Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

New Linux page #491

Merged
merged 1 commit into from
Mar 20, 2022
Merged

New Linux page #491

merged 1 commit into from
Mar 20, 2022

Conversation

TommyTran732
Copy link
Contributor

@TommyTran732 TommyTran732 commented Dec 22, 2021

I like polar bears.

@TommyTran732 TommyTran732 added the c:os operating systems and related topics label Dec 22, 2021
@netlify
Copy link

netlify bot commented Dec 22, 2021

✅ Deploy Preview for privacyguides ready!

🔨 Explore the source changes: 5ca6903

🔍 Inspect the deploy log: https://app.netlify.com/sites/privacyguides/deploys/62373a6830a24e0008ede361

😎 Browse the preview: https://deploy-preview-491--privacyguides.netlify.app/android

@freddy-m freddy-m marked this pull request as draft December 22, 2021 16:21
dngray pushed a commit that referenced this pull request Dec 25, 2021
@youdontneedtoknow22
Copy link

I'm still not really convinced of labeling Fedora as a beginner friendly distro, while the community itself describes it as a distro for developers. And people can easily notice that they're not targeting beginners with their bleading edge distro, their vanilla gnome and no non-free software up until Fedora 34/35. It's just not their philosophy.
I really think you should think again about what distro should you recommend as beginner friendly.

@TommyTran732
Copy link
Contributor Author

I'm still not really convinced of labeling Fedora as a beginner friendly distro, while the community itself describes it as a distro for developers. And people can easily notice that they're not targeting beginners with their bleading edge distro, their vanilla gnome and no non-free software up until Fedora 34/35. It's just not their philosophy.
I really think you should think again about what distro should you recommend as beginner friendly.

What would you recommend then?
Also the good thing about Fedora is that they stay close to upstream, so they can get updates really, really fast. I am not keen on distros with mostly frozen packages, especially on desktop

dngray pushed a commit that referenced this pull request Dec 26, 2021
dngray pushed a commit that referenced this pull request Dec 28, 2021
jonaharagon pushed a commit that referenced this pull request Jan 1, 2022
collections/_evergreen/linux-desktop.html Outdated Show resolved Hide resolved
collections/_evergreen/linux-desktop.html Outdated Show resolved Hide resolved
collections/_evergreen/linux-desktop.html Outdated Show resolved Hide resolved
<p>Using a distribution that stays close to upstream is highly recommended. Avoid distributions with frozen packages, as they are often quite behind on security updates. Debian for example famously was falling behind on Firefox-ESR updates for <a href="https://tracker.debian.org/pkg/firefox-esr">2 months</a>, in one of which their version (78) was deemed end of life by Mozilla. They also cannot keep up with Chromium updates, leading to them having an outdated package with a bunch of <a href="https://tracker.debian.org/pkg/chromium">vulnerabilities</a>. Most notably, Debian <a href="https://www.debian.org/security/faq#handling">only</a> backport security fixes that have recieved a <a href="https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures">CVE</a>. A lot of security fixes <a href="https://arxiv.org/abs/2105.14565">do not</a> recieve a CVE at all, and do not make it to an LTS distribution with this patching model. Sometimes, minor security fixes are also held back until the next release of Debian.</p>
<p>Beyond just security, holding packages back and applying a bunch of backports fundamentally just does not work that well. <a href="https://rootco.de">Richard Brown</a> has a really great presentation about this:</p>

<iframe width="731" height="411" src="https://www.youtube.com/embed/i8c0mg_mS7U" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Obviously this needs to not be a YouTube iFrame.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think there's any privacy issue here. We should not use specific invidious instances as they tend to be unstable. https://github.com/privacyguides/privacyguides.org/discussions/341

Using invidious doesn't "hide your IP from Google" anyway, as there are still requests to googlevideo.com, unless you use &local=true which not all Invidio instances support.

Users do have the options of using something like yt2invidio

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree with dngray here. I don't see how YouTube iframes are a problem at all.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤔 You don't see how automatically connecting people to youtube.com is a problem? Privacy Guides does not make any third-party requests.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What we've done in the past is just hyperlink an image of the video thumbnail to invidious.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not like the page cluttered with YouTube iframes. Also its a third party script which shouldn't be loaded every time you load the page (many people like me block third party scripts in uBlock Origin. A hyperlink to Invidious or the YouTube video should be enough.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What we've done in the past is just hyperlink an image of the video thumbnail to invidious.

There's no reason we couldn't do that actually.

Copy link
Member

@dngray dngray Mar 20, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ph00lt0 about what you mentioned #491 (comment)

What if we did something like https://stackoverflow.com/a/61630345 instead. The poster says that is GDPR compliant.

The main reason I'm not too happy with static thumbnails, is they kinda suck for mobile, can't resize etc.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if we're not happy with the no-cookie solution, maybe we could self host a player and use the data API: https://stackoverflow.com/a/24637811

If you really want to get around all these methods and include video without any sort of iframe, then your best bet might be creating an HTML5 video player/app that can connect to the Youtube Data API (https://developers.google.com/youtube/v3/)

