NIGGER

First thing you should do with any distro is make sure you have secure time (NTS) and secure DNS (DoT) at the operating system level. Only Fedora and Ubuntu do secure time out of the box iirc.

>>110207988
bloat

>>110207988
Ntpd is deprecated now so pretty much everyone will be picking that up at some point.

I replaced ntpd with ntpd-rs (Ubuntu is using the same) on my machines. I only have ntpd on my OpenWRT router now and once they package ntpd-rs there I'll probably swap that out too

>>110208088
Although I could switch to chrony I guess.

>>110207998
A MITM can intercept NTP and slew your time enough that your system wouldn't notice. Inaccurate time is a security risk and breaks TLS.

DNS can be MITM by your ISP and they know every lookup without it being secured.

>>110208107
never mind. I don't know what I was saying when I said, "bloat". Sorry, anon.

>>110208107
A MITM would have to happen inside your ISP network or a router in between you and the NTP server to be effective by the way.

It's a real threat but not practical. Since NTP operates on consensus an attacker would have to attack every single one of the 6 or 7 sources you have configured. Not really feasible.

>>110207927
Me on the left

>>110208126
you btfo him.

>>110207927
linux is easier when you can just have a.i. tell you wat to copy and paste

>>110207927
With all the recent hacking events I feel like its only a matter of time until some distro's official repos get compromised

>>110208138
To be clear he's right your own ISP could MITM you but I really hope they're not going around fiddling with all the clocks.

Some ISPs actually try to be helpful here and even run their own NTP pool you can use (but it shouldn't be your only source)

>>110208088
Ubuntu will eventually switch to ntpd-rs and now they're on Chrony with their own secure time pools for new installations. Router level is good. Make sure you can pick that up through DHCP on your computers as a source and add redundancy with different time servers. 4 sources should be the standard.

I can't believe SystemD still has a poor time daemon. It uses one source only to determine time and you're placing all your trust in that one source. Chrony should be the default imo as distros will have it preconfigured for 4 sources (without NTS though).

>>110208126
Most distributions only connect to 1 source (SystemD timesync). That 1 source has no guarantee of staying accurate if you leave your computer on all the time (it will resolve to a new source from the pool after reboot).

>>110208155
I use BELL so INTERPOL already hacked me.
I don't use OpenWRT.

TOTAL SYSTEMD VICTORY

>>110208169
Systemd only does SNTP. It's meant so embedded shit can set the clock and that's about it. It's not even proper NTP daemon which is why serious distros replace it with Chrony or Ntpd-rs, etc.

Systemd is fine on a laptop if you have other sources on your LAN to use but yeah, it's not great. If you ran a financial institution, etc, that needed really accurate timing you wouldn't use SNTP with Systemd. It's not meant as a serious thing.

>>110208155
ISP routers and most home routers do not support serving it over DHCP though. It's only intended for the router's time. So you have to directly connect to its IP or URL...but that creates more requests.

i'm gonna reinstall linux but don't know what distro aside debian to use for steam and proton, I was having gpu issues with wayland hdr, and so I don't know what kind of issues i'll have with games Since I don't have any friends aside the ones online, i'm gonna get wow and play with my friend with the upcoming update supposedly So I have money for that, and I am going to save up for a new monitor.

>>110208187
shut the fuck up before you get knocked the fuck out pussy

>>110208208
Keep seething. Systemd WON. And it will continue to WIN.

File: chrony.png (108 KB, 960x500)

108 KB PNG

>>110208190
The one thing I just don't like is placing all your trust into whatever server it gets from resolving that pool address whenever you start your computer/server. It may start off accurate but SystemD will stick with it even if it has been kicked out of the pool project for drifting. If you get time.cloudflare.com, then it's probably fine but many servers are just run by volunteers with no guarantees.

As much as I hate big corp, it's probably best to go with Meta, Google, AWS or Cloudflare for time sync. Cloudflare and Meta support NTS too.

