Skip Navigation

InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)M

moonpiedumplings

@ moonpiedumplings @programming.dev

Posts
21
Comments
418
Joined
3 yr. ago

  • ‘No Way To Prevent This,’ Says Only Package Manager Where This Regularly Happens

    Jump

  • I disagree. There are many process failures and areas where security can be improved, independent of trusting a distro maintainer or developers.

    For example, 2FA should probably be enforced for the process of publishing packages. It does appear to be enforced for new packages but older packages still have legacy settings. Github now forces 2fa for basically everything, and they applied that even to existing organizations and repos. There is no real reason that NPM (owned by Github) isn't able to do the same.

    Or another example, is sandboxed builds. Many of these packages, like NPM and Rust packages, have build time scripts, which are executed unsandboxed at compile/install time of these programs. That is how these NPM worms have been so pervasive. You don't have to actually run the javascript package for it to do bad things, just merely installing it.

    On the other hand, the build systems that distro's use, often involve sandboxing the builds to limit the attack surfaces (including limiting network access). Although, Linux distros usually rip out build scripts and build systems in order to replace them with their own, but this also further limits the code you have to audit.

    Even better is to sandbox the program itself to further limit harm but that's not done on Linux distros and is somewhat outside the scope of this discussion.

    If you are an NPM developer, I recommend Deno, with it's built in, on by default sandboxing... that people like to disable. But it's there and is better than giving random NPM package #245 access to your home directory. You could also use podman or docker but yeah.

  • Proxmox Homelab - Docker Swarm Still Viable? Using Different Distros as VMs?

    Jump

  • Hello, I also run k3s on a single node here.

    Yes, it is more complex in some ways. But what I love about kubernetes, is the helm package manager and it's ecosystem, that makes it easier to user packages from other people and organizations.

    They can be searched here: https://artifacthub.io/

    There are many that you may be interested in, like forgejo.

    The big thing I like about helm vs docker-compose, is helm is another layer on docker-compose. If an app receives an update that causes it to need another service/container deployed, that will be reflected in the helm release, which orchestrates containers. But with docker-compose, you would have to manually update the config file format in order to handle such changes.

    Because this setup is more resilient, I actually just auto update all my apps to the latest version on kubernetes, and this is one of the big reasons why I use kubernetes instead of docker. Yes, things do occasionally break, but they mostly break in predictable, easy to handle ways like "config option changed" or "database needs migration". Plus backups/snapshots to ensure if there is a bug or something I can simply roll back.

  • ‘No Way To Prevent This,’ Says Only Package Manager Where This Regularly Happens

    Jump

  • One of the biggest difference is package signing, which is often multi party where multiple developers review changes and coordinate uploads.

    There are others, like how Debian and Red Hat essentially maintain forks of software which they only apply cherry picked security updates to. This blocked the XZ utils backdoor, for example. Debian Unstable, Arch, and other distros which shipped newer versions of software got the backdoor. But not Debian Stable and Red Hat.

    I wrote a long post here, in which I go more in depth: https://programming.dev/post/48171483/23081855

  • ‘No Way To Prevent This,’ Says Only Package Manager Where This Regularly Happens

    Jump

  • Not linux distro package managers.

  • ‘No Way To Prevent This,’ Says Only Package Manager Where This Regularly Happens

    Jump

  • Yes. Install scripts. But also pypi started enforcing 2fa for package pushes, which helps a lot.

  • Removed

    Do you have advice as to where to find hardware to practice?

    Jump

  • Hyper V is bare metal. Hyper V is a type one hypervisor. The hyper v kernel runs under the windows kernel, when you run hyper v, the windoss you interact with is transparently converted into a VM, with all devices passed through to it.

    Anyway the tools to manage hyper v aren't anywhere near as mature compared to proxmox and it's a pain when you hit corner cases so I wouldn't recommend it, BUT it is a type 1, highly performant hypervisor.

  • Do not remove my spam

    Jump

  • I agree with OP. They're basically asking that you should be allowed to promote open source, freely available solutions to problems people might have.

    It's a lot different from an ad since it's ultimately well intentioned. Of course there might be caveats like not actually being open source or doing a rugpull im the future. But, those can be handled.

    I'm so tired of people never even having heard of lichess, or linux, or other foss tools because the marketing for windows and chess commis so aggressive. Most people on lemmy may not realize this, since I suspect we have a uniquely high population of adblock users, on a social media platform with no ads. But regular users, even ones who may be using github, sort of live with in that bubble, and only know about xyz tool because they saw an ad or youtube recommended it to them or whatever.

    edit: though I do think they were kinda pushy in the issue linked after users told them no in criticized it for being too new. But ultimately, without that issue people wouldn't even know about their project.