@jonaharagon this would mean the only connection would be to googlevideo.com which is what invidious does basically.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

collections/_evergreen/linux-desktop.html Outdated Show resolved Hide resolved
collections/_evergreen/linux-desktop.html Outdated Show resolved Hide resolved
collections/_evergreen/linux-desktop.html Outdated Show resolved Hide resolved
collections/_evergreen/linux-desktop.html Outdated Show resolved Hide resolved
@jonaharagon jonaharagon linked an issue Jan 1, 2022 that may be closed by this pull request
<p>Using a distribution that stays close to upstream is highly recommended. Avoid distributions with frozen packages, as they are often quite behind on security updates. Debian for example famously was falling behind on Firefox-ESR updates for <a href="https://tracker.debian.org/pkg/firefox-esr">2 months</a>, in one of which their version (78) was deemed end of life by Mozilla. They also cannot keep up with Chromium updates, leading to them having an outdated package with a bunch of <a href="https://tracker.debian.org/pkg/chromium">vulnerabilities</a>. Most notably, Debian <a href="https://www.debian.org/security/faq#handling">only</a> backport security fixes that have recieved a <a href="https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures">CVE</a>. A lot of security fixes <a href="https://arxiv.org/abs/2105.14565">do not</a> recieve a CVE at all, and do not make it to an LTS distribution with this patching model. Sometimes, minor security fixes are also held back until the next release of Debian.</p>
<p>Beyond just security, holding packages back and applying a bunch of backports fundamentally just does not work that well. <a href="https://rootco.de">Richard Brown</a> has a really great presentation about this:</p>

<iframe width="731" height="411" src="https://www.youtube.com/embed/i8c0mg_mS7U" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Under GDPR are actually not allowed to do this, without permission of visitor because you place tracking cookies without consent.

@Tungsten842
Copy link

Tungsten842 commented Jan 3, 2022

I think repology should be cited, considering that it can be used to rank distros by updated packages percentage. In particular when Fedora is claimed to be a very updated distro or in other places.
https://repology.org/repositories/statistics/pnewest
https://repology.org/repositories/graphs

@dngray dngray force-pushed the main branch 2 times, most recently from b43d748 to e928b25 Compare January 16, 2022 20:04
@Anish-M-code

This comment was marked as resolved.

@ph00lt0

This comment was marked as resolved.

@TommyTran732

This comment was marked as resolved.

@TommyTran732

This comment was marked as resolved.

@cloudflare-workers-and-pages
Copy link

cloudflare-workers-and-pages bot commented Jan 22, 2022

Deploying with  Cloudflare Pages  Cloudflare Pages

Latest commit: 5ca6903
Status:🚫  Build failed.

View logs

dngray pushed a commit that referenced this pull request Jan 31, 2022
dngray pushed a commit that referenced this pull request Feb 6, 2022
@dngray
Copy link
Member

dngray commented Mar 20, 2022

Going to remove mention of grsecurity, it's not free, you need a subscription. I'm not really sure that it is relevant these days.

@dngray
Copy link
Member

dngray commented Mar 20, 2022

On systems where pam_faillock is not available, consider using pam_tally2 instead.

Both of those are subscriber links so I'll try find alternatives.

@dngray
Copy link
Member

dngray commented Mar 20, 2022

If you are using openSUSE, your /boot partition should be encrypted by default should you enable drive encryption.

I'm not sure this is the case. https://en.opensuse.org/SDB:Encrypted_root_file_system

I have completed encrypted boot on Archlinux with GRUB, and let me tell you that it's not a pleasant experience. Your boot time will go to minutes. It also only supports LUKS1.

A guide for converting a normal /boot partition into an encrypted one on Fedora Workstation (not Silverblue!) can be found here.

The other reason I'm reluctant to mention this is, that seems to be for Fedora 33, and this is going to become dated.

@dngray dngray force-pushed the linux branch 4 times, most recently from ce04f92 to 15b1e1c Compare March 20, 2022 09:07
dngray pushed a commit that referenced this pull request Mar 20, 2022
@dngray
Copy link
Member

dngray commented Mar 20, 2022

@TommyTran732 @dngray I dont know if this would be worthy addition to Linux Page but many people have misconception that full disk encryption will completely erase all data stored in disk and protect against Forensic recovery of data but it seems certain old data may be recovered and might help attackers determine how much and where on the partition data was written.

We should mention there that users should not use DBAN on SSDs or NVMe disks, and this should only be for magnetic hard drivies. For SSDs/NVMes Secure ATA command should be issued.

dngray added a commit that referenced this pull request Mar 20, 2022
Co-Authored-By: Daniel Gray <[email protected]>
@dngray dngray marked this pull request as ready for review March 20, 2022 12:08
@dngray dngray changed the title (WIP) New Linux page New Linux page Mar 20, 2022
dngray added a commit that referenced this pull request Mar 20, 2022
Co-Authored-By: Daniel Gray <[email protected]>
@dngray dngray dismissed stale reviews from ghost and jonaharagon March 20, 2022 12:14

Obsolete

dngray added a commit that referenced this pull request Mar 20, 2022
Co-Authored-By: Daniel Gray <[email protected]>
Co-Authored-By: Daniel Gray <[email protected]>
@dngray dngray merged commit 5ca6903 into main Mar 20, 2022
@dngray dngray deleted the linux branch March 20, 2022 14:30
@dngray dngray temporarily deployed to production March 20, 2022 14:31 Inactive
dngray added a commit that referenced this pull request Mar 20, 2022
Co-Authored-By: Daniel Gray <[email protected]>
dngray added a commit that referenced this pull request Mar 20, 2022
Co-Authored-By: Daniel Gray <[email protected]>
@elitejake elitejake mentioned this pull request Apr 11, 2022
@dngray dngray mentioned this pull request May 24, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
c:os operating systems and related topics pr:legacy migration moving legacy content to new format
Projects
None yet
Development

Successfully merging this pull request may close these issues.

The privacy policy of NixOS is only the privacy policy of nixos.wiki