1,137 karma · joined June 5, 2016
One is probably fine but a hold full of them and people's iPhones emitting on UWB also?
By contrast Bluetooth, WiFi etc use the ISM radio bands, which can simply be avoided by any transmission the plane itself needs to do.
Switzerland: £327 a month with an annual commitment, unlimited use of the swiss rail network, local buses/metros/trams/boats etc, with the exception of mountain tourism railways.
Of course, this looks like wasted space when you have a landscape-oriented monitor... I personally very rarely maximize my browser so that I read in more of a portrait-style mode, regardless of the orientation of my display.
Buy blank cards, write your applet, test in an emulator if you want, push to card, test for real with your software that talks to the card, profit. Be aware that if your goal is to write custom cryptography implementations in Java on the Javacard, these will be prohibitively slow. No need to take my word for it, Niels Duif did exactly this: https://research.tue.nl/en/studentTheses/smart-card-implemen...
> Java Card proves to be a worthless platform for high-speed cryptography. Despite the > speedups, generating a signature takes more than 28 minutes for a private key of 254 > bits.
How is crypto done then? JavaCard provides APIs that do it, but these call implementations that either use coprocessors, or contain optimised implementations in the mask ROM. You can't program a mask ROM without doing a production run of smartcards in the hundreds of thousands. Small scale, this isn't possible.
HSM vendors will often sell SDKs for custom code, which you can add to certain models. The barrier to entry simply being that you need to buy an HSM, which isn't cheap. It can be done, however, and on the plus side in my experience of Thales HSMs this means actual C code, meaning performant implementation is possible.
Microsoft provided the operating system that allowed the commoditised IBM PC, and later laptops, to launch.
Without this, no Google, no Amazon and no FB.
Put another way, if every workstation still cost $5k and up to own, far fewer people would have bothered in the first place.
No complaints about your views on Microsoft software ;) I'd argue I'm not sure Google or Amazon are "making the world a better place" when you get into the details, but this is purely about the wider impacts of their strategy.
I think most mail clients can do this, but thunderbird is what I use. On Windows, preferences may be under Tools instead. No idea on Mac.
I don't remember if I got my first phone before or after this - I think maybe after, but I am honestly very unsure. I can tell you it was a 2nd hand 3310. Not everyone in school had one, because not everyone could afford it. Some people's parents didn't have them; most people's grandparents didn't. Landlines reigned supreme, and MSN whenever that arrived (still had a few friends without internet then, I was on dialup, a few people got broadband the year after).
I don't remember anyone using WAP really ever^. I don't really remember when mobile internet actually took off seriously but I remember a friend posting to facebook and getting updates via SMS in 2008/2009. Cool that you did use WAP, but you were likely a minority and that's nothing compared to the ubiquity of LTE connections of today.
^One of my friend's Dads worked for Vodafone at the time. Their HQ was commutable from where we lived. I discussed C++ with him a lot. I still don't remember anyone using WAP and they had staff discount, so your 12p/10p SMS was 2p for them. I only knew what WAP was because I read about it in PC Pro.
In this case dig or delv would be fine. You can also use https://mxtoolbox.com/SuperTool.aspx and pick "MX lookup" to find the MX records. It will also resolve the IPs, both IPv4 and IPv6 (A and AAAA) for you for the returned records.
Their supertool also breaks down SPF records, for example, into their meaning and tells you if they're valid or not. I think other links were posted that do similar things but I haven't had a chance to try them yet.
I've mentioned reverse pointers in various cases, delv can do those lookups too. Here is how you do it: first you find the IP of say mail-ed1-x529.google.com, which happens to be a mailserver of Google that was the last step before my mail server when sending myself a message from gmail. For a bit of a change, this is an IPv6 only server, and it has IP 2a00:1450:4864:20::529. So let's look it up with -x:
delv -x 2a00:1450:4864:20::529
; unsigned answer
9.2.5.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.4.6.8.4.0.5.4.1.0.0.a.2.ip6.arpa. 43200 IN PTR mail-ed1-x529.google.com.
One of, but my no means the only, reasons you can't send email from a home connection is because you announce yourself as smtp.zahllos.example but your reverse dns resolves to something like <somegeneratedhostname>.dynamic.residential.isp.com. You can find out yours: type "what is my ip" into google, copy-paste that and do a delv -x on it and see what your "hostname" is according to the internet.
