Aha, thanks for posting this, was a bit dismayed that I didn’t see that in the release. Now I see it was a misunderstanding so will wait until December to be disappointed. Well, no, I’m disappointed that I’ve been able to do this on my thinkpad for years and have had to fiddle with awkward compromises like accubattery if I want to reduce wear on my phone battery.

Anyone happen to know which release the audio sharing feature is scheduled for? Missed that one too.

Ha unfortunately browsers kind of decide that, I like JXL too 😢

My understanding of debbootstrap is that it’s for installing a minimal system, which is very much not what I want to do when rescuing an existing system as it’d probably overwrite things I’d like to keep. And the mount commands in the docs there to bind virtual filesystems before a chroot are similar to the sorts of things I’m hoping to find a memorable shortcut for yes. However, I already know what I want to bind mount, just looking for a more convenient way to go about it in a panic. Thanks for the suggestion.

Yes I recognise this post was more typing than a few decades of system rescuing but it’s also more relaxing because my laptop already works and a one character typo won’t be as much of a hassle here. It’d make an unpleasant chore more pleasant if there were a simple alias for this, which I occasionally speculate on proposing but ehhh I don’t need it so often.

So it appears this time I’m motivated enough to make a post here. But not quite motivated enough to:

• figure out how to wedge something to do this into the filesystem on my rescue ISO (because I’ll either lose that USB or need to remember to repeat it for the next Debian stable release which might come out before I need this again — I’m thinking on a longer time scale)

• learn how to formally engage with the Debian community (which seems lovely and welcoming but also extremely bureaucratic for sensible reasons and like I’ll have a pretty long road ahead of me to get a patch together and properly formatted and somehow applicable to all architectures and documented/internationalised and a lot of other steps I’m insufficiently motivated to undertake but perhaps eventually once I have a critical mass of contributions in mind that it feels worthwhile to dive in).

Next time I look for a small laptop to have handy one thing I’m going to be sure to prioritise is: how much battery does it use while suspended? I’d really like to not need to have it switch to hibernate after 30m of sleep or w/e and ideally just plug it in overnight like a phone.

Thanks, cancelled for now. I’ll keep an eye out for ways to contribute as we get more organised.

Big fan of that one, been using it for years.

https://explainshell.com/

The app, in the scenario where we’re trusting the author/store, is only part of the surface to the extent it’s exposed to a potentially malicious payload. eg. a trusted solitaire game using a vulnerable API doesn’t exacerbate that vulnerability because it doesn’t expose it to untrusted input whereas a PDF viewer would because the PDF could be coming from anywhere…

Really appreciate you taking the time to write that. I have a sense of most of that (“defense in depth” and “threat model” are good lenses to think about such things through for sure!) but what I was trying to get a better grasp on was how much risk from automated attack was a normal person without worries of an “advanced persistent threat” taking on by using a device past EOL. Like you say, “Quantifying how much of a difference it makes is not trivial” so I feel less conflicted to know that you’re comfortable with your dad taking that risk.

I would think that the main thing at stake for a typical user isn’t just browsing history or email though but rather identity theft since a successful attacker can use the device to get through 2FA.

It seems like the attack surface is limited to RF (bluetooth/wifi can be turned off if one is willing to make that compromise), app install (many just use a small selection of well-trusted apps), and messaging/browser which are regularly updated if the device is properly configured. Apps that aren’t pulling in random untrusted content are far less of an attack vector (eg. one’s bank app isn’t connecting to everything, just to the bank, pinterest is hopefully escaping user content, etc.)

Based on helpful details at the other thread (eg. Project Mainline, baseband isolation) I’m beginning to form the opinion that it is not unreasonably foolhardy for someone to continue to use an unsupported device if they are willing to make the compromises necessary to limit their exposure. Which wouldn’t necessarily mean “giving up bluetooth entirely”, just not using it when you’re in bluetooth range of an untrustworthy party eg. if you just use your headset to make zoom calls at home and are fine not having it on the subway.

Thanks for the reply. Definitely appreciate the point that lacklustre updates mean we need to pay attention even if we’re vaguely covered by our vendor. I think you’ve convinced me to subscribe to CVEs for android too, I’ve only had alerts for my browser. Really too bad they don’t make smaller Pixels.

I don’t think they are things that can be fixed on the app level?

Indeed not. So I’m trying to better understand how vulnerabilities at the system level are exploited. It seems like the attack surface is limited to RF (bluetooth/wifi can be turned off if one is willing to make that compromise), app install (many just use a small selection of well-trusted apps), and messaging/browser which are regularly updated if the device is properly configured.

Based on this thread I’m beginning to form the opinion that it is not unreasonably foolhardy for someone to continue to use an unsupported device if they are willing to make the compromises necessary to limit their attack surface.

Thanks, that’s encouraging and very relevant. Looks like it was introduced in Android 10 and aside from “Project Mainline” is referred to as “modular system components”: https://source.android.com/docs/core/ota/modular-system

Can you shed more light on what someone would be risking by continuing to use an EOL device? You say you don’t advise it, but it’d be helpful to elaborate on why.

It seems like the increased vulnerability would be relatively limited: I presume the browser and messaging are by far the most common vectors and those would be as up to date as ever but I can see how exploiting an unpatched vuln there on an unsupported device could have more impact as it would give more options for privilege escalation.

Otherwise it’d be something RF based. Aside from widely publicised things like BlueBorne (that we should be keeping an eye out for anyway), is it a reasonable concern that there are identify theft rings employing people with modified hardware wandering around subway systems trying to exfiltrate credentials from devices with specific vulnerable basebands? Seems like Android also offers some defence in depth there that’d make it unlikely enough to ensure it wouldn’t be worth their while?

There are a few technologically disinterested people in my life that I advise (as is no doubt the case for many here) and I don’t know how strongly to push for them to get new devices once theirs fall out of support. Most of them are quite content with what they’re using and are not in the habit of installing apps (and will reliably ask me first) so they really would be replacing the device solely for the updates. In some cases it’s not only the time and effort to decide on a replacement and get things transferred over but the expense can also be a burden. So I don’t want to raise the alarm lightly.

Aren’t you sorta trusting whoever wrote any package you install with root? I mean, you should have that attitude anyhow as packages have a huge attack surface so privilege escalation bugs are way more common than remote execution but still, flatpak and snap at least offer a bit of a sandbox which might improve…

I’ve enjoyed runbox.com for years but don’t think they offer catch-all, at least not when I last checked. You might look at mxroute.com, I heard about it later and might have gone with them first and they somehow seem more likely to support that

I can sort of see that for mastodon as it’s meant to be ephemeral but is the Lemmy community also resistant to indexing?

https://simple.wikipedia.org/ is a good alternative sometimes and I’m glad it exists, but that’s almost the opposite problem.

It does seem like they make an effort, their style guide starts out with “Probably the hardest part of writing a Wikipedia article on a mathematical topic, and generally any Wikipedia article, is addressing a reader’s level of knowledge.” https://en.wikipedia.org/wiki/Wikipedia:Manual_of_Style/Mathematics