The other poster mentioned it, but some things that may help:
I'm confused.
Initramfs is unencrypted in /boot when using LUKS with RAID. It has to be, right?
The attacker uses a debug shell to modify the unencrypted boot, so the next time you boot and type your LUKS password, they can gain access.
This doesn't line up with your comment?
Everyone is waiting for this. There needs to be a party.
A fun conversation starter is always "So do you have an internal monologue?"
No thanks. I get some people agreed to this, but I'm going to continue to use .lan, like so many others. If they ever register .lan for public use, there will be a lot of people pissed off.
IMO, the only reason not to assign a top-level domain in the RFC is so that some company can make money on it. The authors were from Cisco and Nominum, a DNS company purchased by Akamai, but that doesnt appear to be the reason why. .home and .homenet were proposed, but this is from the mailing list:
- we cannot be sure that using .home is consistent with the existing (ab)use
- ICANN is in receipt of about a dozen applications for ".home", and some of those applicants no doubt have deeper pockets than the IETF does should they decide to litigate
https://mailarchive.ietf.org/arch/msg/homenet/PWl6CANKKAeeMs1kgBP5YPtiCWg/
So, corporate fear.
I just use openssl"s built in management. I have scripts that set it up and generate a .lan domain, and instructions for adding it to clients. I could make a repo and writeup if you would like?
As the other commenter pointed out, .lan is not officially sanctioned for local use, but it is not used publicly and is a common choice. However you could use whatever you want.
I use a domain, but for homelab I eventually switched to my own internal CA.
Instead of having to do service.domain.tld it's nice to do service.lan.
Yea no clue what this is. No context, can't reqd what was attached because it's an image. Waste of a post.
Agreed, and unfortunately articles like this are food for CEOs to do more under the guise of AI. "See, it works!"
Wouldn't it be more efficient to put this on Codeberg and accept PRs?
I'm still running Qwen32b-coder on a Mac mini. Works great, a little slow, but fine.
I don't think this is how it is supposed to work.
Really wish the DLC for this was still available. Slay away Camp is good, but this was so much better and I missed out on the DLC..
You always "boot something that is unencrypted." You then "mount" the encrypted volumes and load the OS.
This is how people can put an SSH server (dropbear) in initramfs so they can unlock remotely.
The attack is to initramfs, not the encrypted layer.
The order'ish: