I got Howdy face unlock to also unlock my keyring, using the TPM — because a face can't be an encryption key
Howdy gives you face login on Linux. What it doesn't give you is a password — and gnome-keyring, KWallet and friends want one. So you get recognised by your face, and then asked for your password anyway. Which rather defeats the point.
I spent a while trying to fix this the obvious way and it can't work, so I want to explain why before the actual solution, because the why is the interesting part.
Why you can't just hash your face
The obvious idea is: take the face encoding, hash it, use that as the key.
Face encodings are fuzzy. Here are six enrolments of my own face, captured seconds apart on the same camera, compared pairwise:
encoding 0 vs 1 : 0.0829
encoding 0 vs 4 : 0.3609
encoding 1 vs 4 : 0.3846
encoding 2 vs 5 : 0.3166 (identical vectors would be 0.0000)
Every capture is a different 128-float vector. That's why face matching uses a distance threshold rather than equality — Howdy accepts anything under \~0.57. A hash of one encoding is unrelated to a hash of the next, so there's nothing stable to derive a key from.
And even if you solved the noise: your face isn't secret, and the model file sits on disk right next to whatever it would be protecting.
What actually works
The biometric doesn't become the key. It authorises the TPM to release one.
face match -> authorises -> TPM unseals -> a real, stable secret
(fuzzy) (hardware) (exact)
Seal your keyring password to the TPM, and have a PAM module unseal it after Howdy authenticates and hand it to the stack as PAM_AUTHTOK. gnome-keyring picks it up and unlocks. No prompt.
That's it. \~250 lines of C.
https://github.com/jibsta210/howdy-tpm
Face at the greeter, straight to desktop, keyring unlocked, nothing typed.
https://redd.it/1vh8ija
@r_linux
Howdy gives you face login on Linux. What it doesn't give you is a password — and gnome-keyring, KWallet and friends want one. So you get recognised by your face, and then asked for your password anyway. Which rather defeats the point.
I spent a while trying to fix this the obvious way and it can't work, so I want to explain why before the actual solution, because the why is the interesting part.
Why you can't just hash your face
The obvious idea is: take the face encoding, hash it, use that as the key.
Face encodings are fuzzy. Here are six enrolments of my own face, captured seconds apart on the same camera, compared pairwise:
encoding 0 vs 1 : 0.0829
encoding 0 vs 4 : 0.3609
encoding 1 vs 4 : 0.3846
encoding 2 vs 5 : 0.3166 (identical vectors would be 0.0000)
Every capture is a different 128-float vector. That's why face matching uses a distance threshold rather than equality — Howdy accepts anything under \~0.57. A hash of one encoding is unrelated to a hash of the next, so there's nothing stable to derive a key from.
And even if you solved the noise: your face isn't secret, and the model file sits on disk right next to whatever it would be protecting.
What actually works
The biometric doesn't become the key. It authorises the TPM to release one.
face match -> authorises -> TPM unseals -> a real, stable secret
(fuzzy) (hardware) (exact)
Seal your keyring password to the TPM, and have a PAM module unseal it after Howdy authenticates and hand it to the stack as PAM_AUTHTOK. gnome-keyring picks it up and unlocks. No prompt.
That's it. \~250 lines of C.
https://github.com/jibsta210/howdy-tpm
Face at the greeter, straight to desktop, keyring unlocked, nothing typed.
https://redd.it/1vh8ija
@r_linux
GitHub
GitHub - jibsta210/howdy-tpm: Unlock your keyring with your face. A PAM module that releases a TPM-sealed secret as PAM_AUTHTOK…
Unlock your keyring with your face. A PAM module that releases a TPM-sealed secret as PAM_AUTHTOK when Howdy authenticates, so gnome-keyring/KWallet stop asking for a password you never typed. - ji...
