The other person said heat dissipator. The usual phrasing is heatsink.

Your nvme is gonna have a four digit code like 2280 following the m2 designation. The last two digits indicate the length. If you cannot see the code or look up the product description then you can measure it. If you can’t measure it then you can instead look at the supported nvme form factor documentation for your case and ensure it meets the 2280 constraints. 2280 is the biggest m2 nvme ssd size so if your case supports it you’ll be fine.

Make sure it’ll work by looking first, but five bucks will get you a passive heatsink that will probably keep you in good stead over five minute transfers and twenty bucks will get you one with a little fan on it that will make sure you’re golden even during extended transfers.

Post the case model and I’ll look up what will fit in it with links and also see if there’s a good spot to sneak a fan in.

E: you asked the other person how a heatsink keeps temperatures down. It’s real simple: there’s a chip that gets hot. It gets hot because when It does something heat builds up and when it does a lot of stuff a lot of heat builds up. Heat goes away through several ways but here by radiating into the material around it, the connector, pcb and air. If the air is flowing past the hot chip then the difference in heat between the chip package surface and the cool incoming air is greater than that between the stagnant air that’s being heated up by the chip and more heat from the chip can be dissipated into that cool incoming air. Which is why a fan helps.

Air is a gas and gasses are generally not as good at taking on energy. Which is what heat is, energy. They’re bad at it because the particles of a gas are farther apart than those of a liquid or solid. If you dunked your hot ssd in a liquid like oil or encased it in a solid like aluminum you’d see much better temperatures because the hot chip could transfer its energy in the form of heat to the oil or aluminum much more efficiently because the particles of aluminum wouldn’t have to be at as high of an energized state to impart their energy onto their neighbors as those in the air have to.

A heatsink is slapping a big chunk of solid material (that’s good at transferring heat because it’s a metal, metals are good at transferring heat) on the hot chip to get more heat off the chip faster. They have little fins and crap to make their own transfer of heat to the air more efficient.

TLDR: if you glue a half inch nut to your chip the chip gotta heat that nut up.

@inlandempire@jlai.lu , I said I’d write about bitwarden and here I am. Trollaccount69: promises made, promises kept.

Bitwarden is good. People saying it’s bad are either mistaken from not reading news reports closely enough, completely unwilling to accept a company as opposed to a small open source project or don’t consider cloud services worthwhile when they could be self hosted.

I’ll start with the last one first.

I self host a lot of stuff. Many people have a little computer in the closet, some have mini racks, a few have full size frac racks. I have two full size racks in different physical locations separated by miles. The point of saying that is not to brag or flaunt undiagnosed mental illness but to make it 100% clear that I am not opposed to self hosting by any measure.

A few years ago I was in a natural disaster. It wasn’t predictable or common and while some of the conditions that precipitated it had a generous parry window the effects were outsized and still linger to this day.

My local server was rendered inoperable and my offsite was damaged beyond recovery. Conditions in the area prevented consistent access to the internet so my cloud backup was not an option. Afterwards I did not have power or Internet at either my home or offsite location for two weeks. Even in the case that I did, my focus was on keeping my family warm, fed and housed.

The experience immediately afterwards had a lot of what might get called second factors or one time tokens or just shit you gotta write down and every group involved wanted to mediate the process through their website or some other computer system not least of which is the us federal governments now monolothic login.gov (what a fucking name).

Maybe you see where I’m going with this.

If it weren’t for bitwardens ability to access secrets securely through a web browser on an untrusted computer I would have had a much different experience toting handwritten copies of important logins, passwords, tokens, codes and even just notes to remember in sweat soaked waterlogged pockets.

Bitwarden isn’t the only cloud password thingy that has that functionality but it’s the one with the longest history of dudes popping up to “well actually” out the way their website access works when someone says “browser? That’s not secure!”. So I’m not gonna waste your time with that. It is secure and you can do your own research and come to that conclusion yourself.

The point of writing all that is you probably would be what a disgusting race of people with bad teeth from an overcast island in the North Atlantic would describe as “proper fucked” in their nasty, brutish imitation of the English language if you couldn’t get to your selfhosted passwords. Imagine if that coincided with a bonafide cortisol experience.

