- 9029 parentI thought it worked just fine on LTSC 2021 (21H2)
- I think it could be interesting to explore Universal Blue based distros such as Bazzite for this kind of use cases. The OS comes from a standard OCI container image, which means you can create your own customized one by layering changes on top of an upstream base image.
I feel bad for the unsolicited distro plug though especially since you already have a solution that works well and you are familiar with, but I thought it might still be useful to mention it. I'm not sure if uBlue would even be better vs your current setup. Seems like netboot would still be needed to get the latest version without an extra reboot.
- > For a lot stuff on my local network I don’t want the hassle and there are loads of use cases in local networks for normal people to just have port 80 no certs on something like 192.x.x.x because there is no easy way to set up public certificates for that and I don’t want everything hostem on cloud - some stuff I want to still host for myself in my local network.
Tbh I don't see what's hard about this. All you need is an A record pointing to your 192.x.x.x, acme capable dns host and a modern reverse proxy. You can even use a free ddns service if you want. Wouldn't bother with this for development, but anything hosted for longer than a few days absolutely yes. Imo not getting browser warnings is alone worth the few minutes it takes nowadays.
- C++ lambdas can be used to achieve a similar result, not as pretty though https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines... But in general I agree!
- I have used this setup for 6 years or so with KeePassXC and it's fine. Just being mindful of not editing stuff on other devices before the first one has had the chance to sync has been enough to avoid pretty much all sync conflicts. I have only had to resolve those a few times so far, iirc my android client was misconfigured at the time or something.
I still recommend Bitwarden for password management for any "laypeople" since it will just work. Also worth noting that the basic functionality is free.
- Do you have an opinion on the keyboard firmware ZMK? They seem to use LESC but MITM during pairing is still a concern: https://zmk.dev/docs/features/bluetooth
- While we are at it, here are some more useful warning flags I have used: https://github.com/cpp-best-practices/cppbestpractices/blob/.... Some C++-only though, some are a bit opinionated (like -Wsign-conversion) and some useful C-only flags might be missing.
Few C-specific references I found just now, but haven't tried myself yet:
https://github.com/systemd/systemd/blob/0885e4a6e7ca93d3aef8... https://github.com/airbus-seclab/c-compiler-security
Also a good idea to regularly run the program with sanitizers, using them in tests is a good way to do that I think. Why not during development as well if the performance is acceptable for that specific program.
- It has now been changed to
https://github.com/davidesantangelo/fastrace/blob/e8b19407a4...if (rtt < 0.0) { fprintf(stderr, "Warning: Negative RTT detected (%.3f ms) - clock issue?\n", rtt); rtt = 0.0; } - > a parser may reject the document entirely if it occurs
Ah, that's what I was missing. Thanks! The relevant part of the spec:
> user agents, while parsing an HTML document, may abort the parser at the first parse error that they encounter for which they do not wish to apply the rules described in this specification.
(https://html.spec.whatwg.org/multipage/parsing.html#parse-er...)
- Update on power draw for anyone interested: measured with a cheap AC power meter, I get 2.8-4.2W idle with occasional jump to up to 8W on my M720q with i5-8400T, 16GB ram and a single nvme drive. This is on Debian 13 with ASPM enabled for everything and a few containers running (home assistant, esphome, bookstack, tailscale). According to powertop stats on C-states, it's mostly in package C9 and core C10.
- Used Intel 8th gen based mini PCs seem like a pretty good value. 100-150 bucks for a pc from a somewhat reputable brand (lenovo, dell, hp) with slightly better multi core than N150 and ~6W idle if you manage to get it to stay in C10. Some of them have a low profile pcie slot, like M720q and M920q. Also the CPU is socketed so you could technically upgrade it to e.g. i9-9900K, at least the M920q is known to take one as long as you use a powerful enough PSU. Few of them (at least M920q) also support coreboot due to an Intel Boot Guard vuln which could be fun, I'm planning to look into whether it could be ported to my M720q as well.
- The difference is that unlike Brave and Vanadium, Firefox doesn't come with an ad blocker. You will have to install uBO. If you want to also trim tracking query params, you will have to enable a non-default filter list. Modifications like these will make you stand out from the average Firefox user. It's the reason why installing more extensions and messing with settings is not recommended when using Tor browser or Mullvad browser. The GrapheneOS project also discourages it (https://grapheneos.org/usage#web-browsing).
But you are still right, I don't have data for this or even a measure for uniqueness, it's just a guess.
- While I still use Firefox on desktop, on Android I recently switched from Firefox mobile to Brave out of security concerns and frustrations with performance. It has built-in tracker, query param and ad blocking, and is recommended by the GrapheneOS people as a decent alternative to their Vanadium browser [0]. Additionally, I have a gut feeling a Brave user blends in a bit better with its default ad blocking vs say a Firefox user with extensions and filter lists of their choice, but this might be negligible.
On the other hand the affiliate, crypto and AI shit in Brave are quite disgusting tbh, but at least they can be disabled. I also miss Firefox sync a bit.
[0] https://grapheneos.social/@GrapheneOS/111966258971400137
- I have been planning to get either Witrn K2 or Power-Z KM003C. If just cable testing is enough, the Treedix one is probably good.
Related: If you are looking for cables, this guy has tested a bunch (mainly for charging capabilities) https://www.allthingsoneplace.com/usb-cables-1
- Fwiw this has been my setup for ~10 years now and I don't really see an issue with it. Screen locker crashing would have been a concern back in the Xorg days but I don't think it's an issue nowadays with the ext-session-lock-v1 Wayland protocol. I value startup speed and simplicity of my setup and have no use for features provided by a DM, so this has always felt like a no-brainer to me.