Why and how the Austrian Military moved to LibreOffice (Part 1)
https://blog.documentfoundation.org/blog/2026/08/07/why-and-how-the-austrian-military-moved-to-libreoffice-part-1/
https://redd.it/1vhvyjr
@r_linux
https://blog.documentfoundation.org/blog/2026/08/07/why-and-how-the-austrian-military-moved-to-libreoffice-part-1/
https://redd.it/1vhvyjr
@r_linux
TDF Community Blog
Why and how the Austrian Military moved to LibreOffice (Part 1) - TDF Community Blog
Many government departments around the world are moving away from vendor lock-in by tech giants, and switching to free and open source software like LibreOffice. This helps with privacy, security, and digital sovereignty. One such example is the Austrian…
Linux keeps getting better the more I use it
The longer I use linux, the more I appreciate it. I switched from windows a while ago, and I honestly haven't regretted it for a second.I'm a developer, and every time I learn a new command or discover another tool that makes my workflow easier, I realize how powerful and well-designed this operating system is. It feels like there's always something new to learn, and instead of making me frustrated, it just makes me enjoy using it even more. At this point, going back to windows for my daily development work would feel like a huge step backward.
https://redd.it/1vi62gs
@r_linux
The longer I use linux, the more I appreciate it. I switched from windows a while ago, and I honestly haven't regretted it for a second.I'm a developer, and every time I learn a new command or discover another tool that makes my workflow easier, I realize how powerful and well-designed this operating system is. It feels like there's always something new to learn, and instead of making me frustrated, it just makes me enjoy using it even more. At this point, going back to windows for my daily development work would feel like a huge step backward.
https://redd.it/1vi62gs
@r_linux
Reddit
From the linux community on Reddit
Explore this post and more from the linux community
Linux Accidentally Left Legacy I/O & Memory Handlers Open In Kernel Lockdown Mode
https://www.phoronix.com/news/Linux-Lockdown-Legacy-IO-Mem
https://redd.it/1vi6ny9
@r_linux
https://www.phoronix.com/news/Linux-Lockdown-Legacy-IO-Mem
https://redd.it/1vi6ny9
@r_linux
Phoronix
Linux Accidentally Left Legacy I/O & Memory Handlers Open In Kernel Lockdown Mode
For nearly the past decade has been the kernel lockdown mode for tightening up kernel access from user-space such as when UEFI Secure Boot is enabled
NixOS: The Nixpkgs core team has disbanded
https://discourse.nixos.org/t/the-nixpkgs-core-team-has-disbanded/79413
https://redd.it/1vij85a
@r_linux
https://discourse.nixos.org/t/the-nixpkgs-core-team-has-disbanded/79413
https://redd.it/1vij85a
@r_linux
NixOS Discourse
The Nixpkgs core team has disbanded
The Nixpkgs core team has unfortunately decided to disband. We’re proud to have had the opportunity to lead by example in bottom‐up, consensus‐focused governance for Nixpkgs, and of our achievements over the past 10 months, including reforming the committer…
Just read “Just for fun”
Thank you Linus and David. I know this book is from 2001. I tend to be a late bloomer is all respects. Linux included. Books like this help fill in the gaps and provide excellent context. My favorite: “I don’t proactively delegate as much as I wait for people to come forward and volunteer to take over things.”
https://redd.it/1viiw05
@r_linux
Thank you Linus and David. I know this book is from 2001. I tend to be a late bloomer is all respects. Linux included. Books like this help fill in the gaps and provide excellent context. My favorite: “I don’t proactively delegate as much as I wait for people to come forward and volunteer to take over things.”
https://redd.it/1viiw05
@r_linux
Reddit
From the linux community on Reddit
Explore this post and more from the linux community
18-Year-Old Linux Kernel Bug Allows Full System Takeover
https://www.privacyguides.org/news/2026/08/07/18-year-old-linux-kernel-bug-allows-full-system-takeover/
https://redd.it/1virr9o
@r_linux
https://www.privacyguides.org/news/2026/08/07/18-year-old-linux-kernel-bug-allows-full-system-takeover/
https://redd.it/1virr9o
@r_linux
Privacy Guides
18-Year-Old Linux Kernel Bug Allows Full System Takeover
Researchers at Tencent Zhuque Lab uncovered an 18-year-old vulnerability in the Linux kernel that can escape containers and gain full root privileges on the host system.