>>110208232
You're the one seething

>>110208273
>use profanity
>use insult
>"knocked out"
>"b-but you are the one who is seething!"
Whatever makes you sleep at night, bash script shill. You are left behind.

>>110207944 (checked)
Nobara
Iglunix
Gentoo
GoboLinux
EndeavourOS
RHEL

llms are so good at setting up linux servers I can see why stack exchange is dead lmao

>>110208252
>As much as I hate big corp, it's probably best to go with Meta, Google, AWS or Cloudflare for time sync. Cloudflare and Meta support NTS too.
Maybe if you like being exploited. Time based attacks are real and Meta/Google regularly have "outages" which definitely ARE NOT a staged window to penetrate a competitor and steal data from. Most certainly not. And those totally unplanned outages ARE NOT profited off of by employees by selling that information in usenets/decentralized nodes/fediverse which people use to infiltrate home networks to perv on kids and steal money from individuals.
Nah anon, I'll stick to NTP pools thanks.

File: DumbElf_WakeUp.jpg (363 KB, 1328x1328)

363 KB JPG

>>110208436
>>110208252
Even the US federal government's NIST standards for security and CISA says to not just point to cloudflare/google/microsoft's time servers. They outright demand you not use them for anything in a regulated market. I can't imagine being so dumb as to put something as critical as time in the hands of the great rapist crooks of our time.

>>110208376
>setting up linux servers
Wut? You just use a web based GUI driven image builder to add in your repos, baseline, security config, vim config, etc. Press GO and it spits out an ovf (or whatever the fuck you want), and you build the server. Then you have a simple bash script your make ONCE and use on everything forever going forward if there is something that takes more than 2 seconds to build into your image. An LLM is going to fuck that up. Guarantee. And it is going to disable SEL to do it, while breaking permissions on directories and getting syntax wrong 99% of the time because every motherfucking distro has different paths and renamed dependencies because Linux is ran by various walled off and vitriolic cults so the training data is poisoned.

>>110208445
Nobody gives a fuck about the NIST standards. If you're a big org you get one of those hardware NTP servers and run your own clock and distribute that. For everyone else Cloudflare, Facebook, Google, etc, is fine for time purposes.

>>110208562
Although running your own NTP with hardware has to be done carefully too…
https://hackaday.com/2026/08/27/australias-nationwide-phone-outage-was-an-embarrassing-failure/

i think nemo is quite good

File: 1755392978013922.png (249 KB, 1200x806)

249 KB PNG

I asked this in the pc building general but I'll also ask it here;
Should I sell off my RTX 3090 I got back in 2021 and get a AMD 7090 XT??
It seems they preform similar in pure rasterization and I don't use DLSS or anything like that.
I'm also going to be moving from windows to Linux (CachyOS) in the coming weeks and it seems AMD graphics cards play nicer with linux.

I don't yet know all the angles, this has only been an idea of mine for a day so any help is appreciated.

>>110208969
Why go through all the effort for equal performance? Cachy has nvidia driver setup built it too so it's kinda a non issue

>>110208969
Can’t you get a better GPU than that? Don’t used 3090’s sell for $200 more than 9070xts?

>>110208376
>>110208462
People set up Linux desktops all the time and a desktop is magnitudes more complex than a server.
A server doesn't do more than serve goatse.jpg over HTTP, it requires way less packages.
>>110208273
Stop seething and create a viable option for systemd. Nobody's going for those alternatives if they are half way done, you got to step in to the distro dev's shoes here.
>download tar package
>unpackage
>./configure && make && make install
>test it, works
>package it for your distro
Runit for example provided shit for their init system. You got to at least give a reference setup.

File: false.png (105 KB, 641x530)

105 KB PNG

>use different time servers (all anycast/geo dns I believe)
>Meta never wants to agree with the others
>Chrony not happy

I think I'll just stick to one pool than deal with this complexity.

>>110208436
Cloudflare Time ips are in the ntp pool because it's not leap-smearing and they've authorised its use there. There is a high likelihood it's been in rotation because it's enabled for all zones/high capacity.

