• 0 Posts
  • 172 Comments
Joined 1 year ago
cake
Cake day: June 17th, 2023

help-circle
  • The abysmal adoption of DNSSEC is just embarrassing, and I haven’t heard any good arguments for why we shouldn’t do it. There’s one blog post that gets passed around as justification for not adopting DNSSEC, but it doesn’t really go into any technical detail and is mostly just the author saying “I’m scared of governments and TLDs”… which is maybe fair, but you still have to trust them for regular CA certs and everything, so why not make thr base secure?

    Honestly, I might care slightly more about DNSSEC than IPv6 adoption… IPv4 exhaustion and NATing everywhere sucks, but the fact that you can’t trust DNS is like… insane.


  • DNS setups can get fairly complicated with enterprise VPNs and stuff, but the main thing is probably just that DNS is built entirely around caching, so when something does go wrong or you’re trying to update something it’s easy for there to be a stale value somewhere. It’s also really fundamental, so when it breaks it can break anything.

    Overall, though, DNS isn’t terribly complex. It’s mostly just a key-value store with some caching. Running your own nameservers is pretty cool and will give you a much better understanding of how it all fits together and scales.



  • I’ve got bad news for you…

    Sometimes your place of work might have electronics recycling bins or something, but for the most part you’re expected to go to a special eco centre to recycle large electronics and batteries and stuff like this. Often you even have to pay a fee for them to take these items, which seems incredibly stupid to me because it just encourages everybody to throw them out with the normal trash.

    You may find some stores in some places that will take this stuff, but as far as I know this is not commonplace in much of North America. There are also some services where you can pay a fee for somebody to collect an item. We did that for a swollen lithium cell recently.



  • You know, I always used to think praying was incredibly stupid, and I’m sure plenty of people treat it in a way that’s… not really in the right spirit / ineffective? But recently it’s started to make a lot more sense to me. If you’re praying to god in an effort to directly influence the real world I think you’re misguided… If you think of prayer as a time to consider what you’re grateful for and what you want for the future, it actually seems like a really sensible mental health practice. To be clear, I am and always have been an atheist, and I don’t particularly like religions as a whole, but it seems like some of these things I’ve always found odd (like prayer) stem from something that could actually be reasonable and helpful but got corrupted by some game of telephone and people not understanding metaphors lol.







  • I really do recommend doing a Gentoo install at some point, because I think you would learn a lot from it. It’s a really nice experience and a well put together distro. The compiling is potentially not as bad as you think, but there are a couple of packages that are notoriously painful to compile (there are prebuilt binaries available for some of the painful ones if desired too). You’d probably get a decent amount out of an Arch install too. Arch isn’t my cup of tea, but lots of people like it and it’d be quicker to get started than Gentoo. I’m not sure I’d recommend it for you at this stage but eventually you should check out NixOS too! You can even try the package manager out on any distro you want. NixOS is really interesting, but it does things a bit different from other distros, and if you’ve done an Arch / Gentoo install it’ll be interesting to see what NixOS does in contrast.

    Other things to mess with… You mention partitioning, so make sure to check out LVM, and also consider reading a bit about filesystems. Maybe give btrfs a go :).

    I wouldn’t worry about daily driving either Gentoo or Arch. Once you have them set up you’ll probably be fine.








  • I think even if you’re tech-savvy you can have issues with Arch tbh. I don’t think the distro is without merit — a minimal rolling release binary distribution is clearly something people want… But I’m not sure Arch does a great job of being that (for me, at least), and I’ve personally found pacman and the official packages to be kind of lacking (keyring update issue that they’ve maybe finally fixed, installing specific versions of packages / pinning specific versions / downgrading packages are either not supported or not well supported, immediately removing kernel modules on upgrade, even if the currently running kernel may need them, etc…). It just doesn’t feel very polished in my experience and for my use cases (clearly it works for some people!), and that’s what has driven me away from Arch personally. I think a lot of this stems from Arch’s philosophy of being aggressively minimal, which is maybe fair enough… but I don’t think it’s for everybody.


  • Chobbes@lemmy.worldtoLinux@lemmy.mlJust install EndeavorOS lol
    link
    fedilink
    arrow-up
    2
    arrow-down
    1
    ·
    11 months ago

    Who says it hasn’t happened? :P

    If it hasn’t I would just assume that Slackware isn’t a big enough target and that anybody in the position to man-in-the-middle a large number of people would have better targets. I mean, to be clear TLS is not a silver bullet either, but it goes a long way for ensuring the integrity of the data you receive over the internet in addition to hiding the contents.

    Distros usually sign their ISOs with PGP as well (Slackware does this), so it’s a good idea to verify those signatures as it’s a second channel that you can use to double check the validity of the ISO (but I’m not sure many people actually do this). Of course, anybody can make PGP keys so you have to find out which key is actually supposed to be signing the iso, otherwise an attacker can just make a bogus key and tell you that that’s the Slackware signing key (on the official website too, because it doesn’t use tls!). The web of trust arguably helps some (though this can be faked as well unless you actually participate in key signing parties or something), and you can hope that the Slackware public key is mirrored in several places that you trust so you can compare them… but at the end of the day for most people all trust in the distribution comes from the domain name, and if you don’t have TLS certificates you’re kind of setting up a weak foundation of trust… Maybe it will be fine because you’re not a big enough target for somebody to bother, but in this day and age it’s pretty much trivial to set up TLS certificates and that gets you a far better foundation… why take the risk? Why is it smart to unnecessarily expose your users to more risk than necessary?