Thoughts from someone who just got into Linux.
TLDR: Pick your desktop environment first. Distros do not matter until you know what UI you like.
Currently running base Arch with CachyOS kernel and GNOME.
Day 9 on Linux. After all the distro hopping and agonizing over which one to choose, I came to a pretty surprising conclusion, the distro doesn’t matter at all until you know what DE you want.
Linux users are always quick to recommend a distro, but they rarely suggest a DE, terminal, or daily driver software, at least, that was my experience as a beginner.
The more I learned, the more I realized you can make almost every distro function identically at a surface level. Distros and kernels really only come into play after you figure out your interface and workflow preferences first. Linux is taught completely backwards.
Just some random midnight thoughts from a new user. Anyway this is what I ended up with for a primarily gaming rig.
My Current Setup.
I eventually landed on base Arch, running the CachyOS repositories and kernel, with GNOME as my DE. I originally tried CachyOS directly, but swapped to base Arch to cut down on package bloat, my current install sits at around \~950 packages, whereas a fresh CachyOS GNOME install was sitting at around \~1,800 on first boot.
https://redd.it/1viqo0g
@r_linux
TLDR: Pick your desktop environment first. Distros do not matter until you know what UI you like.
Currently running base Arch with CachyOS kernel and GNOME.
Day 9 on Linux. After all the distro hopping and agonizing over which one to choose, I came to a pretty surprising conclusion, the distro doesn’t matter at all until you know what DE you want.
Linux users are always quick to recommend a distro, but they rarely suggest a DE, terminal, or daily driver software, at least, that was my experience as a beginner.
The more I learned, the more I realized you can make almost every distro function identically at a surface level. Distros and kernels really only come into play after you figure out your interface and workflow preferences first. Linux is taught completely backwards.
Just some random midnight thoughts from a new user. Anyway this is what I ended up with for a primarily gaming rig.
My Current Setup.
I eventually landed on base Arch, running the CachyOS repositories and kernel, with GNOME as my DE. I originally tried CachyOS directly, but swapped to base Arch to cut down on package bloat, my current install sits at around \~950 packages, whereas a fresh CachyOS GNOME install was sitting at around \~1,800 on first boot.
https://redd.it/1viqo0g
@r_linux
Reddit
From the linux community on Reddit
Explore this post and more from the linux community
Intel resumes HDMI 2.1 FRL work for Linux, 4K 120Hz already works on Meteor Lake and Panther Lake
https://videocardz.com/newz/intel-resumes-hdmi-2-1-frl-work-for-linux-4k-120hz-already-works-on-meteor-lake-and-panther-lake
https://redd.it/1viyg2e
@r_linux
https://videocardz.com/newz/intel-resumes-hdmi-2-1-frl-work-for-linux-4k-120hz-already-works-on-meteor-lake-and-panther-lake
https://redd.it/1viyg2e
@r_linux
Reddit
From the linux community on Reddit: Intel resumes HDMI 2.1 FRL work for Linux, 4K 120Hz already works on Meteor Lake and Panther…
Explore this post and more from the linux community
Linux 7.3 To Better Handle Cluster Load Balancing On Intel Hybrid CPUs
https://www.phoronix.com/news/Linux-7.3-Better-Intel-Hybrid
https://redd.it/1vj6hic
@r_linux
https://www.phoronix.com/news/Linux-7.3-Better-Intel-Hybrid
https://redd.it/1vj6hic
@r_linux
Phoronix
Linux 7.3 To Better Handle Cluster Load Balancing On Intel Hybrid CPUs
A set of patches from Intel are set to be merged for the upcoming Linux 7.3 merge window to enhance the cluster-aware scheduling code so it better handles load balancing on modern Intel Core (Ultra) hybrid CPUs with a mix of P and E/LPE cores.