If you hate the OP.

You work for the CIA.

Simple as.

>>110209310
i wish that was true so i could have a job

File: 1793285361730945.jpg (84 KB, 1080x838)

84 KB JPG

Is this a bad idea?
I've sent an email to the suckless founder and RMS about /fglt/ before.

>>110209377
Stallman almost certainly knows about 4chan and yes, that's an idiotic idea. Don't bother him about us

File: 1776156418566157.jpg (154 KB, 1080x1162)

154 KB JPG

>>110209397
I've never shared this but he's a retarded niggerfaggot.

I still don't understand why he's a god when there's people like Anselm Garbe and Fabrice Bellard...

>>110207927
ai slop garbage

>>110209421
What did you think he was going to say

>>110209421
Well who do you think worships him as their role model? A bunch of fat basement dwelleling losers

changed to nixos from winblows
coolest fucking shit ever made
i just cannot believe, how good this is

>>110209530

>>110209640
i am so fucking impressed with its paradigm
so far
from my limited understanding it feels like what uv is to python, which made python finally usable
i think this will allow me to not break the system within a month

>>110209640
Not that good.
https://github.com/NixOS/nixpkgs/issues/576544

File: Screenshot_20261031-084404.png (108 KB, 1080x399)

108 KB PNG

Niggas, it's about to be 16 hours since I started compiling my kernel in my Exherbo install
DON'T TRY TO INSTALL A SOURCE-BASED DISTRO WITH 4GB OF RAM THAT WAS STUPID
The make -j2 command has cursed me for eternity. Don't follow my footsteps. STICK TO BINARY!!!! DON'T FALL FOR THE SOURCE-BASED PSYOPS

>>110210621
Excuse me, I meant 28 hours
I counted a whole day as 12 hours for some reason
JUST USE ARCH INSTEAD

>>110210621
>>110210631
You could have just used Gentoo with binary packages and binary distribution kernel and had the best of both worlds.

>>110210706
I know
But I'm too balls deep now
I don't want to give up

>>110210953
>>110210706
After this is done I'm never compiling a Kernel ever again. Or a web browser. I don't even want to know what it's like to compile a web browser.

>>110210964
Compiling a web browser is much worse than compiling the kernel

>>110211010
How do Gentoo uses even update their browser?

>>110211029
binhost I guess

>>110211029
With tears and suffering

>>110210706
>>110210953
Pre-compiled Kernels are pretty universal. You can just download
>https://packages.debian.org/bookworm/linux-image-amd64
and extract it to the right directories. Pretty sure Debian kernel was in Gentoo or Guru repos at some point

>>110208969
That's all true, but I wouldn't trade any 24GB card for a 16GB in this economy. You can afford to waitfag for another 3 years minimum.

>>110211029
>>110211038
>>110211065
IIRC compiling Firefox with my old 4-threaded Ryzen 3 2200G took 45 minutes. But that's just Firefox, Chromium is magnitudes harder for some reason.
>>110211171
What goes for kernels: if you really go thru the entire configuration and disable absolutely everything you don't need it won't be a big deal. My old Ryzen compiled my specific configuration in something like 12 minutes. But that's just my configuration and needs, who knows someone out there has 1000 different USB gadgets or other devices they might use. Or they use 100 different filesystems for storage, who knows.

(my current setup has 16 cores / 32 threads so I don't even care)

In Debian, is it safe to use partitionmanager to reduce my /home LV, and create a new LV with the free space while /home is mounted? /home is in ext4, I have a separate root partition, and the volume group is encrypted. Or should I use a live USB?

>>110211029
alot of us just use www-client/firefox-bin. personally, I have a 5800x and 32gb of ram, jumbo-build USE flag enabled and -j 14 so it only takes ~10 minutes. qtbrowser is worse, but whenever I have a big update I just do it before I go to sleep.

>>110211752
nevermind I'm retarded, I can't reduce it while it's mounted

So what even is x11 and wayland? In windows-adjacent terms, please.