Cloud services can be described as a lot of things. A safety net against local disruptions is part of that.

Alright working backwards from that mess, it’s fine to be skeptical of companies but they do represent stores of expertise and often act as the benevolent supporters of open source projects either through a direct relationship like Bitwarden, keeping the maintainers of an open source project employed so they can continue working on the project (often as part of their job responsibilities) like Bitwarden or even just using the profits to prop up the free side uh, like Bitwarden.

Off the dome, and I will not be looking this shit up, the first thing comes from people seeing some small indicator and freaking the fuck out. Recently it’s a change to an acronym that describes the companies values. Literally come on. Red hat is basically the IG Farben of open source but no one is fleeing the Linux kernel because of their involvement. Another recent freak out came from a new ceo who took on venture capital. The company intends to broaden its user base and provide its service as a trusted third party in an increasingly fractured world, that takes capital and the part no one seems to be willing to hand to ceos, leadership. There have not been tangible changes to bitwardens free service as a result of these events.

My favorite Bitwarden freak out is the tos data collection one. Someone posted the terms of service and highlighted that user data could be collected and used. Now that’s something! Wait, it was the terms of service of the website, not the service (an important legal shield in some jurisdictions) and was just boilerplate. There was no evidence ever provided that Bitwarden collected user data in any way other than that which is part of rendering a web page (how big is the viewport, what protocols do you support etc.).

If you take anything away from this, hell, if you even read down to the bottom and see this sentence: don’t discount cloud password vaults, you may end up relying on them during a trying time.

Mullvad for phones and personal computers because its app gets updated often and is generally very good on phones especially, air for seedbox because it has port forwarding, something else to use in automated scraping.

I ended up with that many active at one time because I wanted to try some of the stuff that gets recommended all the time and between a full crontab of content grabbing scripts and a couple of hermes instances I was running up against some of the guardrails of a normal user account too often for comfort but some of these VPNs fucking suck. I’m getting my money out of em but damn.

E: for anyone reading this the part I am not talking about and will not talk about because of the direction enforcement is going are residential proxy networks. If you also do content scraping or use llm harnesses to acccess data on the web, rpns are better than VPNs. Get in now before they become target number 1 for all government cybercrime dildos.

@inlandempire@jlai.lu , I think you may be inadvertently making a mistake excluding mullvad and bitwarden.

Mullvad is an excellent vpn service that provides unparalleled security, privacy and anonymity. If security, anonymity or privacy could have an effect on your safety then consider weighing that safety against your concerns about its founders political donations.

I currently have active subscriptions to mullvad, windscribe, proton, ivpn and airvpn. If I had to go down to one it would be mullvad, if I had to go down to two I’d add air for piracy.

Windscribe is the one I won’t be renewing. It’s complex, confusing, frankly expensive for what you get, has an awful app and config file generator, constantly seems to radiate incompetence and I think their style in general is cringey.

Proton is what you’re leaving and to be honest I’m probably gonna replace it with Nord. It’s “fine” but I can’t effectively automate its use on headless systems so it’s gotta go.

Ivpn is pretty good with a couple of caveats: it’s still possible to screw up and make an account with pii that the company can be forced to divulge, there are many examples of this vector causing people problems with other services. The company has not faced the same scrutiny as mullvad, however that’s a very high bar. What truly is a dealbreaker is how few servers & locations ivpn has and how not great the speeds are.

Airvpn is a piracy service. Theres no two ways about it and it’s great for that. I wouldnt bet my life on it but it sure does allow port forwarding at a decent price!

Mullvad in comparison is simple, reasonably priced, has plenty of servers and locations with good speed, has the best vpn apps I’ve seen, you literally can’t make an account that’s not anonymous and has gassed the most intense possible scrutiny I know of for a vpn.

If your life or freedom depends on it, you should pick mullvad.

Many companies with some tie to politics I disagree with produce extremely high quality products and services that I rely on. It is particularly hard to avoid in the gun market but is certainly present in security as well.