In embedded development you can forget the overhead due to binary formats such as ELF (while the toolchain might output these as an intermediate, what is flashed is just the relevant sections), but if you are doing things like loop unrolling all over the place, you're going to get less functionality for static program space.
This is why ARM and PowerPC have "embedded" variants of their ISAs. What this means in practice is a compressed form of their instruction representation. Why? If you have compressed instructions, you can fit more of them in program flash. So both Thumb and VLE are variable length encodings. Thumb, for example, can use 16 bits for many instructions, i.e. two bytes, whereas ARM by default would simply take four bytes for all instructions. (For the avoidance of confusion, they still "address" 32-bits of memory and are thus still 32-bit microcontrollers). PowerPC's VLE is similar.
The driver here is cost. You could put in more program memory (the address space has plenty of room) but that costs more money, and when you don't need it, why do it?
Now when a sending server asks "where should I deliver skywall.example email" by querying MX skywall.example it gets google's servers and starts an smtp conversation with them, saying "I'd like to deliver a message for skywall@skywall.example". At this point, Google knows it can accept that, so they say yes, and then continue doing whatever they do to check for spam beyond that, including queries for spf and friends.
The reason the parent suggests this is that if at any point you decide to move off Google, you can pay someone else, e.g. fastmail, for their services, and modify your MX record. 24-48 hours later, DNS around the world catches up and everyone will get fastmail as a response when they ask for your MX record. Any new email goes there instead of Google, and thus you aren't 'tied' to the provider: you just have to move all your old email over. Whereas Google cannot let you move a user@gmail.com address, because they can only change the MX records for the whole of gmail.
DNS is the source of truth here. Whatever your MX records are is where other servers will try to contact to send email. The MX record is typically just another DNS address that will be queried for AAAA/A (i.e. what is the IP), and that doesn't need to be on the same domain at all.
Here's an example of what it looks like:
delv MX ycombinator.com @9.9.9.9
; unsigned answer
ycombinator.com. 295 IN MX 20 alt2.aspmx.l.google.com.
ycombinator.com. 295 IN MX 10 aspmx.l.google.com.
ycombinator.com. 295 IN MX 20 alt1.aspmx.l.google.com.
ycombinator.com. 295 IN MX 30 aspmx4.googlemail.com.
delv NS ycombinator.com @9.9.9.9
ycombinator.com. 159148 IN NS ns-225.awsdns-28.com.
ycombinator.com. 159148 IN NS ns-1914.awsdns-47.co.uk.
ycombinator.com. 159148 IN NS ns-1411.awsdns-48.org.
ycombinator.com. 159148 IN NS ns-556.awsdns-05.net.
I'll cover off the SMTP outgoing as well while I'm at it. You _can_ also not run your own outgoing smtp server but use someone else's. The key here is that if you use SPF and DKIM, you should put their IPs into SPF and their keys into DKIM, as that is what the receiving server will use. So smtp.zahllos.example could be replaced by sendgrid, provided in my DNS I say so. This may work better, as sendgrid may have a better reputation than the server I chose.
Let's imagine I'm sending from user@zahllos.example to user@skywall.example. I'm doing it from say Thunderbird or Outlook, and you're using the same.
I need to send, and to do this I typically use an SMTP server. This is something configured, probably on zahllos.example, maybe with the domain smtp.zahllos.example. My mail client contacts this and 'logs in' with my details, then transmits the email message I want to send to this server. The server says 'right fine' and closes the connection.
At this point, the message is in a mail queue ready to go. The SMTP server then does a DNS request for the MX record of skywall.example. Let's say this is 'mail.skywall.example'. My server, smtp.zahllos.example, then connects to `mail.skywall.example', also speaking SMTP, and says "hey, I have this message to deliver".
It is at this point that mail.skywall.example can decide to do some things. It might check SPF, so it will query the SPF record of zahllos.example to find the list of servers that may send email for that domain. In this example, let's assume smtp.zahllos.example is in the list. Great.
It may then also check the mail headers for a signature, called a dkim signature. My server signed the message before sending; mail.skywall.example can query <uid>._domainkey.zahllos.example and find a public key (or not) and check that this signature matches (or not). Again, let's assume it matches.
It might also check something like TXT _dmarc.zahllos.example to see what my DMARC policies are. If I have something like v=DMARC1;p=reject;sp=reject;pct=100;ri=86400;fo=1;aspf=s;adkim=s;rua=mailto:postmaster@zahllos.example;ruf=mailto:postmaster@zahllos.example;" this tells you I'd like you to outright reject anything not matching policy, that I expect everything to match SPF and have DNS signatures, and you can send reports if you support that to postmaster@zahllos.example. Your server can then enforce these checks as it likes.
