<gchristensen>
samueldr: reading about it, it seems most sensible that new USB devices be unauthorized by default, then authorized when a user logs in, but that likely requires a kernel patch :P
<samueldr>
maybe something logind can handle, are there "user at console" hooke?
<samueldr>
hooks*
<gchristensen>
I think so, but there is a race at boot
<samueldr>
hmmm, not only a race, but an issue where: how do you authorize a usb keyboard to allow login?
<gchristensen>
:) also that
<gchristensen>
maybe explicitly authorize devices which are not removable according to /sys/bus/usb/devices/N/removable
<infinisil>
gchristensen: Argh, but I'm using autoindex on
<gchristensen>
maybe you can use location pattern trickery
<infinisil>
I *need* an index file (setting none is not possible), and this config will be public, so I can't just set it to file "boohoo-nobody-will-assign-this"
<infinisil>
Well it probably is possible somehow, but requires more hackery than I'd think should be needed
<gchristensen>
you could do a little php script to list it with links, at a different location
sir_guy_carleton has joined #nixos-chat
jackdk has quit [Ping timeout: 246 seconds]
<infinisil>
Yeah..
<infinisil>
The easiest hack around this is probably to just disallow assigning to index.html (or equivalent) in my haskell code
<infinisil>
Disappointing, nginx!
<gchristensen>
jwz says every screen locker but xscreensaver is broken... but xscreensaver is so full of junk
<jasongrossman>
Really? He's tried them all?
<samueldr>
are they ideologically broken or are they provably broken?
<samueldr>
and how is "broken" defined?
<gchristensen>
you asked for it
<samueldr>
e.g. does logging-in in another fashion and killing $locker and getting control back broken, because IIRC jwz says it is
<samueldr>
infinisil: if spaces are already verboten in assignable names, could you use that fact for the "you cannot assign this" name?
<gchristensen>
nice
<samueldr>
(thus no need to have a specific name for it)
<infinisil>
samueldr: Oh, you're right. Technically they're not verboten, but it's just not possible to assign them
<samueldr>
yeah, that kind of forbidden, forbidden by being impossible :)
* samueldr
has to check
<samueldr>
I think plasma now delegates locking to sddm
<samueldr>
or if it doesn't it uses the exact same frameworks :/
<samueldr>
hm maybe not, I see a process
Synthetica has quit [Quit: Connection closed for inactivity]
<samueldr>
the argument, imho, is flawed (like I remembered) it's basically "gnome-screensaver doesn't lock, thus xscreensaver is the only one locking"
<samueldr>
(though I sound critical, I do not dislike xscreensaver)
<gchristensen>
as I read it the argument is gnome-screensaver fails unsafe
<mdash>
yeah jwz's argument is that every other thing's lock screen is not simple enough to exclude fail-unsafe bugs
<mdash>
gchristensen: what's the "full of junk" part?
<samueldr>
the xscreensaver applets I guess?
<mdash>
as I understand it that's orthogonal since they're in separate processes and are shared with gnome-screensaver etc
<gchristensen>
for sure
<samueldr>
full of junk as "full of programs I have no use for" and not "full of running things and badly written stuff"?
<gchristensen>
right
<gchristensen>
it is like a showcase of >100 cute opengl demos
lassulus_ has joined #nixos-chat
lassulus has quit [Ping timeout: 244 seconds]
lassulus_ is now known as lassulus
<jasongrossman>
I'm not so sure they're even cute.
<mdash>
all you really need is 'bsod'
endformationage has quit [Quit: WeeChat 2.3]
pie__ has joined #nixos-chat
pie___ has quit [Ping timeout: 268 seconds]
ottidmes has quit [Ping timeout: 258 seconds]
Jackneilll has quit [Ping timeout: 246 seconds]
Jackneill has quit [Ping timeout: 246 seconds]
Jackneilll has joined #nixos-chat
Jackneill has joined #nixos-chat
sir_guy_carleton has quit [Quit: WeeChat 2.2]
<elvishjerricco>
Anyone tried to get luksSuspend working for their root device?
