


  • You’re taking “it’s possible to be clean after bathing without soap” as a way stronger statement than it is.
    Do you think I’m saying soap is bad?
    No one is talking about hygienic hand washing practices for medicine, food prep, after defecation, or after being coated in tough substances.
    We’re in a giant pile of people talking about routing bathing to prevent body odor and the skin issues caused by poor bodily hygiene.
    Washing with running water and a scrubbing action is sufficient for that purpose for many people. Bathing without soap is not a guarantee that you will have BO, a rash, skin lesions, or acne.

    The Africa point isn’t really the gotcha you think it is. Soap working better faster doesn’t mean that a lack of soap doesn’t work. As you said, when they didn’t have soap they still washed. People are generally interested in being clean, and pragmatic. They’ll clean themselves, and if something helps them get cleaner faster, they’ll use it.

    And yup, that passage does document that the Roman empire eschewed soap for personal hygiene until roughly year zero.


  • The primary action that soap has for fighting bacteria is breaking down oils and making it easier for debris and bacteria to be removed. Less food for the bacteria, and faster removal.
    Bacteria will be destroyed by this process, but that’s coincidental to why soap works and provides benefit.
    It’s why we don’t tell people to wash their hands by squirting soap on them, spreading it around and then rinsing it off. The critical step is the mechanical action that facilitates removal of debris with running water.

    Yes, soap is necessary for hand washing because we need to maximize bacteria removal after defecation or before preparing foods or medical activities.

    In the context of bathing however, you don’t need to sterilize your torso. You will also be rinsing your body far longer than you’re typically going to be washing your hands, which when combined with scrubbing results in a clean torso.

    I’m not one of those people who’s opposed to using soap or anything, but that’s not the same as recognizing that it’s possible to wash and be clean without it.


  • Did I say pure luxury, or did I say it makes it easier?

    I did forget that something is obviously 100% vital and indispensable or entirely worthless and void of functionality.

    Early soaps were used for the preparation of textiles rather than personal hygiene.
    As early as we invented soap, we actually had the notion that festering in your own rancid body oils is bad far, far earlier. As such, we had ways of dealing with that well before we had soap and people didn’t just immediately switch.

    So go ahead and use soap. I certainly do. But if you’re looking to have your mind blown, take a shower and just scrub your skin with a brush, loofah or the palm of your hand and be amazed when you still get clean. If you’re really grimey, you can do what the Romans did and rub yourself with olive oil and scrape it off with a scraper before doing that.


  • Phrasing it like that is weird, but you don’t actually need soap. It just makes the oils and grime come off easier, so without it you just need to scrub more diligently.

    If you’re cleaning yourself properly your skin is gonna be the same cleanliness afterwards either way. Cheap soap will dry your skin though, so use decent soap.

    Cleaning regularly and effectively is the key, not the specifics. Soap just lowers the bar for effectiveness, and maybe adds “and also moisturize”.


  • Most voters don’t have a business and never will.

    The value of a net new business is that it creates more jobs and economic activity.
    Most people benefit from more jobs to either work at or drive up labor demand.
    Per that school of economic thought, incentivizing a new business adds more activity to the market and more opportunity for people to find ways to innovate, provide value and become profitable.
    Giving money to an existing struggling business is subsidizing a businesses that’s already demonstrated that it’s not working.

    However, we’re both putting too much into it. The goal is to say $50k for small business, because people like a business friendly atmosphere.
    Trump gets credit for giving tax cuts to businesses for stock buyback, which only helps investors. The goal is to court people who want pro business policies without literal handouts to corporations.


  • If you watch the video, he wasn’t using it for anything political. He’s doing low stakes crowd work. He’s chatting with people, gives a guy in a trump hat a signed hat while making some self deprecating jokes and good natured insults to the guy in the trump hat. Definitely makes like he’s going to steal the guys hat, and puts it on for a second for a bigger laugh.

    Optics good, bad, or neutral, it wasn’t a planned “solidarity” thing like the headline makes it sound.

    A better headline would have been “Biden borrows trump hat for laugh at lunch following 9/11 memorial event”