One of the first things that will happen is that my server will announce itself via an EHLO statement. An obvious check to do is to check that the sending IP actually matches smtp.zahllos.example. by querying 'reverse ptr' records.
Your receiving server will also likely hand the message over to various spam-checking tools for analysis, such as against DNS blocklists and so on. Larger providers likely have much more sophisticated infrastructure here. Ultimately, you're going to do one of a few things: 1) deliver to inbox or apply user-specified rules and deliver to a folder; 2) deliver to junk (which is typically just another folder, but treated specially by clients), 3) reject, and tell smtp.zahllos.example you don't want the email.
Once the email passes through the smtp dameon, assuming either 1 or 2, it then gets stored somehow and in some way. I'm being a little bit vague here, because 'it depends', but in the simplest scenario, the smtp daemon will write the message to an mbox or maildir-style format. More complex setups definitely exist, indeed, there can be multiple layers of servers doing analysis on separate machines, but for simplicity, mail.skywall.example is one VM that makes its decisions and the result ends up in /var/mail/user@domain/ or some such.
A key aspect of this step that makes email very nice is that if smtp.zahllos.example cannot, for some reason, reach your server now it will queue the message and try again at set intervals. You can reasonably safely turn off mail.skywall.example for a couple of hours.
Another aspect is that you can have multiple MX records where you are prepared to accept email, with priorities. So if you can't accept at one address because the server is down for maintenance, another will accept.
So, now you've technically got an email, but you don't know it. So you open thunderoutlook, and you connect to an IMAP server imap.skywall.example - in our example let us assume this is really the same thing as mail.skywall.example. The server checks you are really you with your credentials. At the backend, this is just another daemon that knows to read /var/mail/... and find new messages; it finds one, downloads its headers and displays it on your screen.
Since we're in a slightly more modern world now, in the case your client was already open you might have an "idle" connection with the server at all times, in which case it can push the message down to you.
In the case of webmail, it is really all the same thing, except you point your browser at a webpage, and that webpage communicates with the servers instead of your client communicating directly. Open source webmail might even use IMAP underneath; things like Zimbra use their own java mail agent, while Google is entirely custom.
That might seem complicated, but in the end it isn't: between two domains at the 'edge', in the end, there's an SMTP conversation. One sending server tells a receiving server it has mail for delivery, and it finds that server by asking DNS where it is. The receiving server may do a bunch of checks against DNS also before making a decision on what to do with the email.
It isn't so easy to categorise such a service by pure ASN, as they also offer dedicated and colocation services, so you might be blocking a licensed 'on prem' exchange box for a local UK council.
v=spf1 mx -all
For DKIM, when the email was sent it was signed with a key by the sending server. It is identified by a UUID in the incoming email. So the receiving server again queries DNS for TXT <UUID>._domainkey.hnemail.example and receives the public key as a response. Signature verification passes? Accept email. It fails? Mark as spam.
This doesn't have a lot to do with IP reputation. This is different. If you are a very large email provider, you might develop custom spam filters. IPs are allocated to 'autonomous systems' i.e. who actually uses them and hands them out to users, and depending on the business you might make some decisions about reputation. For example, if the IP address is part of a consumer ISP block that is handed out to users of broadband, chances are high that if they're sending email, it is probably a Windows PC compromised by malware.
Similarly, you might decide some ASNs are better than others. Some hosters are more liberal in what they will accept, such as VPN endpoints, tor nodes and such and as a consequence of this more spam comes from these ranges.
Rightly or wrongly, larger email providers try to add these extra filters to the process to protect their users from spam. This obviously sucks if you are genuinely trying to run an email server on your symmetric home fibre connection with a dedicated IP, but that's the world we live in.
I can't make any general statement on which providers might be best, and some people will have no issue whereas others will find themselves unable to send anything. I don't work for Outlook/Microsoft or Google and never have, so I don't know exactly what rules they use, and in all likeliness they shift constantly depending on spammer patterns. I can only say I've found running from a small DC to work pretty well.
Step 1, I'd move off Linode. Find a local DC or business you can support by hosting a VPS or dedi box with them. LowEndBox might be an interesting place to search but avoid anything too famous.