Device Directory Table
Hello Everyone,
I am currently stuying the part about devices directories in Linux system, and i thought ill make a list of all Device directories to refer back to when needed.
I made the below table listing all essential devices in Linux that you need to know about, while containig the category of these devices, naming, directory and the type of variable they use in their naming (replacing the * with the corresponding numrics or letters. e,g: /dev/sd* > /dev/sda, /dev/sdb, /dev/sdc... and so on).
Thought that i should share this list, and i hope this can be useful to anyone who's looking for a simplified listing of all devices and having them in one place.
|Category|Device name|Directory|* Type|
|:-|:-|:-|:-|
|Storage|Hard Disk|/dev/sd*|a, b, c...|
|Storage|Hard Disk - Partitioning|/dev/sda*|1, 2, 3... (no 0, starts from 1)|
|Storage|Virtual Disk|/dev/vd*|a, b, c...|
|Storage|Xen Virtual Disk|/dev/xvd*|a, b, c...|
|Storage|Non-Volatile Memory Express (NVME)|/dev/nvme*|0, 1, 2...|
|Storage|Device Mapper|/dev/dm- SL to* /dev/mapper|0, 1, 2...|
|Storage|CD & DVD (read only)|/dev/sr*|0, 1, 2...|
|Storage|Generic SCSI (passthrough)|/dev/sg*|0, 1, 2...|
|Storage|PATA (Parallel ATA)|/dev/hd*|a, b, c...|
|Storage|Loop Device|/dev/loop*|1, 2, 3...|
|Terminal|Virtual Console|/dev/tty*|0, 1, 2...|
|Terminal|Pseudoterminal (Master)|/dev/ptmx|N/A|
|Terminal|Pseudoterminal (Slave)|/dev/pts/*|0, 1, 2...|
|Serial/Parallel Port|Serial Port: RS-232 (COM1)|/dev/ttyS*|0, 1, 2...|
|Serial/Parallel Port|Serial Port: Plug-in USB Adapter|/dev/ttyUSB* & /dev/ttyACM*|0, 1, 2...|
|Serial/Parallel Port|Parallel Port: Unidirectional|/dev/lp*|0, 1, 2...|
|Serial/Parallel Port|Parallel Port: Bidirectional|/dev/parport*|0, 1, 2...|
|Audio Device|Audio Device: Advanced Linux Sound Architecture (ALSA)|/dev/snd/*|N/A|
|Audio Device|Audio Device: Open Sound system (OSS)|/dev/dsp & /dev/audio|N/A|
|Pseudo Device|Null Device|/dev/null|N/A|
|Pseudo Device|Zero Device|/dev/zero|N/A|
|Pseudo Device|Random Number Generator|/dev/random & /dev/urandom|N/A|
|Pseudo Device|Full Device|/dev/full|N/A|
|Input|Input Event|/dev/input/event*|0, 1, 2...|
|Input|Mouse|/dev/input/mouse*|0, 1, 2...|
|Video/Graphics|Framebuffer|/dev/fb*|0, 1, 2...|
|Video/Graphics|Video Capture|/dev/video*|0, 1, 2...|
|Memory|Physical/Kernal Memory|/dev/mem & /dev/kmem|N/A|
|Flash Memory|Flash Memory|/dev/mtd*|0, 1, 2...|
|Networking|Network Tunnel|/dev/net/tun|N/A|
|Networking|Syslog Socket|/dev/log|N/A|
|Misc Hardware|Watchdog Timer|/dev/watchdog|N/A|
|Misc Hardware|Real-Time Clock|/dev/rtc*|0, 1, 2...|
(it might not be 100% correct since im still in the process of learning them, so please help me correct anything in case you found any mistake or things that i should add!! or ask questions, in that case i can also learn something new myself while looking things up)
https://redd.it/1vipwv5
@r_linux
Hello Everyone,
I am currently stuying the part about devices directories in Linux system, and i thought ill make a list of all Device directories to refer back to when needed.
