Damn. I would probably try a more mainstream distro for Optimus support, like Pop_OS! or Debian/Ubuntu with non-free repos enabled.
I remember Bumblebee was a thing back in 2013, but it seems that it hasn’t been updated since then: https://www.bumblebee-project.org/

Optimus as in Nvidia Optimus? I remember struggling with that under Linux in 2013. I would have thought it was supported by now. (Unless of course it’s another “Optimus”, in which case just ignore me.)

Ah, cool. I do have WSL installed on every Windows box I use regularly, but it’s good to know for when I run into a more locked down machine.

Seems a bit excessive to install WSL just to get an SSH client.

Using a password manager I’d have to copy-paste or remember each password. Not all have a web interface.

Then pick one that has a web interface or a CLI, Bitwarden has both and is free. KeePass databases can be hosted on your NAS and accessed to CLI tools. There are plenty of options. Or use passphrases (which are just as good as—or better than—complex passwords) and just type them? I use Bitwarden for literally each and every password/lock code/PIN that I have, and I have plenty of Pis and other things that don’t let me easily log into Bitwarden, but finding “Excentric4-Waxing-Adopted-Giraffe” on one device, and typing it in another really isn’t much of a hassle. (Also, why not just SSH into your Pis? Then you only need to worry about accessing a password manager on the machine you’re opening the SSH connection from.)

From the comments on this post it seems that you’re mostly looking for validation of the idea you originally had rather than actual feedback on how secure that idea is. You’re obviously free to manage your passwords exactly as you want, but this idea of a “base password” is objectively less secure than the alternative put forward by many people in these comments, namely to use the Yubikey to log into a good password manager that then handles all the different (completely unique) passwords.

There are always instances where doing things the best and most secure way is more cumbersome, and it’s up to you to decide if you want all of your passwords to be poor (and difficult to change, in this case) just because you occasionally need to log into something that doesn’t neatly integrate with a password manager.

Why not use the Yubikey for the master password on a KeePass DB (or another password manager) and then use actual different passwords—not just prefixed ones—saved in said password manager for your logins?

It doesn’t matter if your base password is a 255 character high-entropy annoying-to-type-manually-on-a-phone-keyboard or a 16 character string of alphanumeric characters if you reuse it in a slightly predictable manner. For it to be somewhat secure, the prefix would have to be completely random, which kinda defeats the idea of you being able to remember them. A “base password” is, to be frank, only one small step up from using the same password everywhere.

And as someone else pointed out, it makes it very difficult to change passwords, which also should be a huge red flag.

Take a look at the leaks on Have I Been Pwned and see how many of them include either clear text passwords or extremely weakly hashed (perhaps even unsalted) passwords. If you show up in just one or two of those, then you’re in a significantly worse position than you would be had you just used different passwords.

That makes sense, thanks. I wasn’t sure whether they included animals in the goal.

After reading the article, I’m confused about how it works. Guinea worms are parasites that you get infected with from bad water sources. Unless you eradicate the source (e.g. the worms themselves), can you really say that you’ve eradicated the disease? Even if we go a decade without any human contracting it, it’s no harder for someone to contract it by drinking contaminated water than it is today. It’s not like a viral disease, that simply stops existing if infection numbers drop to 0 for a while.

That being said, it’s great that numbers are as low as they are. Education and better water infrastructure is helping.

Literally no one but you has used the word “federated” in his thread of comments… You responded to the original comment about git being decentralized by saying “it’s still 1 centralized server that has the code”. I corrected you, because that’s not how git works, and now I’m not sure what the fuck you’re on about…

Edit: Screenshot, in case you forget.

You’d still have a complete copy of the current HEAD, you’d just be missing a bunch of history depending on the depth at which you cloned.

It’s really not. In your example, the meme would be decentralized — not “the internet”. Also, I think you’re confusing “git” with services offering “git and more” such as GitHub, GitLab, etc.

No, that’s not quite how git works. Everyone who’s cloned the repo has a complete copy of the code — at least at the time they cloned/checked it out. If GitHub, Gitlab, BitBucket or whatever goes away, you can keep working without it, provided that people know how to use a remote from another machine. Git really is decentralized even if people tend to use it in a centralized fashion.

Edit: Spelling.

Yes, either that or “I haven’t thought this through well enough that I can explain it in writing, so please let me fumble through an oral explanation and—in all likelihood—waste your time”.

Or, “I’m dyslectic and would prefer to talk rather than write”, which is fair enough, I think.

