udev4096

Stop encouraging centralization and non-private web. Cloudflare's famous mitm also puts everyone's data under their watch. Remember how cloudflare leaked secrets in 2017 on every major search engine?

Which is why you mirror your small blog across multiple networks. Use Tor, I2P, etc. Most blogs are git repos so it's very easy to distribute it

e/OS is a joke: https://www.kuketz-blog.de/e-datenschutzfreundlich-bedeutet-... and https://community.e.foundation/t/service-announcement-26-may... are sufficient to conclude that

Lineage is better and Graphene is obviously the gold standard which provides better privacy and security for normal people. The author is wrong in thinking you gotta be some journalist to use it. GrapheneOS is for everyone

I would never recommend this article for anyone looking for comparison. It's wrong in so many ways. Your opinions are highly biased and it's an extremely poor attempt to make GrapheneOS look bad. For a factual and technical comparison, I would suggest this blog post series: https://www.kuketz-blog.de/android-grapheneos-calyxos-und-co...

It's well written and focuses on facts rather than poorly made assumptions

A good reminder for advancing decentralization and p2p networks!

Yeah, I was shocked. Disbelief that the host was up, which is what usually happens when the cloudflare's page show up

Would be funny if it was a record breaking ddos on cloudflare

"My opinions are universal fact and not a skill issue"

Using luks to encrypt all partitions (incl. /boot) and it's only unlocked using yubikey. I have secureboot enabled (sbctl to enroll keys) and TPM PCR values to avoid tampering. systemd-boot (a lot more secure than grub) doesn't have password to lock the kernel editor so I have disabled the editor altogether. I use fapolicy for "whitelisting" apps. Unfortunately, coreboot doesn't have BIOS password feature so it's unlocked

What a cope. The hardening options highly restrict the unit files from accessing anything more than it's required for it's function. systemd has also made a lot of efforts in progressing the boot security: https://0pointer.net/blog/brave-new-trusted-boot-world.html. Have fun running your "non-infected" systems which is so easy to pwn

Least sane systemd hater, try using runit or sysvinit on a production system and come back crying when your runit bash scripts fail all the time

systemd scales. I love small init systems but systemd is just so convenient. It handles daemon process, encryption with cryptsetup, boot process (systemd-boot), hardening options you can define on unit files, good support for nested containerization etc. It's deeply entrenched in every major distro that it's impossible to administer a linux system without it

Average HN user has happily chugged the sugar coated propaganda from valve, which paints them as a saint which they clearly aren't

Most modern "AAA" games are meant to hook you up. It's an addictive cycle, most games are also only on steam which means steam owns you. It has profiled you, your voice chats, your friends, your game habits, etc. If you'd think for even a minute, you'd realize what a shitshow modern gaming is. It's nothing but a masqueraded attempt for mass surveillance from steam and other major game stores

I highly doubt it. Maybe not at the surface level but if you dig, you'll always find the dirt on any for-profit endeavor

> You don’t have time to play games anyway.

Yes. Games are a complete waste of time and the sooner you realize it the better

Valve is still evil, just like any for-profit tech corps. They have made a fortune in csgo gambling boxes

IncusOS is different. You can use incus itself on all the major distros: https://linuxcontainers.org/incus/docs/main/installing/

Incus was an LXD fork in the very beginning but it's evolved a lot since then. Incus is far superior than LXD in number of ways

Profiles are really great. It's like cloud-init on steroids

It's a lot more than that. Clustering, storage drivers, networking, etc makes up a whole virtual machine manager. It never says it's a hypervisor, it's a VMM as outlined on it's github: "Powerful system container and virtual machine manager"

I have switched to incus and it's really great. It's lightweight, has a working terraform provider, easy-to-use cli, pre-built images (LXC and VM) of major distros (while in proxmox, you have to create templates all the time for VMs), runs on any distro (on proxmox, you're stuck with debian), clustering is nice, supports bunch of storage drivers (dir, btrfs, ceph, zfs), simple web UI and active community. The project leader is also very active and helpful while in proxmox, it's a little unresponsive. You can even install `incus-base` package which only contains LXC specific components for only running LXC containers.

I have noticed incus has better security configs by default. For instance, all pre-built images come with secureboot enabled and there are ACLs which are easy to configure for fine-grained network rules. The only downside I feel like is lack of something like PBS

MBAs need to read this: https://geohot.github.io/blog/jekyll/update/2025/10/15/pathe...

tldr; GTFO!

Agreed. It's just a classic way to manipulate the viewers. They just wanted to sound edgy for not paying a ransom, which is definitely a good thing. Never pay these crooks but you left a legacy system online without any protections? That's serious

There are definitely companies who have never been breached and it's not that hard. Defense in depth is all you need

Since when did owning up to a data breach become such a noteworthy event? Less than 25% sounds more like exactly 25% of impacted customers

I would highly suggest to block JS while you're only browsing. It loads fast, most trackers won't load and better security as most browser exploits leverage JS all the time

Docker is not a sandbox, IT'S NOT! If you must, use gvisor or kata runtime for actual sandboxing

bubblewrap escapes are not unheard of. Infact, it's a common theme that the general linux landscape lacks strong sandboxing, even if you use bwrap, firejail, etc. Especially linux desktop, a security firehazard to say the least unless you are using QubesOS

distrowatch? lmao. no wonder you took the pill and i am not surprised with the omarchy's userbase, it's full of normies anyway and couldn't care less