>>110212026
Dunno, but in my fanfiction
>X11
Is a Oligarchy ran by 11 Aristocrats
>Wayland
Is Free Republic built by those exiled from X11

>>110212026
It's bloat1 and bloat2
Just use links and curl/wget as your (((web browser))), watch ls -la as you (((graphical environment))) and your keyboard as your (((mouse)))

>>110212404
That's just the lore. I mean in technical terms. Right now in my mind is like Windows Explorer had baby with DirectX. Like, it's rendering engine for the GUI.

>>110207927
qrd on qubesos? is the "everything in a VM" approach feasible for daily driving? i like the idea of having granular sandboxing for software i run. LLMs have made software development a lot faster, but that surely also increases the risk of vulnerabilities slipping in.

how solid is qubesos's vm setup? curious about whether i should switch or roll my own solution in my current debian unstable setup

What if I use Linux without GNU?

Anyone getting graphical glitches on an AMD card after updating? Tried switching cables but it only went away after restoring an older snapshot. Lowering the refresh rate to 60 also seems to fix it.

>>110212868
Cachyos btw

>>110212844
Literally just source code

File: 1540342949080.png (93 KB, 775x1024)

93 KB PNG

How do I definitively get rid of the compromised emudhra ca certs on my system? I'm on a live debian stable environment, and packages are reported as being up to date, despite a few compromised certificates being listed via https://emudhra.we-have-a-problem.com/, which should be resolved by an up to date system.

I did the following:
>sudo nano /etc/ca-certificates.conf, disabled emudhra related certs with "!"
>dpkg-reconfigure ca-certificates
>update-ca-certificates
Idk if any of pair of the above commands are redundant.

I was still getting a notice regarding compromised certs from the aforementioned site, so I went into firefox's settings and removed the affected certs from there. That resulted in the site reporting no issues. Idk if software with their own cert management still trust the compromised certs. I remember reading something about Java, and potentially Python, being an issue.

I think the issue with updating packages is due to the security repo not being in /etc/apt/sources.list. Is that to be expected with live stable isos, or might that have been a mistake on the part of the maintainer?

>>110210964
>>110210953
>>110210631
>>110210621
I failed.
I was installing it in my phone and I let the battery die after about 32 hours of kernel compilation. Didn't plug it properly in the charger, thought I did so. Went to check, dead.
I'm not doing this again, or compiling anything again. Fuck "granular control" and "optimization".

I'll probably try again, but not today. I'm too pissed. Maybe I'll try something in my computer instead of running qemu 64bit in an Android phone.

>>110212809
somebody PLEASE respond

>>110212409
I'm not ever leaving this place. This is the content you simply cannot find anywhere else.

>>110212809
I have never used it,nso I can't tell you how stable it is, but my impression is that it must be HEAVY.
If you have a supercomputer, maybe. Idk. I wouldn't advice that in a desktop. If you REALLY have to look up child porn or cartel execution videos use tailsOS instead (and not on an Intel CPU, please)

File: Screenshot_20261031_132016.png (229 KB, 583x1150)

229 KB PNG

>>110213174
>>110212809

>>110213325
>In a desktop
I meant laptop.

>>110213325
my main concern is that since we will all be forced to use vibeslopped software at some point soon, i may as well figure out a good compartmentalization system to protect myself from vuln-ridden junk. that makes sense though, i have a pretty old laptop that was good for its time but wouldn't really hold up to CPU intense workloads today. surely there's something similar that uses containers for sandboxing rather than heavyweight VMs. i will read about it

>>110212809
>>110213174
Never used Qubes

If you're extremely paranoid I would recommend using a totally separate machine for stuff that might be risky as opposed to using one machine running a bunch of VMs. Qubes is a good idea for certain people like security researchers, journalists, and whistleblowers. There you can whip up a temporary VM and use it for stuff and dispose of it when you're done but the elevated hardware requirements and the stricter procedures for managing and accessing stuff just sounds kind of annoying to use as a daily driver.

