• 0 Posts
  • 14 Comments
Joined 3 years ago
cake
Cake day: June 30th, 2023

help-circle
  • sloppy_diffuser@sh.itjust.workstoLinux@lemmy.ml*Permanently Deleted*
    link
    fedilink
    English
    arrow-up
    11
    arrow-down
    1
    ·
    4 months ago

    https://grapheneos.org/usage#web-browsing

    Chromium and their particular fork have much better exploit hardening via sandboxing.

    My understanding is Firefox has better anti-fingerprinting and uBlock origin via manifest v2 support (or v2 features ported to v3).

    The argument often used is malicious ads. Sandboxing and hardening largely mitigates ads that contain exploits, but it doesn’t protect against social engineering, crypto mining, tracking, etc.

    So I guess it comes down to your threat model and desired experience.

    I personally prefer the uBlock origin experience, but an ad free experience and escape from targeted advertising was my target opsec when venturing into privacy.





  • If you want punishment go for NixOS!

    • Fundamental philosophy changes over its lifetime.
    • No idea (when starting) which documentation or patterns go with which version.

    But once it clicks you have a fully declarative setup**. I edit a file, activate, commit to git. On another system, pull, activate.

    ** The config system is expansive but not exhaustive. I still have to login to Slack, pick my theme, etc. My VPN on the other hand is just ready credentials and all.

    I never have to remember the 100 little tweaks I made, every tweak is in git. Noise canceling pipewire filter, what software I had installed, service configurations, secret management, disk partitions, all portable between different systems.

    A lighter introduction is probably home manager, works in any Linux system or macOS. Manages your home directory as the name implies.

    You can also go lighter with a repo flake.nix and a devShell. Its like a generic virtual environment. Auto activate with direnv. A step up from a devShell would be https://devenv.sh/ which tracks more like home manager with configurable modules. A devShell is really a bash script with these programs available from Nix.







  • NixOS. Started with Yellow Dog Linux in 1998.

    I don’t do everything through nix’s derivation system.

    Many of my configs are just an outOfStoreSymlink to my configs in the same dotfiles repos. I don’t need every change wrapped in a derivation. Neovim is probably the largest. A few node projects for automations I’m fine using pnpm to manage. Nix still places everything but I can tweek those configs and commit in the same repo without a full blown activation.