rollingflower

rollingflower , 1 month ago

Yup, Wayland is so old it already has old concepts. But it is also changing a lot

rollingflower , 1 month ago

• TPM encryption or LUKS in general
• general distro architecture like ostree

rollingflower OP , 1 month ago

Ironically that link (that I manually took from the browser as it would otherwise be a permalink to my instance…) doesnt work in Jerboah

rollingflower OP , 1 month ago

Ironically that link (that I manually took from the browser as it would otherwise be a permalink to my instance…) doesnt work in Jerboah

rollingflower OP , 1 month ago

No

rollingflower , 1 month ago (edited 1 month ago)

Here is my template

<span style="color:#323232;">sudo cat > /etc/systemd/user/rsync-backup.service <<EOF
</span><span style="color:#323232;">[Unit]
</span><span style="color:#323232;">Description=do rsync backups with some conditions
</span><span style="color:#323232;"># After=network-online.target
</span><span style="color:#323232;">
</span><span style="color:#323232;">[Service]
</span><span style="color:#323232;">Type=oneshot
</span><span style="color:#323232;"># require a power connection (optional)
</span><span style="color:#323232;"># ExecStartPre=sh -c '[ $(cat /sys/class/power_supply/AC/online) = 1 ]'
</span><span style="color:#323232;">
</span><span style="color:#323232;"># require battery over 40%
</span><span style="color:#323232;"># ExecStartPre=sh -c '[ $(cat /sys/class/power_supply/BAT0/capacity) -ge 40 ]'
</span><span style="color:#323232;">
</span><span style="color:#323232;"># require the connected network to NOT be "metered"
</span><span style="color:#323232;"># ExecStartPre=sh -c '! $(nmcli -t -f GENERAL.METERED dev show | grep -q 'yes')'
</span><span style="color:#323232;">
</span><span style="color:#323232;">ExecStart=/home/user/.local/bin/rsync-backup
</span><span style="color:#323232;"># you might add everything you need
</span><span style="color:#323232;"># ExecStart=/path/to/something/else
</span><span style="color:#323232;">
</span><span style="color:#323232;"># delete old logs (disabled for testing)
</span><span style="color:#323232;"># ExecStartPost=rm -f /var/log/rsync-backups.log
</span><span style="color:#323232;"># log the updates
</span><span style="color:#323232;"># ExecStartPost=sh -c 'echo "Last backup: $(date)" > /var/log/rsync-backup.log'
</span><span style="color:#323232;"># write errors to log
</span><span style="color:#323232;">StandardError=file:/var/log/rsync-backups.log
</span><span style="color:#323232;">
</span><span style="color:#323232;"># GUI message
</span><span style="color:#323232;">#ExecStartPost=/usr/bin/notify-send -t 0 -a "Backup" "rsync backup finished." "$(output of some command if you want infos about the backup)"
</span><span style="color:#323232;">
</span><span style="color:#323232;"># run with low priority, when idling
</span><span style="color:#323232;"># Nice=15
</span><span style="color:#323232;">IOSchedulingClass=idle
</span><span style="color:#323232;">
</span><span style="color:#323232;"># when conditions were not met, try again after 15 minutes
</span><span style="color:#323232;"># Restart=on-failure
</span><span style="color:#323232;"># RestartSec=900
</span><span style="color:#323232;">
</span><span style="color:#323232;">[Install]
</span><span style="color:#323232;">WantedBy=multi-user.target
</span><span style="color:#323232;">EOF
</span>

Timer file:

<span style="color:#323232;">sudo cat > /etc/systemd/user/rsync-backup.timer <<EOF
</span><span style="color:#323232;">[Unit]
</span><span style="color:#323232;">Description=do rsync backups with some conditions
</span><span style="color:#323232;">
</span><span style="color:#323232;">[Timer]
</span><span style="color:#323232;">OnCalendar=daily
</span><span style="color:#323232;">Persistent=true
</span><span style="color:#323232;">EOF
</span>

(I think the unit is needed)

That is a slightly modified variant of my automatic rpm-ostree system updates which took an hour or so with the help of ChatGPT and a lot of testing around.

Systemd services are lit.

If you add a “repeat when conditions are not met” you need another timer to start it. Like 2 loops, one big loop to start the process, and one small loop to keep trying until conditions are met. I do that with my system updates to prevent them being done

• with low battery (or even using an AC requirement)
• over a metered network
• when the system is busy

rollingflower , 1 month ago

Okay good notice. You should put that in a deparate .timer file then

rollingflower , 1 month ago

Fossify Contacts

Connect You

rollingflower , 1 month ago

Adblock doesnt help privacy.

You need to use a hardened browser with as little unique identifiers as possible. Then you need to delete cookies and use different or unified IP addresses, obviously.

rollingflower , 1 month ago

What types of SSDs?

rollingflower OP , 1 month ago

If you use dnf you are not affected, yes

rollingflower , 1 month ago

Use 40 and not rawhide and you are good. But be aware that the upgrade to Plasma 6 might break small things.