Step 2, join this https://sendersupport.olc.protection.outlook.com/pm/services.... They don't actually email me when they block my IP, but at least when I contact them I can argue I'm already in their program and they didn't actually notify me of any sending issues. I've got myself unblocked relatively quickly this way.
Agree with a sibling comment that many major providers fail to operate the SPF/DKIM/DMARC tools they insist you do.
Each to their own, but ultimately if we don't hold on to the freedom to operate our own mailservers, it will be taken away through inaction. This means doing some things right: DMARC, DKIM, SPF of course, server maintenance, good password policies and of course IP reputation. The best way I can recommend for IP reputation is to use a dedicated provider or VPS provider that disallows things like VPN endpoints, where it is less likely they'll assign an address with a poor reputation. A good provider might also ask you what you intend to host, and you might be able to discuss IP addresses with them.
This is in Switzerland on the 'flagship' carrier Swisscom. Swisscom are generally regarded as having the best overall coverage in Switzerland, helped by the fact they used to be the "PTT" i.e. a national enterprise as part of the Swiss Post. They operate Ericsson hardware, and Switzerland has lower power maximums for mobile operators compared to many European countries, resulting in a higher density of antennae. I'm also not talking about challenging environments like the mountains: I'm saying my Pixel 6 routinely drops 5G in the centre of cities like Geneva, Bern or Zürich. One of which happens to host a reasonably large Google office, so you'd figure they'd notice issues like this.
I've tried reflashing the OS from scratch, upgrading to beta versions of 'Carrier Services' etc. The issue appears to have improved over time and happens less frequently, but it still certainly happens.
My original plan was to eventually move to GrapheneOS but I'm now unsure, as I can't tell if this is the quality of stock android and the pixel hardware, and I'm rethinking my options.
Pot, meet kettle.
I had similar experiences. I am British also, so, also learned in and mostly drive manuals. My instructor's car would stall if you looked at it funny. A secondhand car I drove after I passed my test would almost never stall at all. I don't remember the makes - I enjoy driving but I'm definitely not into cars that much, sorry. But there's definitely quite a bit of variation in how cars handle and even someone like me who doesn't care that much for the internal details realises they'll need to “figure out" a new manual car when they first drive it.
Almost all the millennials my age can drive and and a good percentage probably own a manual. Automatics are gaining ground in the UK but they're still typically more expensive. I suspect 17 year olds are still learning to drive manuals in the UK right now.
Sorry to ruin the joke ;)
That said, I stand by what I said. If you look at maps of brexit voting tendency, you'll see they map quite heavily onto rural communities and former industrial heartlands. My explanation for this is that they don't see or feel the benefits of the EU and globalisation. But we didn't have a referendum on who wants globalisation to end, we had one on the EU, and so they took what they could.
> The typical profile of a brexiteer is somebody retired, not somebody in employment
I find this slightly weird stated so definitively having just argued I was being simplistic. I'll lay my cards on the table. I'm British but took advantage of free movement, so I've been party to more conversations on brexit than I really care to think about both back in the UK and here. Trust me, however, this is not an accurate statement: there are plenty of people with jobs who voted for brexit and have strong opinions on it. You don't need to take my anecdata on it though, we can look at a study https://yougov.co.uk/topics/politics/articles-reports/2016/0... - to put this into words:
- of every 100 18-24 year olds who voted, 29 of them voted leave. - of every 100 25-49 year olds you meet, 46 of them will be leave voters. - of every 100 people retirement age or above 36 in 100 you meet will have voted remain.
I find the 25-49 year old bracket overly broad, personally. The vote flips at 50+, but I suspect it would flip slightly younger based on my own experience.
But either way, it can't categorically be stated that all brexiteers are retired people. Actually I can lay further cards on the table: I used to do statistics as a job. So I take issue with the phrase "older people with fewer qualifications most likely to have voted brexit" used on the table I am quoting. Older people yes, but age also correlates with access to education, since my grandparents left school at 15, so there's a significant confounding factor here. I'd be interested in a more detailed breakdown, and I find the "and uneducated" part to be problematic/needing more evidence.
To come back to my point, I was offering a very qualitative interpretation of an extra factor I think encouraged previously core labour voters (in places that have returned labour MPs for about as long as there has been a labour party to choose) to switch allegiances in 2019. I agree with the fact labour does not represent them any longer. Brexit is part of, but not all of, that: I'm adding that Labour had an unclear stance on brexit, whereas these regions tended to vote more strongly for brexit.
