if only secureboot support hibernate

only on phone

but Secureblue, a Linux distro, really follows Graphene’s security hardening stuff.

compartmentalization

top reasons why GrapheneOS is highly praised: ability to create different profiles with different encryption keys, and hardened codes.

on Linux, the top choice is QuebeOS. But i tried it 4 times and still couldnt go with it. My laptop couldnt handle quebeos…

The other choice is SecureBlue. I heard that is called the Graphene of Linux. They have hardened codes, secure browser and very strict secure defaults. The downside? You need to be able to use distrobox, flatpak, rpm-ostree, brew to maintain your apps. So in a way, it is the same compartmentalization, but a bit messy.

If u cant deal with these 2, then maybe use TailOS to do your download. Not sure if it saves the data?

Using VM is also great. But i think a “super VM” is the only answer and that is QuebeOS. You can literally control everything inside each VM.

not only i rawdogged linux, i used a rolling distro with a lot of questionable security decisions (eherm… Manjaro) during grad school.

… no idea how that laptop survived grad school but it did…

unfortunately with S0ix being forced on all modern laptops, zram is the only logical choice. With s3 sleep at least i can say i need swap because i need hibernation…With S0ix? Dont bother.

hows BSD for everyday use compare to linux?

even for currently running PCs, sometimes i swear to God it’s like dejavu : my laptop suddenly asks if i want to use the OneDrive and Office sub. You know that screen when you do the Win 11 setup.

The only way to exit is via the “Remind me later”, which is even more BS. You cant even Decline.

to be honest that setup is faster to arch-chroot if things go wrong.

Thats why “easy to use” is very subjective.

Gnome is sure easy but if things mess up and i need to reinstall? I had to hunt and reinstall my extensions and enable the right settings. That could take like 30 mins or more, after reinstalling the distro.

In minimal setup like sway? I can literally git clone and then stow all my dot files. No more than 5 mins. I could do it with 10 beers at 3am in.

QuebeOS is cool. I tried it once and havent tried again.

I get that it is secure, but i feel like i need to rewire how my brain works. E.g. you dont open a Download folder, instead you spawn a File manager quebe and open Thunar

ex arch user for 5 yrs

current fedora user since 2024

i’ve been getting a lot of “recommended” youtube videos on gentoo and nixos

send help plezz

i use a yubikey and still have the ability to type my LUKs password in. Yubikey is just more convenience: plug in and it auto type the password field. On Fedora this means it populates the field with asterisks. Still, i think using password is the best method.

With that said, i believe a much better secure layer is something similar to what Novacustoms, Purism attempt to do: verify if somebody else not you try to access the laptop. So far i know of only Dasharo boot and the stuff from Purism that can do these…

So the layout is: Boot verification -> LUKs-> your data

Or if you have the juices and powers: Boot verification -> LUKS -> QuebeOS dom0 -> choose your Quebess.

or unless you go Quebes and you no longer think in terms of partition anymore…,…

Sorry my hands are busy

`C - x 2’

C -x C-f ~/.emacs.d/init.el

C-x C-s

sudo apt update either has little outputs (so nothing to show off), or it crashes because of library conflict

For me it was: pacstrap -K /mnt blah blah to see literally everything comesin your system getting installed , followed by arch-chroot /mnt

Oh btw, I used Arch.

theres zswap?

i know the OP was about server, but just curious how long is every one’s uptime on laptop / desktop?

lots of people recommend bitwarden, but i am more at peace with an offline password manager that i control like Keepass. You can also go the GNU route and use “pass” on Linux too

Or use a physical key like Yubikey to login

i think the good alternative is to get a really fast drive and hibernate everytime you close the lid. Sure it’s slower to resume but with ssd that shouldnt be an issue. Or if Framework has 2 drives we can suspend the image to that 2nd drive then use the main drive to boot up off of it.

I was loaned a Macbook at my previous workplace. Didnt really use it much because my work apps do not work on Mac. So it sat on the shelves until the day I left the company (too much toxicity). I only used it once or twice when doing presentations. Anyway, that thing suspened pretty much 10/10. The power save is better too: i closed the lid on Sunday night and next Sunday, when open up the lid the battery was at 95%.

good battery life is nice, but does Linux’s bibernation or suspend work reliably on this? Asking because coming from Lenovo, the power performance is not a problem but it is the power management. Unless I am on a Window version specifically for that Lenovo laptop or I am on a Mac, there is always that 10% chance the laptop will fail to suspend properly.