• 0 Posts
  • 42 Comments
Joined 6 months ago
cake
Cake day: January 5th, 2024

help-circle



  • Tiny 11 comes in two variants:

    Tiny11 Core is not suitable for use on physical hardware as it outright disables updates. It’s best used for short-term VM instances.

    Tiny11 also has problems with updates. The advantages gained through Tiny11 will erode with applying Windows updates. The installer is more tolerable than Windows 11 by not forcing an online account (but still needing to touch telemetry settings). Components like Edge and One drive will inevitably rebuild themselves back in with cumulative updates. If this is something that coerces you to not update your system, don’t subject yourself to using Tiny11. Additionally Tiny11 fails to apply some cumulative updates out of the box, which could be a further security risk.

    I recently tested the main Tiny11 in a VM based on a different user recommending it in a now deleted thread. I was skeptical knowing the history of Tiny10 onward that 11 would actually be able to update properly, and NY findings backed up my initial skepticism of functional updates.





  • The worst gotchas and limitations I have seen building my own self-host stack with ipv6 in mind has been individual support by bespoke projects more so system infrastructure. As soon as you get into containerized environments, things can get difficult. Podman has been a pain point with networking and ipv6, though newer versions have become more manageable. The most problems I have seen is dealing with various OCI containers and their subpar implementations of ipv6 support.

    You’d think with how long ipv6 has been around, we’d see better adoption from container maintainers, but I suppose the existence of ipv6 in a world originally built on ipv4 is a similar issue of adoption likewise to Linux and Windows as a workstation. Ultimately, if self-rolling everything in your network stack down to the servers, ipv6 is easy to integrate. The more one offloads in the setup to preconfigured and/or specialized tools, the more I have seen ipv6 support fall to the wayside, at least in terms of software.

    Not to mention hardware support and networking capabilities provided by an ISP. My current residential ISP only provides ipv4 behind cgnat to the consumer. To even test my services on ipv6, I need to run a VPN connection tunneling ipv6 traffic to an endpoint beyond my ISP.



  • jrgd@lemm.eetolinuxmemes@lemmy.worldonly as in free beer
    link
    fedilink
    English
    arrow-up
    1
    ·
    27 days ago

    If that is the case, the developer should have likely noted otherwise before closing the issue as the final piece of discussion. That is good to know that your experience hasn’t dropped the OS into base Windows 11. If as you say is true, the developer should also really spend some time cleaning up the README and clarify that base Tiny11 can actually be updated in-OS. I will still test in a VM later today to confirm that Tiny11 doesn’t actually erode or degrade on update for myself.


  • jrgd@lemm.eetolinuxmemes@lemmy.worldonly as in free beer
    link
    fedilink
    English
    arrow-up
    4
    arrow-down
    1
    ·
    edit-2
    26 days ago

    From the Github README:

    Also, for the very first time, introducing tiny11 core builder! A more powerful script, designed for a quick and dirty development testbed. Just the bare minimun, none of the fluff. This script generates a significantly reduced Windows 11 image. However, it’s not suitable for regular use due to its lack of serviceability - you can’t add languages, updates, or features post-creation. tiny11 Core is not a full Windows 11 substitute but a rapid testing or development tool, potentially useful for VM environments.

    It literally says that it cannot be updated from a built OS install. You need to reinstall tiny11 by rebuilding the install image with a newer Windows 11 base image. Obviously it would be best to do this every time there is a security patch release for Windows 11.

    EDIT: Rereading further, the bigger Tiny11 image might be able to be updated in-OS. I’m going to dig through the ps1 scripts to see if the README holds up to that un-noted capability.

    EDIT2: I don’t see any registry edits that knock Windows Updater offline. I’ll test it in a VM to see if things work (from prebuilt when it eventually downloads). Though I am unsure at this moment if such an image’s changes will survive a Windows update at all.

    EDIT3: VM not tested yet, but an issue on the GitHub seems to corroborate my initial assumption.

    EDIT4: VM tested. Things claimed to be patched out (Edge) came back with one of the cumulative updates applied shortly after install. Other cumulative updates are being blocked (error instantly on attempt to install after download) (perhaps unintentionally). Image downloaded claimed to be for 23H2, but Windows 11 22H2 was installed, seemingly with no way to actually upgrade. I think my point stands.