I tested Plasma 6 on Fedora Kinoite months ago and it was already in a really good state. Really, the release of Fedora 40 will have a pretty much just working new Desktop!

rollingflower , 1 month ago

This, I would honestly not recommend regular Fedora, but Kinoite always.

I dont feel safe on traditional distros that just break and literally have no mechanism to just reset everything to default.

<span style="color:#323232;">rpm-ostree reset --reboot
</span>

Done.

rollingflower , 1 month ago

Gentoo is moving the non-technical organization overhead to Software in the Public Interest (SPI). As noted above, SPI is already now recognized at US federal level as a full-fleged non-profit 501©(3). It also handles several projects of similar type and size (e.g., Arch and Debian) and as such has exactly the experience and background that Gentoo needs. What are the advantages of becoming an SPI Associated Project in detail?

Financial benefits to donors:

<span style="color:#323232;">tax deductions [1]
</span>

Financial benefits to Gentoo:

<span style="color:#323232;">matching fund programs [2]
</span><span style="color:#323232;">reduced organizational complexity
</span><span style="color:#323232;">reduced administration costs [3]
</span><span style="color:#323232;">reduced taxes [4]
</span><span style="color:#323232;">reduced fees [5]
</span><span style="color:#323232;">increased access to non-profit-only sponsorship [6]
</span>

Non-financial benefits to Gentoo:

<span style="color:#323232;">reduced organizational complexity, no “double-headed beast” any more
</span><span style="color:#323232;">less non-technical work required
</span>

[1] Presently, almost no donations to the Gentoo Foundation provide a tax benefit for donors anywhere in the world. Becoming a SPI Associated Project enables tax benefits for donors located in the USA. Some other countries do recognize donations made to non-profits in other jurisdictions and provide similar tax credits.

[2] This also depends on jurisdictions and local tax laws of the donor, and is often tied to tax deductions.

[3] The Gentoo Foundation currently pays $1500/year in tax preparation costs.

[4] In recent fiscal years, through careful budgetary planning on the part of the Treasurer and advice of tax professionals, the Gentoo Foundation has used depreciation expenses to offset taxes owing; however, this is not a sustainable strategy.

[5] Non-profits are eligible for reduced fees, e.g., of Paypal (savings of 0.9-1.29% per donation) and other services.

[6] Some sponsorship programs are only available to verified 501©(3) organizations

---

You can still donate to the SIP and the Förderverein in Germany.

rollingflower , 1 month ago

To my knowledge they did some horrible “performance” fixes like disabling Windows Defender.

Windows requires you to install random software. If you are really careful, you could live without antivirus, but honestly just dont.

If your PC doesnt tolerate the overcomplicated Windows 11, any Linux distro is lighter.

I recommend to give Fedora Kinoite a shot. It is a very modern distribution model.

Fedora Discussion is a good resource for help, and I am always down to fix the small Kinoite issues like video codecs or flatpaks.

rollingflower , 1 month ago

Okay then that was the “extreme” mode and maybe was already removed.

rollingflower , 1 month ago

RIP Jia Tan

rollingflower , 1 month ago

Can we stop calling a good software dev autistic or stuff?

rollingflower , 1 month ago

Why… is Canonical so good with business connections and spreading desktop Linux around the world? While they use fu**ing Snaps and break GNOME as “their desktop”?

rollingflower , 1 month ago

I think their concept is just as flawed as “dash to dock”. Desperately trying to “not be Windows” (while mimicking mac lol)…

You have a huge top bar that is mainly unused space. You have no hitbox at the top right edge, because of the bad GNOME decorations (also in Firefox) and because of that stupid top bar.

Then having a dock with empty space around it, where you could easily fit clock, quicksettings and menu, why??

Dash to panel fixes most, just not the bad hitboxes to the top edge. And luckily it is very actively maintained.

Ubuntu meanwhile keeps that useless top bar and also places a bar at the edge. This is good for regular screens. But it is annoying when tiling in half.

And they dont fix it, as they still keep the silly top bar.

And the main issue is their theming, which breaks apps.

rollingflower , 1 month ago

This is so damn needed

rollingflower , 1 month ago

It is also a lie as the installer doesnt know any percentages.

But afaik Debian installer, Calamares, Fedora Anaconda and more all have loading bars

rollingflower , 1 month ago

github.com/Jguer/yay

Doesnt look like that, many translations but also normal maintenance

rollingflower , 1 month ago

Fedora Pantheon or something. But really, GNOME, KDE, LXQt, Cinnamon, Mate, soom COSMIC are all in a better state.

rollingflower , 1 month ago

Damn didnt know that was FOSS

github.com/OdyseeTeam

rollingflower , 1 month ago

Would probably be /usr and /bin, while some apps get installed to /opt or even /local or /var

rollingflower , 1 month ago

That would mean the app has access to the path, which was explained as insecure in another place

rollingflower , 1 month ago

Yes thar is the direction I am going to. But they just disable kernel modules from running, I dont know if that is as complete as simply not building them.

