AI is a hideous abomination tainting everything with its existence or our lord and savior that will soon™ solve all of humanity’s problems. There is no middle-ground anymore.

And the notion that a tool can be useful for one thing if properly handled, not so useful if used carelessly, and absolutely stupid when used for a purpose it cannot actually fullfil is somehow (magic? collective brain-dead?) deemed crazy now.

PS: The only thing more insane than the discussion itself are the arguments about AI-use being unethical as it is trained on stolen data usually made by the very same copyleft guys that claim that no copyright should exist, all data should be free, and copying something is no theft!

That’s what the documentation says. I don’t know if/when that changed as I barely use docker.

Well… it’s the default iirc (192.168.65.0/24). So that’s what docker uses if there is no explicit configuration you could find.

the 192.168.65.1 address that manifested out of nowhere

Or it’s indeed the internal virtual lan your docker config uses…

Is that an actual problem or are you really just trying to fix the logs? That should be doable via headers so the real origin is preserved independent of proxying.

And as with every other of these browser lists some flavor of the month new firefox-based one wins. One that might or might not still exist in that form in another year (here it’s one that only exists as firefox release-based for a year - before that is was a fork from some old firefox version or even based on chrome at some point). 🥱

If you use the shortlived profile and your key is compromised, you benefit from the short lifetime.

Maybe I’m just too stupid to understand how those certificates work.

But in what scenario is my key compromised but not my server? Because someone getting control of my server can just get an new long-term certificate. That was my actual point in the comment above. I understand the argument of added security if they only issue short-term certificates. But where is the benefit of my short-term certificate when someone compromising my server can just get a new long-term one in seconds?

Also we are talking about self hosting. I understand the issue of revoking certificates when you have a massive userbase where some might miss the revocation for quite some time. Not so much with the dozen max family and friends.

As of the manpages systemd-sleep looks for:

The main configuration file is loaded from one of the listed directories in order of priority, only the first file found is used: /etc/systemd/, /run/systemd/, /usr/local/lib/systemd/, /usr/lib/systemd/.

Also

The default configuration is set during compilation, so configuration is only needed when it is necessary to deviate from those defaults.

So yes, you can use any existing file from another computer as your template (root:root 644 would be the default owner/permissions for it).

PS: I tried on my PC and setting AllowHibernation=no in the config file produced a different “hibernate is disabled by config” error. Only if I remove the resume=<swap location> kernel parameter do I get the “not set up” error you mentioned but I’m not at home and only have my old (encrypted and able to hibernate) bios laptop with me. So I can’t check this for modern UEFI where systemd-sleep should automatically pick a suitable swap space and save the location in an EFI variable without any additional configuration.

You can however set the resume=UUID=<your swap's UUID> kernel parameter anyway. Even the automatic systemd/uefi setup accepts this as a way to manually select a location. So maybe you try that. If your problem is decryption of the swap at startup you should not get an error when initiating the hibernation as you do now but instead get problems when you try to restart from swap.

Washer/dryer getting their signal to start from an outside source according to electricity price (with a dynamic plan) or weather (with your own solar) actually makes sense. I really don’t care when it does my laundry as long as it’s done between me leaving the house in the morning and coming back in the evening.

The main point is that even smart appliances barely ever need their own connection to the internet. Getting (meaningful) communication from inside your home network (including from the one device that acts as your access point from the outside that has a connection) is absolutely enough.

OP seems to use the systemd hooks anyway. And with them all disks get decrypted with the first given password (or at least try and only ask for additional passwords if that fails). So it’s not neccessary anymore to have everything on the root partition. Several encrypted with the same password will do. (For example I unlock a classic swap partition and 3 differently sized disks creating one btrfs raid1 for root with one password.)

I asked the same as resume= should still work in general, but strictly speaking it’s not neccesarry anymore. Modern UEFI systems work without it by saving the information where to locate the saved state in an HibernateLocation EFI variable.

I know that I could easily change my config. My point is that a) they are failing to advertise this and b) I don’t see any reason to do it. I understand the arguments about security benefits of shorter certificates on their side and iirc they are already planning to change it from 3 months to 1.5 months in the future. But in what scenario do I benefit from a short-term certificate as long as the regular ones are still available anyway?

Wild guess as I’m not using dracut and have only setup encrypted hibernation on an old bios laptop…

But did you edit the systemd-sleep.conf (usually /etc/systemd/sleep.conf, although there are some other possible locations)? The other old-school and universal way of telling your system that hibernate is enabled without systemd would be a resume= kernel parameter

Certbot came with a systemd timer running twice a day (0, 12 +12h random) that only renews –iirc– when the certificate has 30 days or less to live. Also I looked it up and my (version 6.7) Certbot neither mentions the option with the --help option, nor in the manual (where there is just one instance of “profiles exist, no other details given”).

So they probably need another way than a random blog post when they want users to use (or even just know about) that option…

It’s been pretty much a set-and-forget experience

Yeah, that’s what it always has been. So no need to change anything unless they make it the new standard on their side with an update…

So exactly like an AGI emerging after just one more update.

You mean they are reaching geo-synchronous orbit after already skyrocketing this year?

Where can I get this graphic in better quality and with actually visible lines?

Edit: Okay, scrap that. At the second attempt the source actually loaded… And it’s interactive but not really better.

90% of this is usually based on knowing where on the keyboard the “–”-key is located and using it correctly over hyphens…

I personally have gone for Manjaro

Why would anyone intentionally do that?

The whole Manjaro concept of delaying Arch updates by two weeks is bullshit, because they don’t actually use that time for additional tests or include fixes. They just ship exactly the same bugs 2 weeks later.

On top of this where Arch explicitly warns users about the AUR as unvetted community content and only lets you install AUR helpers manually (increasing the chance that people see the warning and think twice) Manjaro comes with their own AUR helper pre-installed. No warning, no nothing. Oh, and they use the unmodified AUR which is running under the assumption that you have an updated Arch system, not one weeks out-of-date. So welcome to breakages and dependency hell.

Said Manjaro-specific AUR helper also has ddos’ed the AUR on multiple occasions because they don’t seem to believe in testing.

Have I mentioned the –by now meme-worthy– fact that they are too stupid to not let their SSL certificates expire and unironically proposed setting your PC’s clock/date back as a solution?

Internet censorship is very easy to do, I don’t know why some people tunnel-vision on the fact it’s not perfect. It doesn’t have to be perfect to still be very effective.

That was my actual point. It’s effective for censorship and targeting the broader population. It’s ineffective for preventing piracy as a lot of people there are indeed tech-affine and belonging to the <1% that will go the extra mile to circumvent it.

So implementing provider and dns blocks against piracy is either stupid or an intentional lie. I assume the latter.

And who’s going to block all the freely available DNS servers, proxies and also TOR? 😆

That’s just another piece of bullshit legislature to enact censorship measures in the name of some seemingly legit reason. You will never actually get rid of piracy sites with local ISP and DNS blocks. But the moment there is a procedure to easily make them happen, they can indeed be used to block the not tech-affine majority of people from news and information they should not see.