If you want GrapheneOS without funding Google, why not get a secondhand Pixel?

Thanks, I’ll try that.

The issue has happening on an increasing number of websites, though: Ecosia, ScienceDirect, TrainSplit (which thankfully has a fallback to hCaptcha), Indeed, and more.

Thanks. What’s your source for that list? I think you’re right that those measurements are factors in the final “bot score”, but I expect there are many other measurements also factored in.

If you look at my OP, though, you’ll see my browser passed the checks but was still blocked, which Cloudflare said shouldn’t happen.

It pops up on which page?

I can’t see it on either of the pages mentioned in my OP:

• https://developers.cloudflare.com/cloudflare-challenges/troubleshooting/challenge-solve-issues/
• https://browser-compat.turnstile.workers.dev/

I’m getting this issue in Chromium.

Like you, I’ve encountered it especially often in the last 3 weeks or so. Thanks for confirming it’s not just me!

Do you have a link to that feedback form, by any chance?

I eventually managed to find contact details for the webmaster for the site on which I most recently encountered this. Hopefully they’ll fix it in their Cloudflare configuration.

Failing that, I’ll try User-Agent spoofing. Failing that, another ISP, or VPN.

Cloudflare is already wrongly flagging this Linux box as a bot when it connects from an ordinary domestic ISP.

Surely it would be more likely to flag it if it was connecting from a VPN exit node.

No VPN present in this particular case.

This reminds me I need to have another look at Ledger, Beancount, et al. More info at https://plaintextaccounting.org/

Nice. It would be good to put the distro name beneath each logo, for people who don’t recognise the logos.

Your mum is a rounding error.

Relevant David Revoy cartoon: https://thebrainbin.org/m/comicstrips@lemmy.world/t/1848750/authenticity-problem

This is by David Revoy, who has started getting wrongly accused of using AI for his art

Plenty of shallow people in the world, sadly, enjoy vicariously living even shallower lives than their own.

IPMI/BMC have been known problems since 2015, if not before.

Matthew Garrett: IPMI - because ACPI and UEFI weren’t terrifying enough

I feel the same way, but can you explain how a VPN would help achieve that in the face of Google’s proposed developer verification scheme?

How would that help you?

The article says, “unverified apps will only be easily installable in the sanctioned countries where verification doesn’t exist.”

So even if you used a VPN to trick Google into thinking you live in a sanctioned country, you wouldn’t be able to distribute apps to those countries without breaking sanctions.

Progress report 1

• I’m ruling out HMAC-SHA1, because:
  • Plain vanilla HMAC-SHA1 uses a shared secret. I don’t want the PC/server to have a copy of the credential. May also be susceptible to MITM/relay attacks.
  • Rolling-code HMAC-SHA1 only partially solves those problems.
  • Encrypted rolling code HMAC-SHA1 solves those problems, but I haven’t found a reliable source for using it with LUKS.
• If using systemd, pick FIDO2:
  • Avoids flaws of HMAC-SHA1.
  • Native support in systemd, so “future-proof”.
  • Wider support than OpenPGP. More HST vendors to choose from, including cheaper options than NitroKey or Yubikey: useful if each sysadmin (or colleague, or relative) needs an HST.
  • Compatible with QubesOS.
• Otherwise, OpenPGP:
  • Like FIDO2, solves HMAC-SHA1 flaws.
  • However:
    • smartcard-key-luks seems unmaintained on GitHub and on GitLab.
    • LUKS with OpenPGP isn’t well-documented for non-Debian-based distros.
• TBD: Clevis/Tang:
  • Remote/network-based unlocking.

Thank you for this! That thread is helpful in itself, and also links to other relevant resources - including by Lennart Poettering (controversial guy, but the canonical source on systemd).

This coverage has a better headline: Trump blames Minnesota governor for cyberattacks against the state. Cites no evidence.

Funding restrictions and denialism, plus starting a war against a cyberattack-capable nation, made infrastructure attacks inevitable.

Security researchers have been publicly raising the alarm about SCADA vulnerabilities for 20+ years.