Of course if the vpn is for getting past the company firewall so you can look at pornography on company WiFi or something, feel free to disregard this.

I brought up bitwarden but I’m tired of tippa tapping out a post so just imagine an equally long description of how it’s good and the problems always seem to turn out to be overblown.

Seeing slopsayers and rust aficionados fight in the comments is like coming across a baron and revenant going at it in melee.

Hell yeah.

I think again, that you are perhaps a bit too idealistic here.

The secret fisa courts run by handpicked judges mediating pushback against demands that someone or some company give up any data they have only apply to Americans.

So the fake made up process to keep the us government from performing bulk data collection on citizens only applies to citizens. Noncitizens have no similar protection under law, fake or otherwise.

Not to break out the rasp and put too fine a point on it: noncitizens have no protection under law, fake or otherwise.

We already know that us telecommunications infrastructure has hardware (not software, baseband level) backdoors built into it by design in order to facilitate spying. I can say this for a fact because it was a low key huge deal that the lawful intercept backdoor was compromised a year or two ago.

Anti communists like to scream about huawei telecom equipment being compromised by the evil ccp, but rarely make the factual statement that it is all designed with built in backdoors to meet the requirements of the nations who order it. All those nations also use telecom equipment backdoors just as much as American intelligence agencies do. When nations rip out Chinese made stuff and replace it with something from what passes for an ally at the moment they aren’t giving up their backdoors.

Just off the top of my head, and this post likely has some awkward phrasing I owe you an apology for because it is all off the dome, the English had to do a heavily redacted investigation into their own complicity with telecom spying that was done on British soil by Americans as part of the prism program with no us oversight to protect British citizens.

All that is to say: even if you live in a nation outside the five, nine, fifteen, ct, club du berne, special committee or any other intelligence sharing organization and your data never flows into American jurisdiction and you run some ideal operating system and service compliment that has no surface for interface with the authorities, you are not safe from the bulk collection of encrypted data under prism.

Which is what prism is. Bulk collection of encrypted data for processing at a later date.

The two possible ways to get safe about it are to be in and be accessing systems in the Russian federation or the prc. Neither is a good shield because China isn’t trying super hard to keep spooks out and the Russians are currently in the Treehouse Made from Old Pallets stage of their new Internet.

You cannot escape prism because it does not require access to your device and is not constrained by borders. I encourage you to investigate which Android systems can be hardened to the extent of ios. I have concluded after years of observation that it is graphene and only graphene.

Okay with that mega downer out of the way:

When I brought up the phenomenal amount of long running vulnerabilities in the kernel (which I hate other people pointing to because it doesn’t reflect the extent to which ai tooling has allowed much more extensive and expansive testing but coincides with a change in the maintainers policy around the cve system!) and the lz fiasco, I was hoping it would be clear that vulnerabilities and bugs often are backdoors and interference, we have recent examples of that as well as a historical record of explicit attempts to insert bugs and vulnerabilities as literal backdoors and interference and there is a frightening pattern present even in my own favorite distribution Debian that alludes to that process.

I said those things to illustrate that to the extent there is a community reading the source it’s either merely equivalent to the private software world, infiltrated by operatives or populated with useful idiots like the eos knucklehead who said graphenes security is for pedophiles.

That situation combined with the fact that there is no pretense of legal protection for a person running open source means that it’s a pretty hard sell for regular people to rely on code reading instead of recognizing that the control causes a change to happen.

Again my point is that you are making a wild, indefensible leap of reasoning and judgement when you say that the only way to tell if a control is doing something is to read the code.

I also maintain that you are mistaken about antivirus. Even if the third party program relies eitirely on the hooks within the defender subsystem and only provides recognizable warnings that don’t slide off the users frontal lobe like butter across a skillet that is safety.

You even admitted that antivirus could be “implementing real safeguards”.

There are terrible antivirus programs and some that are pretty good. The presence of data collection in a eula doesn’t mean it’s a bad program. People choose to use Facebook knowing that it’s a nightmare panopticon because they want what it’s providing.