It’s voluntarily broadcasting it, because YOU told it to broadcast it.

Yes, and that’s not the issue as I’ve been saying the entire time. The issue is that you have a right to know where it’s broadcast — both in the past and in the present. That’s what I’ve been saying the entire time. And the privacy policy needs to specify exactly what data is sent and where to. The privacy policy you cited did neither, it just stated that it was sent out.

I am interested in discussion but I prefer to discuss things based on facts rather than feelings.

Email isn’t exempt from the GDPR. If an email provider is doing anything with your email except for delivering it to the intended recipient, then you have a right to know under the GDPR. Plenty of hefty fines have been handed out over failing to sufficiently inform about such things: https://www.enforcementtracker.com/ (look for e.g. art. 12 violations). Even something as simple as SMTP logs contain PII according to the GDPR and should be handled as such.

You voluntarily sending an email, with whatever content you decide to put there, to a recipient of your choosing, is in absolutely no way the same as clicking a vote button and involuntarily having your vote and username broadcast to whoever cares to listen without your prior knowledge and consent. Yes, emails travel through a bunch of MTAs underway — that’s a prerequisite for email to work. And no, broadcasting Lemmy votes along with usernames is in no way a prerequisite for voting to work.

It doesn’t matter if you post your +1 via lemmy or via email.

It absolutely does. When sending an email, you fill in the recipient and decide where your data goes, but when you press ‘upvote’ on Lemmy, you don’t have a say in who that information is broadcast to — especially not in its current form. And it’s on whoever runs the Lemmy server to comply with the GDPR and make data processors known. It really doesn’t matter how similar you think it is to email, the GDPR treats it differently and that’s the reality you have to accept.

Your argument could easily be extended to every piece of information floating across the internet. No one is forcing anyone to upload an image to Facebook, but Meta is still responsible for documenting who handles the image and for what purposes, they can’t just say, “you uploaded it, we let 3rd parties have their way with it”.

And I’ve also worked with the GDPR, both as a developer implementing systems to accommodate requests for data insight and erasure, and implementing controls to make sure data was being handled correctly and e.g. not stored for longer than allowed, and I’ve worked with it from a security perspective in order to protect the personal data of about a couple of million people, and finally I’ve worked with it in management to implement safe and GDPR compliant data handling strategies in a couple of companies.

Still not a good example because I’m still in control of what I choose to send and whether or not I choose to send it at all. I can’t choose whether or not Lemmy broadcasts my username in conjunction with my votes to whoever may be listening, but I can choose not to send an email to a mailing list stating who I am and how I vote on Lemmy posts.

Organizations handling EU citizens’ data are required to abide by the GDPR and I can assure you that Gmail and others do that, they were among the first scrutinized when the GDPR went into effect. Just because I can send any data via email, doesn’t mean that email providers can do whatever they want with the data. If an email provider processes the contents of your email in order to do targeted advertising, then they have to very clearly state that in their privacy policy.

This isn’t specifically aimed at you, @cwagner@lemmy.cwagner.me, but more of a general observation. Lots of people in this thread appear to be unfamiliar with the GDPR and how it works, and that’s completely fair — especially if you’re not from Europa and/or haven’t worked with it. I just wish they would actually check how it works instead of making assumptions. This is a good start: https://gdpr.eu/data-privacy/

Problem is that it’s not historical. If a server was defederated yesterday, it doesn’t appear in that list. And again, GDPR takes this stuff seriously, and “look at the bottom” is not sufficient. It needs to specify what data goes where.

I don’t think email is a good example because you’re in complete control of who you send an email to. However, I’m not in control of who Lemmy sends my voting data to (because I don’t control who a given instance is federated with), but GDPR grants me the right to know that.

if you want data deleted, you can do that, but you’ll have to send that request to every server you (or your instance on your behalf) sent it to.

According to the GDPR an “organization” has to specify exactly who processes the user’s data (i.e. every instance in a federation — past and present), and everyone that processes that data must make it easy to make data/deletion requests, to that’s hopefully baked into Lemmy from the get-go because otherwise someone is going to find themselves in the middle of a GDPR nightmare sooner rather than later. It’s not enough to say in the privacy policy that “user data spreads to federated instances” or something to that effect.

And given that usernames are connected to the votes, I’m pretty sure that it does not comply with the GDPR to just say that it “will place this interaction in the user’s outbox and immediately deliver it on the user’s behalf to all”.

Edit: Added link.