HayadSont

joined 1 month ago
[–] HayadSont@discuss.online 1 points 20 hours ago (1 children)

They don’t seem to give a shit about security. I think the well is poisoned.

Nah, I wouldn't go that far. That's like way too dramatic.

Best to just use apt

I will whenever apt doesn't (majorly) rely on backports for its security updates AND actually sandboxes its own packages. Zero Trust, FTW!

[–] HayadSont@discuss.online 0 points 1 day ago (3 children)

Ah okay, thanks for the clarification! I haven't delved deep into that aspect yet. But I've recently become aware of this unaddressed attack vector. And it is definitely something to worry about.

Unsure if it's solved anytime soon. But, if it is properly addressed and solved at some point in the future, would that (completely) redeem Flatpak's security model? Or, at least make it superior to what's found elsewhere?

[–] HayadSont@discuss.online 1 points 2 days ago* (last edited 2 days ago) (1 children)

Hehe :P , thanks for sharing your experiences!

Uhmm..., please allow me to elaborate upon my first question, as I don't feel it's quite answered yet.

You noted the following in an earlier comment:

Edit: I’m leaving it

Which led me to believe that you left Bluefin for some reason. But after reading your great wall, it doesn't seem as if you actually left it. So..., I'm mostly confused at the moment :P . Would you mind elaborating in hopes of (at least) alleviating this confusion?

[–] HayadSont@discuss.online 2 points 2 days ago* (last edited 1 day ago)

It's simply reflective of how Steam publishes those numbers on its own platform. For some reason, Fedora isn't explicitly accounted for while it's very likely to possess a huge chunk of the "Other" category.

To illustrate this point, we'll look at Boiling Steam's latest report. It uses ProtonDB's data to give us (possible) insight on what's found within "Other" (that accounts for 23.27%). Before I delve further, it has to be said that ProtonDB's data contrasts Steam's in significant ways. It's not a huge departure, but one definitely notices a slight discrepancy between the numbers.

FWIW, as per Boiling Steam's report, we find the following numbers for Fedora (and related derivatives):

  • Fedora - 8.7%
  • Nobara - 5.2%
  • Bazzite - 4.5%

Which (together) amounts to 18.4%.

If we would scale this down, as Boiling Steam's report doesn't include SteamOS Holo^[I'll assume its share is 30.95% based on Steam's own numbers.], we'd get:

  • Fedora - 6%
  • Nobara - 3.6%
  • Bazzite - 3.1%

Totaling to 12.7% this time. And thus, it('s at least likely to) constitute the majority of the "Other" category.

[–] HayadSont@discuss.online 3 points 2 days ago (5 children)

But how is it a security nightmare? Or did you mean "distraction", but chose to use "nightmare" for -I suppose- exaggeration (or similar/related reasons)?

doesn’t matter if you downloaded malicious code

Hmm..., please help me understand: say, I installed a flatpak that included malicious code. But, it required some permission to enact upon its maliciousness. Which, it never received. And thus, if my understanding is correct, it couldn't enact upon its maliciousness. How didn't Flatpak's security model not matter in this case? Apologies if I sound obnoxious (or whatsoever)*, but I'm genuinely trying to understand your case.

[–] HayadSont@discuss.online 2 points 2 days ago* (last edited 2 days ago) (3 children)

Thanks for sharing your experiences! As much as I absolutely love and favor 'immutable'/atomic ~~"Doritos"~~ distros over their traditional counterparts, I can't but accept the reality that it's not (prime-time) for everyone (yet). Though, I do wonder what put you off (specifically). Would you mind sharing it?

Anything needing deeper access or only available in package form, I’ve been able to run in boxes.

I assume you're referring to distroboxes and not to (GNOME's) Boxes used for running VMs.

[–] HayadSont@discuss.online 2 points 2 days ago* (last edited 2 days ago) (7 children)

Its a security nightmare

How so? Doesn't its sandbox offer superior security (under most circumstances) over most other solutions? Even in its relative infancy*.

[–] HayadSont@discuss.online 2 points 1 week ago (1 children)

Apologies for my ignorance, but what's OST?

 

collapsed inline media

Included is the following disclaimer by the author:

  • This may not be representative of all types of Linux users. I’m sure this is not what your AWS engineer uses on EC2.
  • This may not be completely representative of all Linux gamers either. But I’d wage this is actually a good predictor where the market is going to shift. We saw first that Manjaro was getting the boot here first, before going under pretty much everywhere.
  • There may be some additional biases, due to whoever used ProtonDB.
  • Flatpak is NOT a distro, but that’s what Steam reports when it’s running on Flatpak, and Flatpak being distro independent we report it as a separate environment, if that makes sense. Feel free to ignore it if you wish.
  • Arch Linux is Arch Linux on desktop. The Steam Deck’s OS is reported as HoloISO, not Arch Linux, so stop trying to claim that Arch is first because of the Steam Deck! This is mainly data reported from desktop PCs, so no, SteamOS is not a thing at the moment on such machines. This may change as Valve starts providing official support beyond the Steam Deck.
[–] HayadSont@discuss.online 1 points 1 week ago

As the person in question has remained silent, I do wonder if I could perhaps help out instead. Would you be so kind to vocalize your question(s) as elaborate as possible? Afterwards, I'll try to answer them to the best of my abilities.