But if its possible, then everyone with amd or intel should block nouveau, and vice versa. Just keep it small.

rollingflower , 1 month ago

It would be a problem because of how it is currently done.

I imagine an install ISO to have a monokernel, build the kernel-building-system and detect the needed drivers. Save the config and build the matching kernel from that.

Now if you want to swap hardware, there is a transition tool within the OS that allows to state the wanted hardware component and remove the old driver from the config.

Or you switch to a monokernel and run the hardware detection and config change again.

Or you use the install USB stick (which you already have) which already uses a monokernel and has a feature to detect hardware, change the config on the OS, build and install the kernel to the OS.

This is a bit more complex than for example what fedora plans with their new WebUI installer. Poorly such a system also doesnt work that well with so many kernel updates.

rollingflower , 1 month ago

What I really like about stuff like RedoxOS, COSMIC, typst, simpleX, Wayland and others is having stuff built from a modern perspective with modern practices.

Linux is ancient now, and its a miracle that it is thriving like this.

If dynamic loading really is that robust, it probably doesnt matter. But I dont know how big the performance increases are and I really need to do benchmarks before and after.

There are btw also some experiments on making tbe CentOS-Stream LTS kernel run on Fedora. Which would be another great way of getting a more stable system.

rollingflower , 1 month ago

It is a smaller project, but good to hear its actively developed!

rollingflower OP , 1 month ago

ubuntuce.com

rollingflower OP , 1 month ago

In emacs, nano

rollingflower OP , 1 month ago

Uhm this is linuxmemes my guy

rollingflower OP , 1 month ago

You need to be more specific.

You need to think about the background problem here.

When Google made Android, it was web based. Their “perfect sandbox” ironically has no internet toggle. They won tons of marketshare, and iOS is not different here, both restrict apps to containers and have permission systems to reach out of these containers to access sensors, files and other data.

Desktop operating systems are way older and have no such concept. We have mandatory access control with SELinux and Apparmor, but those are (I think) more complicated than Flatpak.

Flatpak is a solution for multiple problems of Desktop Linux Apps at once.

1. isolate apps with a real permission system
2. make apps run anywhere
3. have a single platform to target, so we dont need packagers anymore (for most GUI apps) and can file bugs upstream
4. separating apps from the system: stable distros can have modern apps (similar to Windows) and Apps dont affect the stability of the OS at all. Also config files of such apps are in their container, not bloating your “oh so good xdg basedir”

These are all extremely important points for a healthy, modern and secure Linux Desktop.

But there are also issues to every point:

1. most apps are not adapted to this model, which means they need broad static permissions like Pulseaudio, home or even host, allowing surveillance or trivial (even documented) privilege escalation. This is basically how apps like Flatseal work. Pulseaudio has no portal, do apps can listen to your mic whenever they want.
2. Apps that “run everywhere” will not have distro-specific optimizations. The system needs to run on old LTS kernels to be universal, which means you miss out on tons of optimizations. Developers could just not care, but this depends on the app.
3. Flatpak is more complicated than Snap (or even Appimage, if you leave the manual signing, monitoring vulnerable libraries and having a manual repo out). So it is not a great experience for “the Linux packaging model”. GNOME Builder is a good IDE for it but afaik only for GTK apps.
4. No issues here. This is the core princible of “immutable” distros like Fedora Atomic Desktops.

If you have issues with flatpaks, you need to be more specific. Maybe it is a packaging issue, or you expect an app to do stuff that is not

rollingflower OP , 1 month ago

Same. Ubuntu AND Fedora Libreoffice, SciDAVis and more where broken, not the Flatpaks.

Flatpak is really meant for the big GUI apps. No problem with small distro packages really. It just takes off the huge burdens of maintaining distro packages for like Libreoffice, which is as big as the Linux Kernel.

rollingflower OP , 1 month ago

Fair point. But when apps are on Flathub and people say “I dont care I have the AUR” they need to know.

• the AUR has no verification at all
• the apps have no permission system at all, so you need to trust them 100%
• they are installed on your system and might mess up updates, give dependency errors etc.
• their solution does not apply to nontechnical people. If a solution is not scaleable, it is not a good solution

rollingflower OP , 1 month ago

Which is not needed but a good bonus. VLC and others are still unverified, even though very well packaged.

But I dont care about VLC anymore haha, Celluloid has Wayland support, portals, MPV configuration and is better for watching movies. Not for music though.

rollingflower OP , 1 month ago

How come the other distros don’t seem to care?

Obviously because they are SO MUCH MORE BADASS.

No.

lmddgtfy.net/?q=why can ubuntu ship nonfree codec…

rollingflower OP , 1 month ago

What points?

rollingflower OP , 1 month ago

Okay having an easily readable build file is a bit missing. Flathub hides that a lot.

I think their rating system, which is on the website and also GNOME Software, displays apps with home access as insecure.

And somehow this seems to be general knowledge and an issue about a privilege escalation through a local override was just closed. Yay