I don’t think you’re arguing in bad faith or being oppositional, what it sounds like to me is that you believe in the ability to escape bulk surveillance of encrypted transmissions and that it’s possible for all users to aspire to understand what’s going on at all (or enough to make informed decisions!) times and therefore a method of securing oneself that doesn’t provide 100% protection from that spying or put all those controls in front of the user with as much granularity as possible doesn’t count.

To bring it all the way back to the start though, ios hardening is real.

Yes! I been in the Broadcom world so freshtomato calls it aqm.

Hang on, if a social service doesn’t get paid for how does it exist?

Money.

Set up aqm or whatever it’s called on openwrt.

It makes a huge difference.

I don’t think you’re arguing in bad faith or being oppositional at all and I think it’s good you care about this stuff. I care about it too.

TBH I kinda get the impression you have a bit more of an idealist take on things than I do.

PRISM is not something companies or individuals choose to comply with. The NSA demands data under color of law (section 702!) with disputes mediated in secret courts run by judges handpicked for those roles.

Avoiding the possibility of data collection through the cloud service vector doesn’t protect the user because every telecommunications company I am aware of is known to have complied with fisa demands, most germane to our topic: Verizon very famously. So even if a user isn’t using any cloud service that handles their data, their data still gets handled by telecom companies doing the exact same bulk collection of encrypted transmissions for processing at a later date.

No American can escape PRISM without completely leaving all telecommunications behind no matter the manufacturer of their computer or the programmer of its operating system and software.

I use Linux everyday and have as a main os for a long time.

The Linux kernel is not safe. In the past year there have been high cvss bugs and vulnerabilities discovered which were present for decades (yes, with an “s”). There are first party accounts of direct infiltration attempts and evidence of covert ones with varying degrees of success from nothing to long con winners like lz.

All operating systems have bugs and vulnerabilities which impact their security and safety.

From a laypersons perspective even assuming they are familiar with the concept of open source, how can they be expected to put their trust in a community that can’t even keep itself safe?

Remember that interactions between a person and some company are mediated by law. If Google or Apple screws them over there’s at least the pretense of some recompense. If your average user gets hit by a deserialization error in Linux they can’t come back on kernel.org, they’re just flapping in the breeze!

I do not use proprietary antivirus on windows and generally point people away from it except for some unique situations.

You are mistaken about proprietary antivirus on windows. While recently there has been a big effort to kick them out of ring0, they do actually perform a task with measurable degrees of completeness using real techniques for securing code execution and user data. You might think as I do for my own purposes that they’re not doing you any good but no matter how much we both might hate norton, it is doing something.

Specifically for many users third party antivirus is a trusted secure process they can rely on when they have no baseline of trust for the operating system.

The above is not gibberish. Many people fundamentally do not trust windows and cannot make a clear determination how to proceed when some dialogue box pops up (think uac of olde). You and I hate the bright orange, yellow and red windows of third party antivirus but they’re using those colors to make them clearly stand out from the os’ warnings.

We may see an intermediary between us and links in our emails as a waste of time but for a lot of people the process of clicking only the links with the big green checkmark next to them (indicating the destination has been vetted by the third party antivirus and isn’t malicious) is one that keeps them safe.

Could that be accomplished with retraining? Yes but no one is doing it and generally retraining efforts in organizations don’t actually do a good job and leave users feeling confident enough.

Ios hardening is effective and is not a half measure unless evaluated against a bar for security that excludes using public telecommunications networks.

Those are morrowind menus.

Pia is owned by kape technologies, a company founded by former Israeli intelligence officers that buys up VPNs.

I tend to recommend airvpn for cheap port forwarding but bear in mind you may recognize the need for a separate normal service because of airs unique position in the marketplace.

Anyone handling (incredibly insecure! This cannot be understated!) push notifications can be secretly compelled by force of law to hand them over. That’s not unique to Apple or ios.

To bring that all the way back to what I said, that the claim “ios hardening is a myth” is not true: you can turn off push notifications in ios. Because of the nature of the technology there are other controls around it that are not part of the receiving devices operating system and need to be handled separately.

If you haven’t already, disable push notifications.