If you are paranoid about specific applications being compromised you can use OS level virtualization like containers on Linux or BSD jails to limit what the application can access and do.

>>110213376
Maybe OpenBSD? I've never used a BSD before, but I've heard that BSDs run a lot of alpine containers for tasks like connecting to network because BSD can't do it natively yet, and OpenBSD is notoriously hyperparanoid about security
There's also immutable atomic desktops that Fedora distributes, and even more paranoic forks of that such as SecureBlue, and OpenSUSE seems to have been trying some shit like with immutable rolling, unlike fedora's immutable stable desktops, so if you're fine with such alternative methods of security implementation you could go for something like that.

Do package repositories need to use https? I checked list in /etc/apt/sources.list on my actual installation, and found that all domains use http instead.

What browser do you use?

>>110213898
No because the package integrity is checked against its checksum in the release file. If something is amiss, it will not install. This is checked against a signing key stored in the keyrings directory (/usr/share/keyrings), which will have been placed there during installation. You have to explicitly override the configuration to install something from the repos without a key. It's more efficient to use http (no TLS, easier on the mirrors). The only advantage of https in apt is not letting anyone on the wire know what packages you are downloading. All third-party mirrors will use http and optionally https.

Debian by default uses http if you set up a network mirror in the install. It also is the default in the example file:

/usr/share/doc/apt/examples/debian.sources

Note this:
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

If that is in your sources file (or whatever your distribution uses), then it will only use that specific key. Without it, it will use any key in the keyring. If you don't have any other repos installed, then it's fine not to specify the key.

Read the man pages for: apt-secure, sources.list, apt-transport-http.

File: 757hbx8sd4m81.jpg (44 KB, 1080x1080)

44 KB JPG

>>110214088
librewolf

>>110207927
This is /ufglt/ - UnFriendly GNU/Linux Thread now
Please drop your tranny socks in the collection bin

>>110214112
And the old format (sources.list) doesn't specify a key usually for the distribution repos but it will still be checked against a key in the keyring. The new <vendor>.sources format is clearer and you may be able to convert it using with recent apt/distros:

apt modernize-sources

>>110214088
firefox

File: Icecat.png (177 KB, 650x650)

177 KB PNG

>>110214088

>>110214088
Brave

File: edge.png (43 KB, 795x443)

43 KB PNG

>>110214088
Using Microsoft Edge now.

>>110214088
waterfox

>>110211029
By using binary packages (There is binary firefox, Google Chrome, edge, etc) or using a good CPU to compile the thing.

Building Firefox only takes about an hour on my 5950X:

$ qlop -aHv www-client/firefox
www-client/firefox-99999999: 1 hour, 11 minutes, 11 seconds average for 1684 merges

>>110214088
I tried to access 4chan with links to post the reply there, but it didn't work. Curse JavaScript.
I did manage to go as far as this thread, but when I pressed enter on your then highlighted post number 4chan told me I needed JavaScript to do that.
Funnily enough, I was able to, right before that, access the Devuan.org site and download an iso for Devuan Freia, so as long as the website you're visiting doesn't use JavaScript, it is surprisingly viable.
So, unfortunately, I'm using (((LibreWolf)))

I'm switching from Linux Mint to LMDE and reinstalling Windows 10 LTSC on my main machine. I have two 4TB SSDs currently, one NVME and one SATA, and I'm wondering what would be the best way to wipe the drives for a good, fresh install. Would blkdiscard just be alright for my needs?

>>110214392
Just use wipefs. You don't need something like blkdiscard for this.

>>110214134
You first, "sister".

>>110214399
Far better than dd, I would expect. I'm most certainly going to have to hunt down the apps I have currently installed, but isn't there a way to list them in a text file output and mass install them (or the closest ones) through that in apt? I'm well aware that Ubuntu based apps aren't really compatible with Debian.

>>110214531
This will list installed packages:

dpkg -l