  • jrgd@lemm.eetolinuxmemes@lemmy.worldonly as in free beer
    link
    fedilink
    arrow-up
    10
    arrow-down
    1
    ·
    edit-2
    27 days ago

    Do note that this system is liable to leave your computer vulnerable as it has no way to update itself from within the OS.

    This image would be fine for booting short-term VMs as long as you periodically rebuild and reinstall it, but not ready for consumer use.


  • Based on how the script /usr/lib/kernel/install.d/99-grub-mkconfig.install (a script that runs on kernel installations) behaves, unless you are running in Xen Hypervisor or are on an architecture that doesn’t support it, Fedora by default expects to have GRUB_ENABLE_BLSCFG set to true. This script is provided by the package grub2-common, so it’s unlikely it can be removed without removing the GRUB bootloader’s management system entirely.

    More than likely, most customizations will work just fine with GRUB_ENABLE_BLSCFG set to true as long as you properly run grub-mkconfig (or just update-grub) after you make those changes so that they get applied to the bootloader portion of GRUB itself.

    If for some reason you do absolutely need to disable BLS in order to get the customization you want, the proper way to enforce grub-mkconfig on new kernels would be to write a script in the /usr/lib/kernel/install.d/ directory titled like 98-grub-manual-mkconfig.install that would forcibly run the proper mkconfig command after kernel installation and initramfs generation.



  • Checking inside /usr/lib/kernel/install.d/, you can see the mechanisms in place for installing new kernel entries. Not knowing what you did to your config (did you back it up before making changes?), you should check if the entries are being populated properly in /boot/loader/entries/. If they are, you have likely toyed with the BLS config in some way that broke being able to load dynamic entries without mkconfig.

    If that is indeed the case, I wouldn’t know exactly what you touched to break it, but this discussion forum might give some insight.

    If this isn’t the problem, it might be helpful to post your grub config minus any sensitive details to help determine what is going wrong.



  • jrgd@lemm.eetoLinux@lemmy.worldAre we (linux) ready for Arm devices?
    link
    fedilink
    English
    arrow-up
    12
    arrow-down
    1
    ·
    edit-2
    2 months ago

    Beyond the article being ancient at this point (in terms of AOSP and Android development lifetime), Stallman’s argument boils down to the same talking points of Free Software purism.

    To the first real point being transformed here: Android is not GNU/Linux because it does not contain much of the GNU Project’s software. While it’s correct to claim it’s not GNU/Linux, how does it not make it Linux still? Is Alpine Linux not considered “Linux” because it doesn’t contain GNU? Please elaborate on this point of Linux being Linux because it has GNU.

    To the second point of including proprietary drivers, firmware, and appplications: we once again meet the questionable argument of transforming an OS to something else. Points are made that Android doesn’t fit the GNU ideals due to its usage and inclusion of proprietary kernel modules, firmware, and userland applications. These are valid points to be made in that these additions muddy the aspect of Android (as packaged by Google and major smartphone manufacturers) being truly free software. However the same can be said about traditional “GNU/Linux distributions”. Any device running on x86 (Intel, AMD) will be subject to needing proprietary firmware in order to function with that firmware having a higher control level than the kernel itself, just as Android would. There is also the note that while it is less necessary now to have a functioning desktop, a good portion of hardware (NVidia, Broadcom, Intel, etc.) require proprietary kernel modules and/or userland drivers in order to have full functionality that the average user may want. Finally, there is proprietary applications as well. Some Linux desktops include proprietary applications like Spotify, Steam, Google Chrome by default. Are we really to also exclude an overwhelming majority of the biggest Linux distros as Linux as well being that they include proprietary software or rely on proprietary code in some fashion? GNU itself lists very few distros as GNU-approved.

    To note, AOSP does have a different userland environment than your standard Linux distro running X11 or Wayland. That is by far the best reason I could think of to classify Android as a different category of ‘Linux’ from say Debian, Fedora, OpenSUSE, Arch, Gentoo, Slackware, and others. However, AOSP is still capable of running with no proprietary userland software and can even be made to still run cli applications as well as run an X11 server that is capable of launching familiar desktop Linux applications. I really think that the arbitrary exclusion of Android from being Linux by virtue that RMS doesn’t think it fits with GNU ideals is silly. If there are better arguments to be said for why Android (especially AOSP) shouldn’t be seen as Linux with a different userland ecosystem rather than not Linux entirely, I’d love to see them. However, I remain unconvinced so far.



