You're somewhat right in the sense that the point of disk encryption is not to protect from remote attackers. However, physical access is a bigger problem in some cases (mostly laptops). I don't do it on my desktop because I neither want to reinstall nor do I think someone who randomly breaks in is going to put in the effort to lug it away to their vehicle.
data1701d
Clevis pretty much does TPM encryption and is in most distros' repos. I use it on my Thinkpad. It would be nice if it had a GUI to set it up; more distros should have this as a default option.
You do have to have an unencrypted boot partition, but the issues with this can at least in be mitigated with PCR registers, which I need to set up.
It’s a smidge more difficult on Debian if you want to use a non-ext4 filesystem - granted for most people, ext4’s probably still fine. I use it on my desktop, which doesn’t have encryption.
I’m using LVM. The BIOS solution would be a bad idea because it would be more difficult to access the drive on other systems if you had to; LVM allows you to enter your password on other systems to decrypt.
Do your servers have TPM? Clevis might be the way to go; I use it on my Thinkpad and it makes my life easy. If the servers don’t have TPM, Clevis also supports this weird thing called Tang, which from what I can tell basically assures that the servers can only be automatically decrypted on your local network. If Clevis fails, you can have it fall back to letting you enter the LVM password.
Sent! Although I just realized it’s not like only one person has to send an e-mail; multiple would make it clearer that these images are important to some people.
Well, it was worth a shot.
I don't do it for my desktop because 1) I highly doubt my desktop would get stolen. 2) I installed Linux before I was aware of encryption, and don't have any desire to do a reinstall on my desktop at this time.
For my laptop, yes, I do (with exception of the boot partition), since it would be trivial to steal and this is a more recent install. I use clevis to auto-unlock the drive by getting keys from the TPM. I need to better protect myself against evil maids, though - luckily according to the Arch Wiki Clevis supports PCR registers.
Has someone sent an e-mail about the issue? If not, I can message debian-cd@lists.debian.org, which seems like the person you should contact.
This is very annoying to me; I’m a big fan of these images and they’re my goto for testing Debian on new hardware or doing full disk dumps/images.
I don’t even play STO, but I felt the urge to say: Wow, Voyager with an article in front just feels so wrong for some reason, which is weird because that’s not true of other ships; we here them say “the” Enterprise, “the” Titan, “the” Defiant, “the” Cerritos, etcetera.
However, Voyager is just Voyager and it sounds wrong any other way for some reason.
I wouldn’t necessarily say that - Debian and FreeBSD releases have roughly the same support lifespan, meaning if installed on release day, you’d get a few (~5 years) years of support without major upgrades.
I’d say both systems have a high chance of success at upgrading to the immediate next version, so that becomes maybe 7 or 8 years when adding the years of support left on the now older immediate next version.
For a second immediate next upgrade, you might be right that a BSD has a better chance of surviving.
I wouldn’t know about Open SD, though, as they operate on point releases and I don’t know to what extent they prevent breaking changes.
JavaScript be like that sometimes…