This is obviously my opinion only, offered without guarantee or warranty.
There's also the European angle. Those who want to work likely faced competition from EU workers and generally feel hard done by when it comes to globalisation. After all, if you worked in coal, steel, car manufacturing or your family did, quite likely you, or a relative, has lost a good portion of that work to cheaper manufacturing abroad. Which is more appealing: Labour, who prevaricated on Brexit, or BoJo, who simply said he'd do it? It isn't all that different to 'America First' in its appeal.
There probably wasn't any way to avoid the demise of coal, especially given our need to combat climate change, but did Labour provide an alternative? During the 2000s, Labour massively expanded higher education but also increased 'student debt', and only paid lip service to apprenticeships. If you're working class and working/aspirational, likely your budgeting is quite strict. Things like 'debt' and 'loans' generally mean 'trouble' and not a solution.
I agree this is broad strokes, but Labour has a problem in that it no longer actually represents its traditional demographic.
Swiss medical insurance is actually quite strongly regulated and not like the US system at all. Extras are generally where insurance make money, like having a private room in a hospital instead of a ward.
Where I disagree is that a change of government will improve things, because I don't think 'more money' will magically solve all of the problems. As an example, GPs should be doing face to face appointments again as you say, and they should be on call for out of hours. Not for extra money, they're already highly paid. This is just part of the job - people aren't ill conveniently between 9-5 Mon-Fri. Before anyone says this is unfair, UK software engineer salaries look nothing like US ones most of the time, whereas doctors are 'raking it in'. Yes, being a doctor is a tough profession, undoubtedly, but getting into medical school is highly competitive and sought after. So you either want the status and money in exchange for unsocial hours and dealing with the sick and dying or you choose a different career.
I don't find it a convincing argument that 'this is all the fault of the tories' because I also had a problem with panic attacks when I lived in the UK under a labour government, and was also outright refused treatment because our local area had only adult facilities and I was 17.5 when it started. I've plenty of other stories, but this is mine.
Generally UK politics is polarised like the US and people who believe the conservatives' sole motive in life is to dance on the graves of the poor while watching a food bank burn are likely to be overrepresented online. Remember that austerity came on the heels of Gordon Brown trying to spend his way out of a recession, the same PM who as chancellor sold off the UK gold reserves at the bottom of gold value and tax raided a bunch of pensions. Labour are by no means perfect either, and unfortunately even governments have to budget.
Don't get me wrong, the tories have been the government for quite a while now. They've had time to improve things and they definitely haven't. I'm just saying the idea Labour will magically resolve NHS issues is a fallacy. I'd argue that the real issue is the short term/electoral driven policymaking with regards to the NHS - it is a sacred cow, and even the slightest mention of change could potentially be political suicide.
Let me extend that comment a bit. SIDH operates over the 'full endomorphism graph' which doesn't have enough structure to form a class group. What we do know about it is that the ring in question is isomorphic to a sub algebra that is a quaternion algebra. Quaternion algebras are not commutative and this property is inherited.
To compare to diffie hellman, imagine that when you combine public material the order matters. If Alice and Bob don't find a way to agree on the order the secret is computed in, they get different results.
SIDH's torsion point images are how that agreement happens but they also depend on curve parameters that relate to the secret isogenies under use. It is this that is being attacked. A special case was found back in 2017, but no clear way to SIDH.
Warning on CSIDH: like CRS before it is vulnerable to Kuperberg attacks, so there's a subexpontential time attack. It's arguable therefore whether it is post quantum and what parameter choices are appropriate, if any.
This is all fine though. SIDH was never a practical contender for many use cases like say smart cards, because waiting 5 minutes for your payment to be authorised on a 40MHz smartcard processor is a bit of a no-go. SIDH is orders of magnitude slower than all other options.
You can have multiple inheritance. You can have as many levels of partially implemented, partially abstract classes as you like provided you eventually have a concrete class, and these abstract classes can have member data. You can have static methods, which I've seen abused as namespaces so often. You can have static methods and non static ones in a class hierarchy. Finally you can mix templates into this.
In an ideal world the developers of a project in a company would collaborate to keep this from getting out of control and enforce a relatively consistent philosophy. However in practice people have their quirks and specific not always rational views, and programmers are in general not always the best at dealing with other people, programmers included.
So a strong personality is determined to do it one way and refactors a bunch of code to their liking, and on and on, and now a variety of features have been used in different ways.