  • I have been utilizing BunkerWeb for some of my selfhost sites since it was bunkerized-nginx. It is indeed powerful and flexible, allowing multi-site proxying, hosting while allowing semi-flexible per-site security tweaks (some security options are forcibly global still, a limitation).

    I use it on podman myself, and while it is generally great for having OWasp CRS, general traffic filtering targets and more built on top of nginx in a Docker container, the way Bunkerweb needs to be run hasn’t really remained stable between versions. Throughout several version upgrades, there have been be severe breaking changes that will require reading the setup documentation again to get the new version functional.


  • A few things Fedora centers itself around:

    • Wayland-oriented Workstations
    • SELinux support OOTB
    • BTRFS as default filesystem
    • General attitude toward using close to bleeding edge packages as defaults
    • Package order of Fedora rpm repos, Fedora Flatpak -> RPMFusion, Flathub -> copr -> external installation
    • Immutable variants of Fedora exist for the major desktops


    Fedora generally prides itself on being a Wayland-focused and oriented workstation distro. There is still active support for desktop environments/window managers that run on Xorg, but you should consider moving toward a Wayland-supporting environment (Gnome, KDE, Sway, Hyprland).

    SELinux (a Mandatory Access Control system) is enabled by default and has pretuned policies installed that should support most use cases out of the box. SEApplet is a useful utility to find active SELinux denials in case an application is getting permission denied issues for seemingly no reason.

    If you intend to use BTRFS as your filesystem of choice and want to utilize it to its fullest (encrypted partitions, subvolume encryption, automatic snapshots), it is best to read up how BTRFS and subvolumes work before partitioning so that your subvolumes will be correct the first time. It can be tedious to edit subvolumes, move their contents, and remount portions of the filesystem after they have already been populated.

    I’m sure you’re used to how things on Arch with bleeding edge works, and understand that on Arch you should always read patch notes before updating. Generally, updates on Fedora are fine to just push through. It is worth generally reading what is new when performing system upgrades to a new version of Fedora, I have noticed occasionally in over five years of usage the first target release of a new version of Fedora can sometimes have breakages that tend to get fixed within the next couple of weeks. There is extensive testing for system upgrades that can be openly viewed, but the testing doesn’t always catch everything before a new release.

    By default, the best way to grab packages on Fedora is from the official repos or from the Fedora Flatpaks. Barring that or if you aren’t satisfied by a default package for whatever reason (some stuff in default repos doesn’t have ffmpeg support or others due to codec licensing issues), you can add the second-party RPMFusion repos or add Flathub to grab additional or alternative packages as well. If those avenues fail, you might be able to find someone maintaining the package you need or want to test on Copr, which is essentially like Ubuntu’s Launchpad PPA platform. Barring all else, you could manually install a given application externally, though obviously this typically isn’t the best solution in most cases. Some cases where you might want RPMFusion packages are for things like audacity-freeworld, which includes proper ffmpeg support for Audacity. This package comes from rpmfusion-free. Or you might want something like akmod-nvidia to install the proprietary NVidia drivers or steam to install Steam. These packages come from rpmfusion-nonfree. Also, if you are not familiar with Flatpak, it might be worth becoming familiar with how it works (Flatseal is an excellent application that lets you modify how certain Flatpaks are sandboxed).

    Immutable variants of Fedora (Silverblue, Kinoite, Sway Atomic, Budgie Atomic) also exist and provide an immutable base image that won’t typically get modified across boots. Most of the custom user installation of programs is intended to be installed via Flatpaks (Fedora or Flathub) or through using toolboxes to create sandboxed environments for certain workflows. If you absolutely need to rebase the system image with extra utilities, rpm-ostree is available to modify the system package selection, though this method is not recommended to just be used to install everything (needless rebasing of the immutable image defeats the point of using an immutable distro). Obviously these spins aren’t for everyone, but are there for those who want to use them.