Just some Internet guy

He/him/them 🏳️‍🌈

  • 1 Post
  • 940 Comments
Joined 2 years ago
cake
Cake day: June 25th, 2023

help-circle
  • You absolutely can if you want to. Xen have been around for decades, most people that do GPU passthrough also kind of technically do that with pure Linux. Xen is the closest to what Microsoft does: technically you run Hyper-V then Windows on top, which is similar to Xen and the special dom0.

    But fundamentally the hard part is, the freedoms of Linux brings in an infinite combination of possible distros, kernels, modules and software. Each module is compiled for the exact version of the kernel you run. The module must be signed by the same key as the kernel, and each distro have its own set of kernels and modules. Those keys needs to be trusted by the bootloader. So when you go try to download the new NVIDIA driver directly from their site, you run into problems. And somehow this entire mess needs to link back to one source of trust at the root of the chain.

    Microsoft on the other hand controls the entire OS experience, so who signs what is pretty straightforward. Windows drivers are also very portable: one driver can work from Windows Vista to 11, so it’s easy to evaluate one developer and sign their drivers. That’s just one signature. And the Microsoft root cert is preloaded on every motherboard, so it just works.

    So Linux distros that do support secure boot properly, will often have to prompt the user to install their own keys (which is UX nightmare of its own), because FOSS likes to do things right by giving full control to the user. Ideally you manage your own keys, so even a developer from a distro can’t build a signed kernel/module to exploit you, you are the root of trust. That’s also a UX nightmare because average users are good a losing keys and locking themselves out.

    It’s kind of a huge mess in the end, to solve problems very few users have or care about. On Linux it’s not routine to install kernel mode malware like Vanguard or EAC. We use sandboxing a lot via Flatpak and Docker and the likes. You often get your apps from your distro which you trust, or from Flathub which you also trust. The kernel is very rarely compromised, and it’s pretty easy to cleanup afterwards too. It’s just not been a problem. Users running malware on Linux is already very rare, so protecting against rogue kernel modules and the likes just isn’t in need enough for anyone to be interested in spending the time to implement it.

    But as a user armed with a lot of patience, you can make it all work and you’ll be the only one in the world that can get in. Secure boot with systemd-cryptenroll using the TPM is a fairly common setup. If you’re a corporate IT person you can lock down Linux a lot with secure boot, module signing, SELinux policies and restricted executables. The tools are all there for you to do it as a user, and you get to custom tailor it specifically for your environment too! You can remove every single driver and feature you don’t need from the kernel, sign that, and have a massively reduced attack surface. Don’t need modules? Disable runtime module loading entirely. Mount /home noexec. If you really care about security you can make it way, way stronger than Windows with everything enabled and you don’t even need an hypervisor to do that.











  • Why is this always the argument that comes up? It’s like if foreign people came by thousands to post the 9/11 attacks on american media to test the free speech. Most would take it down, some might stay up, but it’s ultimately still very disrespectful and upsetting for a lot of people.

    You can enjoy a heavily moderated platform for what it’s good at. I use rednote for my cat, food and art content and enjoy the cultural exchange. There are better suited apps in general for free speech and political debate. I’m tired of politics invading every platform, so it’s been rather nice in that aspect. For what I want to use that app for, I’m perfectly fine with the CCP’s rules, even if I disagree with some aspects of the CCP.

    Free speech is important, but we don’t need it literally everywhere.


  • No FOSS clients, nobody’s got time to reverse engineer it as it happened so fast.

    As for privacy, well, it uses plain HTTP for at least all the media, so, not very private. It requests less permissions than Meta’s apps however, and only asks when the feature is needed (for example, the Nearby page requests GPS which makes sense). It does seem to like to paste my clipboard which is not very cool, no idea what it’s doing with it. I use a VPN for it.

    It’s still a chinese app under the control of the CCP. Personally, I’d rather China have my data than the US, because at least for China it’s useless whereas with the current administration in the US, who knows what they do with that data.

    As for the app itself, it’s pretty nice. Don’t expect free speech, but the rules also make it for a rather respectful and positive experience overall. For what it’s intended to be (share cats, recipes, makeup, and other entertainment content) it’s pretty good and a breath of fresh air compared to the non-stop political fighting on other platforms. That said it’s not as censored as some assume it is: if it’s presented tastefully you can usually get away with it. Respect and honesty gets you far on there whereas lies and aggression gets you banned. I’ve seen guns, LGBTQ, cars, religion, politics, comparing capitalism and communism. They’re talking about Elon’s nazi salute on there and all.

    The massive cultural exchange going on there is quite enjoyable. People from all sorts of countries are trying out new recipes and adapting them to their local taste. Turns out mandarin isn’t so bad to learn either. Very welcoming community. Rumors are it made the chinese government consider relaxing the great firewall. The sentiment is very anti-war as people from enemy countries are building online friendships.

    I approach it with caution, but I’ve been rather please with what I see.