I think there’s a fundamental lack of understanding amongst people in general about the purpose of our networks. The Internet, like cable television and broadcast tv and radio before it, is a propaganda and surveillance technology overlaid on military command and control.

I want to keep it 100% with you: I did not make the point that it works. I made the point that your claim (and apologies, I’m paraphrasing here) “there is no way to believe it works unless you personally can see the code” is absurd and I will stand by that.

The first link you sent seems to be about google. You were talking about iPhones though. Are you trying to make a broader point about more than just iOS?

The mysk case referenced in your next link (nov. 2022 analysis of a mid 2021 iOS version) actually had an interesting update this year: all the wiretapping type charges got thrown out but the deceptive practices claims were allowed to proceed. It’s likely the plaintiffs will win that one since the company has significantly changed the wording around the settings controls in question in the intervening five and a half years of development.

Despite how this might seem, I’m not trying to fight you. I want to bring this back to how you initially said “ios hardening is a myth”. I really think you have a cohesive approach and argument to make but you’re not tying it all together because you think that left on their own claims like the above and the one about not being able to trust settings unless you can see the source are self evident but they’re not.

as a kind of backwater waste of time discussion spur I think that specifically the source reading line of reasoning pushes people away from security and privacy because it excludes a person who can’t analyze the source code because they are unable to effectively read it.

Normal person who can’t read code even if it were in front of them in plaintext: “well fuck me I guess”

Now it’s extremely clear to me from your replies that you feel you’re in some kind of fight or something. I don’t want that. We don’t have to keep talking if this is stressing you out and it’s not a win or a loss.

I didn’t make the claim that iPhone hardening is a myth, you did. I am open to you providing something to back it up, as I have not seen anything that would.

You said you can read news stories about the toggles not doing anything. May I see the news stories that show the options in iOS don’t do anything?

I am open to hearing evidence that iphone hardening is a myth.

That’s an absurd statement. I do not need to open the power switch on my table saw to understand and recognize that when I turn it off the blade stops spinning.

Even if I were unable to directly view the blade I could see that stock passed across it is not cut.

Even if I didn’t have a table saw I could read the news stories about law enforcement complaints that turning the power button to the off position stops the saw from spinning and craftsman is unwilling to offer a bypass to the switch citing safety concerns and form a cohesive rational understanding that the control does what it says on the tin.

Because of people being driven away from proton I have been suggesting it more than usual, but the simplest and most correct answer if you value your own safety is mullvad.

The service speaks for itself and there is nothing that compares. Several people have replied to me when I suggest mullvad saying “what about one of the founders donations to a Swedish far right political party?” so rather than extol the many virtues of literally the best vpn service out there I will spend time explaining the thing they’re talking about.

There is a party in Sweden called orebro. It is a small political party based in the city of orebro and has varied platforms. One is a policy called remigration which broadly refers to deporting non ethnically Swedish people from the country. I am tiptoeing around explicitly calling this a far right policy because frankly Europe as a whole is trending against migration so it may reflect window shifting more than goose stepping and I am a communist and no communist nation in history has ever operated on open borders however the word remigration as a description of their platform is, let’s just say an ethnically charged dogwhistle.

The party’s other platforms are what could be called left or even schizophrenic and someone described it as “Marxist revisionist” and that’s probably true.

One of the two founders of mullvad, Daniel berntsson, donated half a million kronor to orebro.

Do you consider that policy right wing? Is it bad enough to outweigh the other platforms of the orebro party? What portion of the half million kronor donation would you consider to be going to that platform as opposed to the party’s many other platforms? What portion of that donation comes from berntssons stake in mullvad? What portion of your five dollars a month supported the party or if you take a more nuanced view, that particular policy? Is it even possible to ethically consume services under capitalism? When you pass on will the portion of this purchase that can be traced to that policy by Anubis’ accounting staff make your soul heavier than a feather?

Only you can answer those questions. I would recommend you instead answer the following question: is that enough to cause you to accept a worse quality and more unsafe service?

If it is, a similar but not equivalent service is ivpn, but as a current user of their service it is more complex, easier to screw up and has not been tested to the extent of mullvad.