[–] HayadSont@discuss.online 7 points 1 week ago (1 children)

I want my apps to be able to talk to each other. So flatpak is just in the way.

This is (at least somewhat of) a legit concern. But is mostly directed towards Flatpak's limitations in its current implementation.

Also, I don’t see the point of immutable distros. I could boot off of btrfs snapshots years ago. Immutability gives me absolutely nothing of value either

Have you ever wondered why openSUSE started working on (what would eventually become) Aeon while they had previously pioneered the BTRFS + Snapper workflow with Tumbleweed? I believe you may find the point of immutable distros in there 😉.

[–] HayadSont@discuss.online 1 points 2 weeks ago (1 children)

Your reply is much appreciated, fam! Unfortunately, I wasn't able to return right away. I thank you for your patience! Btw, I'm not native. So, if I misuse any terms/words/phrases or whatnot; my apologies. Usually, I put in some significant effort to alleviate this. Sadly, I didn't quite have the chance to do so this time. Thank you for your understanding!

Firstly, I'm glad we can have a civil discourse on this topic rather than resorting to personal attacks and namecalling. I also appreciate the fact that you seem like someone who actually wants to get to the truth rather than defending your stance no matter what.

Thanks fam for the compliments! Your engagement is (I think) (at least) equally commendable!

You're right. The people in the video are in fact publicly celebrating the 9/11 attacks which took the lives of thousands of innocent people. As you can see, it's not just grown ass men who are celebrating, but children and women too. If this is the level of hatred they have towards the United States, do I really need to explain how severe their hatred for Israel would be?

Btw, I understood the implied context of the footage. But, it would be intellectually dishonest if I didn't take into account the framing at hand. Cuz, if we were to be very critical of the footage itself (so without AP's provided text as guidance), then there's nothing explicitly there that connects those celebrations to the 9/11 killings; no burning of American flags or anything that would imply it. Granted, I assume neither of us speak Arabic. So that doesn't help either 😅.

Just to be clear, I'm well aware that this story is pretty much uncontested^[I did find this, but it seems to be a biased take.]. So I'm not actually disputing it. But, with the benefit of hindsight^[That is, the eventual wars in Iraq and Afghanistan.], it's hard to completely deny any ulterior motives for broadcasting said celebrations.

And to push back: is it sociologically-speaking strange for them to be glad that the biggest support of their rivals has received a retribution?

That's an easy question to answer. There would be one country and it would be called Palestine.

History has indeed taught us that that^[Nation states only exist since relatively recently. So, there has never been a Palestinian state or something. However, Muslim rule has dictated over those lands. My reading of history informs me that while Jews definitely weren't first-class citizens, they were fortunately not persecuted like we saw in other parts of the world.]'s a pretty likely outcome. But, I was also curious to hear your take on the other question. Namely, "What would become of the Israeli people?".

But they will be celebrating.

Likely indeed.

And they will want the whole world to see them celebrating. That's for sure.

For this, I'm not so sure. But it could be.

https://en.m.wikipedia.org/wiki/Dolphinarium_discotheque_bombing#Aftermath

Ah, another celebration. I'm starting to notice a pattern :P .

https://www.youtube.com/watch?v=cWOw7YI7vzo

Another one.

https://www.youtube.com/watch?v=0xPNTbtUHVc

This video I didn't pay a lot of attention to as the media outlet didn't seem to be as reliable as I'd like.

https://www.youtube.com/watch?v=c-wyW-7iJwU

I think I got the message by now :P .

Again I want to be very clear that I'm not an Israeli sympathizer. I'm just trying to make a point that the Palestinians aren't the saints that the liberals (btw I'm a liberal myself) often portray them to be.

If sainthood is achieved through suffering alone, then I'd argue they would make a good chance. But yeah, I get where you're hinting at.

 

A video by SavvyNik that covers some of the highlights from the following recently published scientific article - Wolves in the Repository: A Software Engineering Analysis of the XZ Utils Supply Chain Attack

 

Fellow open-source enthusiasts,

We all have that mental backlog of promising projects — those distros, tools, and systems we keep tabs on but haven't yet deployed. Perhaps you're waiting for that mythical free weekend, lacking a spare/compatible device or just holding out until that one killer feature drops.