I made the below table listing all essential devices in Linux that you need to know about, while containig the category of these devices, naming, directory and the type of variable they use in their naming (replacing the * with the corresponding numrics or letters. e,g: /dev/sd* > /dev/sda, /dev/sdb, /dev/sdc... and so on).
Thought that i should share this list, and i hope this can be useful to anyone who's looking for a simplified listing of all devices and having them in one place.
|Category|Device name|Directory|* Type|
|:-|:-|:-|:-|
|Storage|Hard Disk|/dev/sd*|a, b, c...|
|Storage|Hard Disk - Partitioning|/dev/sda*|1, 2, 3... (no 0, starts from 1)|
|Storage|Virtual Disk|/dev/vd*|a, b, c...|
|Storage|Xen Virtual Disk|/dev/xvd*|a, b, c...|
|Storage|Non-Volatile Memory Express (NVME)|/dev/nvme*|0, 1, 2...|
|Storage|Device Mapper|/dev/dm- SL to* /dev/mapper|0, 1, 2...|
|Storage|CD & DVD (read only)|/dev/sr*|0, 1, 2...|
|Storage|Generic SCSI (passthrough)|/dev/sg*|0, 1, 2...|
|Storage|PATA (Parallel ATA)|/dev/hd*|a, b, c...|
|Storage|Loop Device|/dev/loop*|1, 2, 3...|
|Terminal|Virtual Console|/dev/tty*|0, 1, 2...|
|Terminal|Pseudoterminal (Master)|/dev/ptmx|N/A|
|Terminal|Pseudoterminal (Slave)|/dev/pts/*|0, 1, 2...|
|Serial/Parallel Port|Serial Port: RS-232 (COM1)|/dev/ttyS*|0, 1, 2...|
|Serial/Parallel Port|Serial Port: Plug-in USB Adapter|/dev/ttyUSB* & /dev/ttyACM*|0, 1, 2...|
|Serial/Parallel Port|Parallel Port: Unidirectional|/dev/lp*|0, 1, 2...|
|Serial/Parallel Port|Parallel Port: Bidirectional|/dev/parport*|0, 1, 2...|
|Audio Device|Audio Device: Advanced Linux Sound Architecture (ALSA)|/dev/snd/*|N/A|
|Audio Device|Audio Device: Open Sound system (OSS)|/dev/dsp & /dev/audio|N/A|
|Pseudo Device|Null Device|/dev/null|N/A|
|Pseudo Device|Zero Device|/dev/zero|N/A|
|Pseudo Device|Random Number Generator|/dev/random & /dev/urandom|N/A|
|Pseudo Device|Full Device|/dev/full|N/A|
|Input|Input Event|/dev/input/event*|0, 1, 2...|
|Input|Mouse|/dev/input/mouse*|0, 1, 2...|
|Video/Graphics|Framebuffer|/dev/fb*|0, 1, 2...|
|Video/Graphics|Video Capture|/dev/video*|0, 1, 2...|
|Memory|Physical/Kernal Memory|/dev/mem & /dev/kmem|N/A|
|Flash Memory|Flash Memory|/dev/mtd*|0, 1, 2...|
|Networking|Network Tunnel|/dev/net/tun|N/A|
|Networking|Syslog Socket|/dev/log|N/A|
|Misc Hardware|Watchdog Timer|/dev/watchdog|N/A|
|Misc Hardware|Real-Time Clock|/dev/rtc*|0, 1, 2...|
(it might not be 100% correct since im still in the process of learning them, so please help me correct anything in case you found any mistake or things that i should add!! or ask questions, in that case i can also learn something new myself while looking things up)
https://redd.it/1vipwv5
@r_linux
Reddit
From the linux community on Reddit
Explore this post and more from the linux community