No language is immune to this as it is fundamentally a human problem, but taking out features generally helps. Since we can get by without inheritance most of the newer languages have done away with it.
- Multi Account Containers - does exactly what it says on the tin. I load Google stuff inside a Google container for example, and banking websites all get their own container only used for that purpose.
- Auto Cookie Optout, with their config added to uBlock Origin. Basically automatically clicks "essential cookies only" everywhere it can (it helps to allow loading of these sites automatically in uBlock and uMatrix, otherwise it can't). Possibly not an issue if you're outside the EU, though.
- uMatrix so I have some level of control over what loads when I want it.
- ClearURLs - takes out tracking and unnecessary URL parameters. uMatrix tends to block and warn if you do click one and you can find the dest_url without parameters on its warning page, where ClearURLs fails.
- Decentraleyes - injects resources instead of loading them from CDNs. Quite mixed results with this but it is still on the list for the moment.
- Sideberry, basically another tree style tabs.
Nice testing sites for these extensions are basically any newspaper website or shopping website, which are all thoroughly infested with trackers and such.
> Instead they declared themselves rulers
This statement logically suggests that Microsoft laid down the law on secure boot and the impetus was entirely theirs and nobody could have done anything differently.
The UEFI forum was made into a public forum for the public version for x86. Before that it was a proprietary boot protocol designed by Intel mostly for itanium but also licensed to Apple for x86 (2010 era Mac minis use efi). Microsoft were not the originators, although I've no doubt they're contributors to this and secure boot.
Where Microsoft _do_ dictate is the Windows logo program, which is distinct from UEFI. This was the discussion originally on Matthew Garrett's blog: will they or won't they leave an 'off' option (practically they had to, to boot older windows and rescue disks).
Furthermore Microsoft's Windows logo requirements, while requiring OEMs to carry their keys on the basis OEMs want Windows logo, didn't exclude the likes of Redhat or Canonical from standing up a CA and getting included. There's some discussion of this on Matthew's older blog posts: https://mjg59.dreamwidth.org/6503.html?thread=194919 although I think there was a better discussion on OEM inclusion I can't find.
In other words we find ourselves where we are because everyone has been content for years to simply use the shim signed by Microsoft. Only Microsoft stood up a CA and underwent the due diligence. And you can't say a free CA can't be stood up, because letsencrypt went from zero to cab root programmes in this time.
The only issue in here that needs some care is forcing vendors to ship all approved CAs, not a minimum selection they care about.
Bootkits are a minor issue now as othe commentators have insinuated because of secure boot.
There are other advantages, too. With secure boot and tpms remote attestation of some systems at least becomes a bit more reasonable. You can also have the same bootkit resistance under Linux if you're prepared to put in a little bit of effort.
Sure if I had my way we'd have prioritized MTE/PAC over secure boot but there you are.
So let me sum up. Yes, what Lenovo is doing is bad, and if Microsoft are really proposing ditching third party signing then they deserve another massive antitrust suit. Looks like Matthew is again pretty much the only voice in the Linux world trying to make something practical work.
I am saying that it should always be the case that you can disable secure boot and it should always be the case that you can manage your platform keys. I also think they should ship the UEFI CA by default and offer the option to opt in to secure core as part of Windows' OOBE if they feel so compelled.
But there is a non profit neutral third party already and no Linux distro (or the Linux foundation) have pushed for CA inclusion that I know of.
UEFI and Secure Boot are here to stay unfortunately. That's not going to change (and that's more of a comment on the design of UEFI than SB).
Fair disclosure, I've been involved in products supporting secure boot, have run my own laptop with my own keys such that only my signed stuff runs. I also have one of those Talos 2 boards and it also supports its own secure boot, even though all of the software all the way down to the firmware is open source.
So far Microsoft have actually been pretty reasonable: they enabled the shim in the first place. No Linux distros including heavyweights like Redhat or Canonical stepped up to undergo the requirements for default inclusion in the UEFI forum.
It always strikes me as a logical fallacy to argue against having a secure boot but then be pro end to end encryption. 'Secure boot is being used to oppress us therefore secure boot is bad' is as extreme a view as 'some awful human beings share csam so end-to-end bad'.
Ultimately in both cases the problem is societal and not technical. We need consumer rights protections so we don't end up renting our devices, and we need policing and community work to eradicate csam. Frothing at the mouth misinformed 'activism' comes across very badly to people outside the tech world we necessarily need to engage to make constructive policies for the future.