<elvishjerricco>
I saw some stuff for doing it on Arch. Didn't know if it'd be any different on NixOS
jasongrossman has quit [Ping timeout: 246 seconds]
<sphalerite>
ugh jwz
jasongrossman has joined #nixos-chat
jasongrossman has quit [Client Quit]
iqubic has quit [Ping timeout: 268 seconds]
jasongrossman has joined #nixos-chat
jasongrossman has quit [Remote host closed the connection]
jasongrossman has joined #nixos-chat
hedning has joined #nixos-chat
Jackneill has quit [Quit: Leaving]
__monty__ has joined #nixos-chat
jasongrossman has quit [Ping timeout: 240 seconds]
jasongrossman has joined #nixos-chat
ottidmes has joined #nixos-chat
Guanin has joined #nixos-chat
jD91mZM2 has quit [Quit: WeeChat 2.3]
jD91mZM2 has joined #nixos-chat
Guanin has quit [Ping timeout: 272 seconds]
jD91mZM2 has quit [Quit: WeeChat 2.3]
Guanin has joined #nixos-chat
Synthetica has joined #nixos-chat
jD91mZM2 has joined #nixos-chat
<jD91mZM2>
Wow, Nix just saved my scaleway ubuntu install. Was trying to do a very quick and dirty workaround by symlinking /usr/bin/python to something, but accidentally overwrite python2.7. Then dpkg wouldn't work. So I got nix's python, symlinked, and reinstalled python with apt
<jD91mZM2>
s/overwrite/overwrote
<jD91mZM2>
And the crazy thing is that the thing I wanted to try and work around randomly started to work after that episode.
<mdash>
jD91mZM2: sounds like it's time to switch your scaleway to nixos ;-)
<jD91mZM2>
mdash: Yeah that'd be nice, but there's no official NixOS image and I'm very lazy
endformationage has joined #nixos-chat
<sphalerite>
jD91mZM2: ahahaha
<etu>
jD91mZM2: The last part to recover from that must have felt rewarding :-)
<simpson>
To its credit, it *does* sometimes sleep().
<jD91mZM2>
It's it prett optimal, if pam_authenticate asks for the password
<jD91mZM2>
Then pam_authenticate surely uses a nice blocking read, which is better than a sleep, no?
<jD91mZM2>
Wow I am not typing well. s/It's it prett/It is pretty/
<elvishjerricco>
gchristensen: Yea, one day I want suspend to trigger both physlock and luksSuspend. Lock the VT to a script asking for the LUKS passphrase and unlock once the disk is available
<gchristensen>
neat
<clever>
gchristensen: oh, wow, the plex app can even "cast" to another device like netflix
<clever>
gchristensen: so i can select the nas, from the website, and remote-control it
<gchristensen>
oh cool
<clever>
only problem that remains, is dpms
<clever>
xorg shut off the hdmi output half way thru an episode, and the tv tried to turn itself off
<clever>
gchristensen: running strings on the main binary, reveals mpv symbols!?
<clever>
mdash: ive mainly been getting self-signed warnings, but i'm also messing around with forwarding the http port via ngingx with lets encrypt, lol
<mdash>
clever: heheh
<mdash>
i didn't bother with https until i made it accessible off my network
<clever>
mdash: i think even if you dont forward the port, its still accessible from outside
<clever>
it will just tunnel backwards down a connection the service opened
<clever>
but that turn leeches bandwidth from plex servers
<clever>
it sends a set with version&path when you connect
<mdash>
yeah i'm getting these things mixed up in my head because I didn't even sign up for an account on plex.tv until I paid for plex pass
<clever>
mdash: when i first fired my server up, i had to access it via 127.0.0.1 (security reasons) and it just gave non-helpfull errors when i used the LAN ip
<mdash>
yeah
<clever>
and it basically refused to do anything, until i signed up for a plex account, and then tied the service to my acct
<mdash>
huh, you can definitely configure it for lan only use without an account though
<clever>
opening the http port on the local plex instance is almost useless, it just gives an identical site to app.plex.tv
<clever>
in either case, it then asks the plex servers what the LAN&public IP of all services are, and tries to contact them
<clever>
they have a weird subdomain, that resolves every valid v4 ip, like 1-2-3-4.example.com
<clever>
so you can trick the browser into thinking it falls under same-origin policy
<mdash>
yeah the blog post i just linked describes that
<clever>
and then app.plex.tv can freely access 192.168.2.15
<clever>
ive reversed enginered parts of it using the chrome network console, when it had connection trouble
<mdash>
the thing that persuaded me to sign up for a subscription was camera upload, i'd been using syncthing before but this has been way less hassle