  • How to balance work, career development and personal projects

    Jump

  • I don't really like big streamers, I only watch small streamers that read every message. I like to ask questions of experienced users and help less experienced users.

    I watch a bunch and find them by tag.

    Like here is the linux tag: https://twitch.tv/directory/all/tags/linux

    https://twitch.tv/directory/all/tags/cybersecurity

    And then the software and gamedev category (categories are how twitch groups games):

    https://twitch.tv/directory/category/software-and-game-development/

    I usually watch them to the side while I work on personal projects.

  • Heavy Community Backlash Blocks Fedora's AI Developer Desktop Initiative

    Jump

  • This doesn't need a software solution. One of the reasons why I like link aggregators (which lemmy is) is because posters can de editorialize post titles, removing clickbait.

    Instead of "Linus SLAMS psycho for DARING to suggest C++ in the kernel" the title can be replaced with "Linus explains why C++ is not suitable for the Linux kernel" when they post it.

    But people don't really do this, and people get mad at people who do this sometimes.

    Of course, then people can inject bias in their titles. But I would rather not have clickbait.

  • How to balance work, career development and personal projects

    Jump

  • Not a real auggestion I guess but you can watch people doing software/game dev, cybersecurity, or linux stuff on twitch.

    It's live and not educational focuses, so it's entertaining, but I have learned a lot from these streams over the years.

  • Removed

    Does anyone use a YubiKey?

    Jump

  • I have a VPS which hosts some stuff and I just e2ee all the data. Syncthing sync is e2ee and Joplin sync is e2ee. But lots of services don't support e2ee, or e2ee gets in the way of UX and nice features so we make a tradeoff.

    As for LUKS, I guess a good solution is to have a VPS or public device somewhere that shares the encryption key with the server (but only after it gives the correct password) but only to the correct IP address of your server.

    The router solution someone mentioned below is similar.

  • Are there actually good clients for mailing lists? [Answered: No]

    Jump

  • Are there actually good clients for mailing lists? [Answered: No]

    Jump

  • Are there actually good clients for mailing lists? [Answered: No]

    Jump

  • Oh yeah lmao it appears there are no indents on mobile.

  • Are there actually good clients for mailing lists? [Answered: No]

    Jump

  • The best thing I have found is this software, mailman. Check out an example: https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack.org/thread/GTPTFUPXXBDMWNQZGZDLM2IIX4FSTT5Y/

    It lets you view discussions as threads on a website, and then you when click reply, it gives you the option to reply using your email software. This is a really neat way to do it, although the UI definitely looks rough compared to lemmy. But it might be a better way to do email, where you literally just present it via a forum website but all "posts" and "comments" are handled by your email client.

    Or mailman lets you sign in and reply via the software itself, but idk if they are actually using that.

  • Installing Debian 13 (Trixie) with BTRFS

    Jump

  • Woops it was a slip of the tongue. Keyboard?

  • Podcasts/Classes/Breakdowns of Use & Basic Knowledge?

    Jump

  • My favorite, the most comprehensive course I have seen this this one: https://professionallinuxusersgroup.github.io/course-books/lac/syllabus/

    Most knowledge is transferable to most distros. Some distros deviate by using alternate init systems (the part responsible for booting the system and managing services), but most distros use the same underlying suite of software to manage it.

    On diference between distros is the package manager, but although the commands may be different, the underlying operations of installing, searching for, and removing software packages are all the same.

  • Installing Debian 13 (Trixie) with BTRFS

    Jump

  • If you want Debian, my recommendation is to install Linux Mint Debian Edition, which is based on Debian, rather than Ubuntu. Save for some extras focusing on usability/UX/UI, it uses Debian's repos.

    Linux Mint is the team behind the timeshift tool in the first place: https://github.com/linuxmint/timeshift , so you can be assured there is first class support.

    If you want something more up to date, I would recommend Opensuse tumbleweed, yes, although they use snapper instead.

    And if you download an RPM for a 3rd party driver (like the printer for example) chances are there will be unmet dependencies because it was meant for Red Hat.

    I have never needed to download a driver for a printer on any Linux distro. Most of the time it just works using IPP (built in thing). Downloading drivers for printers is a Windows thing, in my experience.

  • Installing Debian 13 (Trixie) with BTRFS

    Jump

  • These repos are targeted towards red hat enterprise linux, which is also dnf based, but has vastly different versions of packages than fedora, and is a much more stable distro.

    The same way you wouldn't want to mix apt repos of different distros, you wouldn't want to use repos designed for Red Hat, for Fedora.

    Nvidia does seem to provide Fedora repos, but I would recommend following Fedora's official docs and getting them from rpmfusion, unless there is something you specifically need from Nvidia's repos.