• 6 Posts
  • 389 Comments
Joined 2 years ago
cake
Cake day: June 12th, 2023

help-circle








  • That is a quite popular opinion judging by the votes. I think they function quite differently, and are useful for different things, which might be more unpopular.

    BSD and MIT are more like “public domain” or “creative commons” licenses. Some people genuinely just don’t care and want literally anyone to use their work.

    Libraries, languages, APIs, OS’s, etc… Work well because they have mass adoption. They have mass adoption (often) because people get the freedom to use them during their paid time. Companies are exploitative and evil, but often their dev and engineer employees aren’t.

    Copy left licenses (GPL, AGPL, CERN-OHL-S to not forget about open source hardware) really shine for end products like hardware, applications, hosted software, games, etc… Where you want to preserve a “unique” end product against theft, exploitation, and commercialization, and really care about having not everyone be able to do whatever they want.




  • Dropping instead of blocking might technically be better because it wastes a bit more bot time and they see it as “it doesn’t exist” rather than an obsticle to try exploits on. Not sure if that is true though.

    For me:

    • ssh server only with keys

    • absolutely no ssh forwarding, only available to local network via firewall rules

    • docker socket proxy for everything that needs socket access

    • drop non-used ports, limit IPs for local-only services (e.g. paperless)

    • crowdsec on traefik for the rest (sadly it blocks my VPN IPs also)

    • Authelia over everything that doesn’t break the native apps (jellyfin and home assistant are the two that it breaks so far, and HA was very intermittent so I made a separate authelia rule and mobile DNS entry for slightly reduced rules)

    • proper umask rules on all docker directories (or as much as possible)

    • main drive FDE with a separate boot drive with FDE keyfile on a dongle that is removed except for updates and booting to make snatch-and-grabs useless and compromising bootloader impractical

    • full disk encryption with passworded data drives, so even if a smash and grab happens when I leave the dongle in, the sensitive data is still encrypted and the keys aren’t in memory (makes a startup script with a password needed, so no automated startups for me)

    For more info, I followed a lot of stuff on: https://github.com/imthenachoman/How-To-Secure-A-Linux-Server






  • Then the question is: what is being smart or dumb? If acting dumb in 90% of life while having the capability of being smart isn’t “being dumb” then what is?

    If someone who has the capability of being 50/100 intelligent and is always acting 50/100, I would argue they are smarter than someone capable of 80/100 intelligence but acts 20/100 intelligence for 90% of their life.



  • You absolutely can fail. I daily drive bazzite but many things have been pretty rough:

    Any coding apps that will use an external device -> you can’t use flatpak. You have to use distrobox that constantly freezes your entire mouse for 3-5 seconds upon any sort of dialog, settings, saving, anything where it has to access the filesystem. Then you have to add udev rules to directories that in the documentation says not to write to, and reloading the rules doesn’t work for testing, you have to fully restart with every minor change or it will seem like the change didn’t work.

    Luckily most device drivers seem to work in the provided arch distrobox but holy dependency hell. Things will fail to install because they need a package that exists on the host but not the container so you get an unsolvable “file exists” conflict. When installing a package, it will sometimes just try to grab an old version of a dependency specifically that will 404 out instead of just grabbing the most recent version (never happened on arch itself to me)

    Setting up a plasma vault with gocryptfs was not fun figuring out how. Also ran into tons of dependency problems and the fact that fedora just abandoned it specifically. Ended up just having to stick the binary in a random folder and point to it.

    Any sort of document authentication/signing -> doesn’t work and will not work in the future for a long time.

    You absolutely have to install rpms still for corectrl, any external devices, like drawing tablets, etc…

    Some games inexplicably use <50% GPU and <40% CPU with terrible framerates and will not go any higher (or lower) no matter what, switching between low and high settings and resolution results in 0fps change.

    When I have my config set and don’t have to change anything, it is super super nice to never have to manually update, but anything outside of very basic usage is weaving through nonstandard undocumented territory.

    Bazzite trades maintenance headaches for configuration and installation headaches. For me, that is worth it.