FWIW, my 'someday' list includes:

Operating Systems/Distros:

  • Gentoo – Source-based meta-distribution driven by Portage and USE-flags for near-granular control; binary packages also available if you'd rather skip marathon compile sessions.
  • Guix System – GNU's functional, declarative distro built with Guile Scheme.
  • MocaccinoOS – Image-based, container-built distro that originated from Gentoo/Sabayon but now uses the Luet package manager and OTA-like updates.
  • NixOS – Declarative Linux distribution using the Nix package language.
  • Qubes OS – Security-focused OS that uses Xen virtualization to compartmentalize your digital life into isolated environments with a unified desktop.
  • Spectrum – In-development security-oriented OS built on Nixpkgs using KVM-based microVMs for compartmentalization.

Desktop Environments/Window Managers:

  • COSMIC - System76's comprehensive Wayland-native desktop environment written in Rust.
  • Hyprland – Dynamic tiling Wayland compositor with scriptable layouts and impressive animations.

System Security/Firmware:

  • coreboot – Open source alternative to proprietary BIOS/UEFI firmware (though recent x86 still needs vendor blobs such as FSP/AGESA).
  • Heads – coreboot + Linux payload providing TPM-measured, tamper-evident boot for select laptops.
  • nix-mineral - NixOS module for convenient system hardening.
  • TrenchBoot – Framework for dynamic root-of-trust (DRTM) launches via Intel TXT, AMD SKINIT, or SEV-ES.

Applications/Tools:

  • Android Translation Layer - Run Android apps natively on Linux (still in early development).
  • Emacs – The self-extensible Lisp machine masquerading as a text editor; someday I'll embrace the config rabbit hole.
  • Olive – FOSS non-linear video editor in alpha.
  • systemd-sysext – Overlay read-only /usr and /opt (or /etc via confext) with extra images; extensions auto-activate at boot or can be merged/unmerged/refreshed live with a single command. Handy for immutable distros, though it’s additive-only and not a full package manager.

What open-source projects are you admiring from afar? Time to compare notes!

 

While this is an especially great development for the Fedora Atomic aficionados among us, I wouldn't be surprised if we'll be hearing a lot more from sysexts as (yet another) avenue for installing software, particularly on other atomic/immutable distros. The concept itself isn't new - Flatcar has been utilizing this approach for some time (and has been a significant influence on this Fedora initiative).

The gist would be that it basically allows installing software natively without the traditional rpm-ostree layering method. This approach eliminates both the lengthy installation times and reboot requirements typically associated with that process. Though, it doesn't seem to completely replace the conventional method as it comes with certain limitations (as per the developer):

They can not be used to:

  • install another kernel
  • install kernel modules
  • make changes to the initrd
  • make changes to /etc
  • add udev rules

For those wondering what is actually envisioned to be installed using this method, the software that's already available may shed some light 😉.

In any case, note that this is FAR from its final form. The (relative) complexity currently involved in installing and updating software reflects this clearly; don't expect shiny wrappers that will make all of us blissfully ignorant of the underlying complexity right away 😜.

 

Look, I've only been a Linux user for a couple of years, but if there's one thing I've learned, it's that we're not afraid to tinker. Most of us came from Windows or macOS at some point, ditching the mainstream for better control, privacy, or just to escape the corporate BS. We're the people who choose the harder path when we think it's worth it.

Which is why I find it so damn interesting that atomic distros haven't caught on more. The landscape is incredibly diverse now - from gaming-focused Bazzite to the purely functional philosophy of Guix System. These distros couldn't be more different in their approaches, but they all share this core atomic DNA.

These systems offer some seriously compelling stuff - updates that either work 100% or roll back automatically, no more "oops I bricked my system" moments, better security through immutability, and way fewer update headaches.

So what gives? Why aren't more of us jumping on board? From my conversations and personal experience, I think it boils down to a few things:

Our current setups already work fine. Let's be honest - when you've spent years perfecting your Arch or Debian setup, the thought of learning a whole new paradigm feels exhausting. Why fix what isn't broken, right?

The learning curve seems steep. Yes, you can do pretty much everything on atomic distros that you can on traditional ones, but the how is different. Instead of apt install whatever and editing config files directly, you're suddenly dealing with containers, layering, or declarative configs. It's not necessarily harder, just... different.

The docs can be sparse. Traditional distros have decades of guides, forum posts, and StackExchange answers. Atomic systems? Not nearly as much. When something breaks at 2am, knowing there's a million Google results for your error message is comforting.

I've been thinking about this because Linux has overcome similar hurdles before. Remember when gaming on Linux was basically impossible? Now we have the Steam Deck running an immutable SteamOS (of all things!) and my non-Linux friends are buying them without even realizing they're using Linux. It just works.

So I'm genuinely curious - what's keeping YOU from switching to an atomic distro? Is it specific software you need? Concerns about customization? Just can't be bothered to learn new tricks?

Your answers might actually help developers focus on the right pain points. The atomic approach makes so much sense on paper that I'm convinced it's the future - we just need to figure out what's stopping people from making the jump today.

So what would it actually take to get you to switch? I'm all ears.

view more: next ›