FedX

From what I can tell, the issue with Wireguard is that the traffic is quite obvious. Other options might be blocked, but technically harder to implement said blocks.

Yeah, WG is by far the best way to do this kind of networking.

That’s quite fascinating, didn’t realize Wireguard could be blocked in that way (although the WG traffic is pretty obvious looking, so it makes sense). The only solution I know of without a need for a VPS is hosting everything on Tor. Wildly private and secure, but also wildly slow. Beyond that, there are a number of ways of using a VPS to similar effect, I know people have used Cloudflare Tunnel to similar effect in the past.

Also, there are apparently quite a number of wiregaurd derivatives which protect better against detection and blocking methods. amnezia and wstunnel are the two that came up. Likewise, you will need a VPS, and might even be able to set up a tailscale-like coordination server that way (maybe with headscale, or maybe with one of its competitors like NetBird).

ZeroTier might also get the job done, but I really don’t know much about it.

Hope this helps, and good lucks!

There’s a ton of suggestions and stuff already, so don’t want to add to the noise, but thanks for the work! Had no idea about Artix, and almost installed it because of dinit.

Just wanted to say, KaOS is systemd free, it’s been using dinit for the init system for some time now. It does ship with some standalone systemd components like elogind, but so does Chimera. (also a really good project if anyone wants to check it out, quickly becoming my go-to recommend).

Also check out Chimera Linux, it’s a brilliant project. The lead dev is trans, the package management philosophy is very similar to Void, but with Alpine’s APK instead of XBPS, and Dinit is a damn good init system. Here be dragons, but it remains one of my favorite distros.

Ronald is indescribably more important than any tech billionaire could ever hope to be. So let’s raise a glass and give out a hardy thank you to all the Ronalds of the world!

Yup, that sounds exactly like what I do.

Huh, the more you know. My only experience with ZSH is when I briefly used Manjaro, and it seemed fine at the time… but now that I say that I think about it, “Manjaro defaulting to it,” might have been a bit of a red flag…

Yeah, I agree. It’s quirky, its syntax is annoying, and a good ZSH setup is probably better… but I don’t have the time to do an actual ZSH setup.

There’s probably only two people who will get this joke… and I’m one of them.

Today I’m using Chimera, but KaOS, Arix or perhaps some unholy install of Alpine with DINIT are tempting me. Seems a persistent kernel panic on wake from sleep has been fixed, so I’m not super tempted to hop ATM.

I have used quite a number of “enthusiast” distros. Arch, Alpine, Void, NixOS, briefly Rawhide, others I am forgetting, and most recently Chimera. Arch is by far the simplest, easiest and stablest distro I have ever used, at least for what I want out of my computer.

Listened to a rather interesting episode of Darknet Diaries the other day about a European cyber crime group. To this day, the FBI has been unable to decrypt the devices. The feds didn’t give too many details about the specifics, but what they did share was quite interesting:

• Five layers of encryption, each with unique passwords.
• LUKS root partition presumably tied to TPM2.
• Veracrypt or truecrypt volumes in userland.
• A custom-made encryption toolkit.

From what I gathered, I think the optimal balance of usability and security (especially for a headless machine) would be the following:

• LUKS root volume tied to TPM to protect against cloning of disk. Also, nothing too valuable ever lives on root.
• More important data stored behind a FUSE encryption layer like gocryptfs, these can be easily opened remotely. You can also tie the password to data hidden inside the LUKS volume for effective two-password protection if the volume is not already behind a LUKS layer.
• If your really concerned, add in additional layers as needed. You can tie LUKS to TPM and FIDO, not sure if you can set up a two password mode, but that would be quite nice. You can also (probably) tie FUSE based systems to biometrics like Howdey or fingerprint sensors if you have them. This could also be setup in a kind of two-password mode for a single volume. Realistically, two layers of encryption is overkill, but it’s more about ensuring multiple layers of redundancy rather than making it harder to crack.
• I can’t recommend systemd because of its numerous security vulnerabilities, but homed does have a neat feature where it will unmount encrypted home volumes when your computer goes to sleep. Not sure how effective or useful it is, but it is a nice feature. Been wanting to see if I can setup something similar on Chimera/Artix with dinit user services.
• Defiantly set up duress key-codes/panic buttons. Likewise, been wanting to write a clone of swaylock with duress code support, but as far as I know, nothing of the sort exists right now.

It is also very much worth noting, even though the FBI never got into the hackers’ computers, they had more than enough evidence to convict the lot. Being the defender of a computer system is always a losing battle.

Wonder if the boot device died. Behavior is in line with some NVMe failure modes I have encountered.

Me, earlier today, referring to Niri as a desktop instead of a “window manager,” which is also wrong as it’s a Wayland compositor.