-
-
Notifications
You must be signed in to change notification settings - Fork 210
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
New Linux page #491
New Linux page #491
Conversation
✅ Deploy Preview for privacyguides ready! 🔨 Explore the source changes: 5ca6903 🔍 Inspect the deploy log: https://app.netlify.com/sites/privacyguides/deploys/62373a6830a24e0008ede361 😎 Browse the preview: https://deploy-preview-491--privacyguides.netlify.app/android |
I'm still not really convinced of labeling Fedora as a beginner friendly distro, while the community itself describes it as a distro for developers. And people can easily notice that they're not targeting beginners with their bleading edge distro, their vanilla gnome and no non-free software up until Fedora 34/35. It's just not their philosophy. |
What would you recommend then? |
_data/operating-systems/linux-desktop-immutable/1_fedora-silverblue.yml
Outdated
Show resolved
Hide resolved
<p>Using a distribution that stays close to upstream is highly recommended. Avoid distributions with frozen packages, as they are often quite behind on security updates. Debian for example famously was falling behind on Firefox-ESR updates for <a href="https://tracker.debian.org/pkg/firefox-esr">2 months</a>, in one of which their version (78) was deemed end of life by Mozilla. They also cannot keep up with Chromium updates, leading to them having an outdated package with a bunch of <a href="https://tracker.debian.org/pkg/chromium">vulnerabilities</a>. Most notably, Debian <a href="https://www.debian.org/security/faq#handling">only</a> backport security fixes that have recieved a <a href="https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures">CVE</a>. A lot of security fixes <a href="https://arxiv.org/abs/2105.14565">do not</a> recieve a CVE at all, and do not make it to an LTS distribution with this patching model. Sometimes, minor security fixes are also held back until the next release of Debian.</p> | ||
<p>Beyond just security, holding packages back and applying a bunch of backports fundamentally just does not work that well. <a href="https://rootco.de">Richard Brown</a> has a really great presentation about this:</p> | ||
|
||
<iframe width="731" height="411" src="https://www.youtube.com/embed/i8c0mg_mS7U" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Obviously this needs to not be a YouTube iFrame.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't think there's any privacy issue here. We should not use specific invidious instances as they tend to be unstable. https://github.com/privacyguides/privacyguides.org/discussions/341
Using invidious doesn't "hide your IP from Google" anyway, as there are still requests to googlevideo.com, unless you use &local=true
which not all Invidio instances support.
Users do have the options of using something like yt2invidio
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I agree with dngray here. I don't see how YouTube iframes are a problem at all.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🤔 You don't see how automatically connecting people to youtube.com
is a problem? Privacy Guides does not make any third-party requests.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What we've done in the past is just hyperlink an image of the video thumbnail to invidious.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I do not like the page cluttered with YouTube iframes. Also its a third party script which shouldn't be loaded every time you load the page (many people like me block third party scripts in uBlock Origin. A hyperlink to Invidious or the YouTube video should be enough.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What we've done in the past is just hyperlink an image of the video thumbnail to invidious.
There's no reason we couldn't do that actually.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@ph00lt0 about what you mentioned #491 (comment)
What if we did something like https://stackoverflow.com/a/61630345 instead. The poster says that is GDPR compliant.
The main reason I'm not too happy with static thumbnails, is they kinda suck for mobile, can't resize etc.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
if we're not happy with the no-cookie solution, maybe we could self host a player and use the data API: https://stackoverflow.com/a/24637811
If you really want to get around all these methods and include video without any sort of iframe, then your best bet might be creating an HTML5 video player/app that can connect to the Youtube Data API (https://developers.google.com/youtube/v3/)
@jonaharagon this would mean the only connection would be to googlevideo.com which is what invidious does basically.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hmm seems using the iframe is the preferred way https://stackoverflow.com/questions/12549252/should-i-use-object-or-iframe-for-loading-a-video
_data/operating-systems/linux-desktop-immutable/1_fedora-silverblue.yml
Outdated
Show resolved
Hide resolved
<p>Using a distribution that stays close to upstream is highly recommended. Avoid distributions with frozen packages, as they are often quite behind on security updates. Debian for example famously was falling behind on Firefox-ESR updates for <a href="https://tracker.debian.org/pkg/firefox-esr">2 months</a>, in one of which their version (78) was deemed end of life by Mozilla. They also cannot keep up with Chromium updates, leading to them having an outdated package with a bunch of <a href="https://tracker.debian.org/pkg/chromium">vulnerabilities</a>. Most notably, Debian <a href="https://www.debian.org/security/faq#handling">only</a> backport security fixes that have recieved a <a href="https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures">CVE</a>. A lot of security fixes <a href="https://arxiv.org/abs/2105.14565">do not</a> recieve a CVE at all, and do not make it to an LTS distribution with this patching model. Sometimes, minor security fixes are also held back until the next release of Debian.</p> | ||
<p>Beyond just security, holding packages back and applying a bunch of backports fundamentally just does not work that well. <a href="https://rootco.de">Richard Brown</a> has a really great presentation about this:</p> | ||
|
||
<iframe width="731" height="411" src="https://www.youtube.com/embed/i8c0mg_mS7U" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Under GDPR are actually not allowed to do this, without permission of visitor because you place tracking cookies without consent.
I think repology should be cited, considering that it can be used to rank distros by updated packages percentage. In particular when Fedora is claimed to be a very updated distro or in other places. |
b43d748
to
e928b25
Compare
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
Going to remove mention of grsecurity, it's not free, you need a subscription. I'm not really sure that it is relevant these days. |
Both of those are subscriber links so I'll try find alternatives. |
I'm not sure this is the case. https://en.opensuse.org/SDB:Encrypted_root_file_system I have completed encrypted boot on Archlinux with GRUB, and let me tell you that it's not a pleasant experience. Your boot time will go to minutes. It also only supports LUKS1.
The other reason I'm reluctant to mention this is, that seems to be for Fedora 33, and this is going to become dated. |
ce04f92
to
15b1e1c
Compare
We should mention there that users should not use DBAN on SSDs or NVMe disks, and this should only be for magnetic hard drivies. For SSDs/NVMes Secure ATA command should be issued. |
Co-Authored-By: Daniel Gray <[email protected]>
Co-Authored-By: Daniel Gray <[email protected]>
Co-Authored-By: Daniel Gray <[email protected]>
Co-Authored-By: Daniel Gray <[email protected]>
Co-Authored-By: Daniel Gray <[email protected]>
Co-Authored-By: Daniel Gray <[email protected]>
I like polar bears.