Pebble are pretty good.

They don’t require any work to use, have a battery life measured in weeks, not hours, keep all your health data local unless you very specifically set it up to send it to a health app, and are open source and reasonably priced.

Not an advertisement. It’s still a US company, but compared with something like a Samsung thing they’re pretty cool.

Yes kinda? It depends a lot on the system. It’s still pretty common, even with containers like docker, for different services to run with different accounts and permissions. Eg. If you have a webapp with a small database or something, the web server will be www-data or whatever and the db will be a different user account like a postgres user or something. Even a fresh Linux install will have a separate user account for things like ntp (or systemd-timesync) etc. Users aren’t usually people, they’re daemons with limited scope and rule of least privilege.

Even if it’s all docker containers and you deploy them with the same docker account on the host, there are almost certainly a bunch of different accounts inside.

That way if there’s some vulnerability in ntp or something, an attacker might have permission to mess with the time but can’t, in theory, take over the whole container.

I think there is a trend towards caring less about that aspect of defence in depth if each service is in its own container and just rely on isolation. People are deploying services running as root with ansible or even just in dockerfiles, and not caring about it because there’s nothing else on the box for an attacker anyway. If they compromise the service, they’ve already got what they want.

I get the thought process but it still doesn’t feel good to me. If some docker bug shows up that allows a container user with root to break isolation and use the shared kernel to pivot to the host or other containers, then that one dodgy webapp that’s not running as a restricted user can become a part of a larger kill chain. It’s really easy to develop systems with least privilege in mind and there’s not much downside to doing it. It’s a good habit to create different accounts for different services (even if there’s one admin/docker/ansible/whatever account for deployment).

Your user account can run applications and read and write to a lot of locations on the disk.

So it can be used to run malware (cryptominers, ransomware, RATs etc.) Exfiltrate the data your account has access to, download or plant malicious or illegal data, use your internet connection to attack other systems with DOS or similar, use any logged in social media accounts to attack or spam your contacts, steal saved passwords and credentials from your web browsers, use your peripherals or connected devices (printers cameras microphone speakers), pivot to access other services on your local network (smart devices, IoT, TVs, home lab) etc.

There are comparatively few things an attacker wants on a desktop that actually require root access. It’s mostly just system files, package management and settings changes that require root to mess with. Eg. You would need root to dump a shadow file or stuff like luks encryption keys from kernel memory, but if an attacker has your logged in user account, the disk is already decrypted and account is already logged in.

What debarchery!

For the unprivileged container thing, containers tend to be lighter on resources than VMs at the cost of a little isolation (they share the same kernel as proxmox which could have security implications).

The ability for lxc containers to run unprivileged with all the restrictions that entails alleviates a bit of that security risk.

Both options are generally considered pretty secure but bugs/vulnerabilities could break isolation in either case. The only real 100% safe isolation is bare metal.

I tend to run containers unless I have a really good reason to need a VM, and run unprivileged unless I have a really really good reason not to.

My recommendation is a VPN server to connect in from outside and have the default gateway for the VPN clients be a server that acts as a router that’s set up with your commercial VPN.

That way, you can be outside on a phone or a computer, access your internal network and still have your public internet traffic go out through your commercial VPN without having to be able to configure multiple VPN connections at once (eg. Android doesn’t support that).

Eg. 2 debian proxmox containers. One that runs wireguard (head/tailscale might also work here?) for external access and one that runs mullvad(or whoever) VPN cli and IP forwarding to be the gateway for your clients.

Only downside is the extra hops to send everything through your home network first rather than straight to the commercial vpn which is probably fine depending on your speeds. You can always disconnect and connect directly to the commercial VPN for faster internet traffic if you need to.

“known by scientists for a long time” doesn’t necessarily mean true. Medical science believed in the four humours and thought most disease was caused by an imbalance in bile, blood and phlegm for like 1200 years before being replaced by the idea that it was actually miasma and stinky air.

Germ theory’s claim that tiny monsters are eating your insides, maybe like invisible poisonous insects or miniature demons and you need to wash them off your hands - Sounded Batshit crazy by comparison.

Questioning long-held assumptions and challenging scientific norms is a good thing, but every human has a grift that they’re vulnerable to and for some people, even smart, sciencey people, that grift is conspiracy alt science anti vax flat earth hollow earth aliens built the pyramids and the government doesn’t want you to know the truth.

The big difference between UAC and Sudo is that you can’t as easily script UAC. They can both require (or not require) a password but UAC requires user interaction. Sudo has no way of knowing if it’s being interacted with by a person or a script so it’s easier for applications to escalate their own privileges without a person doing it. UAC needs to have the escalation accepted with the keyboard or mouse.

There’s still plenty of sneaky ways to bypass that requirement but it’s more difficult than echo password | sudo -S

And Debian Sid is still stuck on 6.3.6 :(

Hopefully they figure out the qt update thing and get the new version packaged soon?

I never understood why so many bash scripts pipe grep to awk when regex is one of its main strengths.

Like… Why

grep ^nvme0n1 | awk '{print $3}'

over just

awk '/^nvme0n1/ {print $3}'

Yeah, it’s a shame because some of those OSM-based ones are really close to being perfect. It just seems like it’s really difficult for the open source devs to reconcile OSM data with GTFS and timetables for some reason.

Often the “local app” is basically a proprietary wrapper around Google maps.

I want to like this, but because there’s no GTFS/public transport timetables, it makes it kinda impossible to use it to get around cities that publish their transport data.

PT is the one thing I’m still stuck on Google maps for. I REALLY want an open source alternative.

They also force you to pay a 99USD yearly fee just for the privilege of being a developer.

That’s impressive! It took me way longer to learn. Maybe a month or two? Even longer to feel really comfortable with it.

“No conclusion whatsoever” is basically the scientific consensus on whether Dvorak has any effect on efficiency or typing speed. It’s hard to get good data because it’s hard to isolate other factors and a lot of the studies on it are full of bias or have really small sample sizes (or both).

To anyone thinking of learning Dvorak, my advice is don’t. It takes ages to get good at, isn’t THAT much better and causes a lot of little annoyances when random programs decide to ignore your layout settings or you sit down at someone else’s computer and start touch typing in the wrong layout from muscle memory or games tell you to press “E” when they mean “.” or they do say “.” but it’s so small that you don’t know if it’s a dot or a comma and then you hit the wrong one and your guy runs forward and you die…

That said, I’m also a Dvorak user and it is very comfortable and satisfying and better than qwerty. Just not enough to be worth all the pain of switching.

Yeah, that’s what they’re for. Having multiple accounts separated and not interfering with each other. So you can have eg. three different tabs of Gmail open or office or whatever in the same window with different accounts logged in. Each tab with a different colour. Great for separating work stuff from personal stuff or isolating bank logins etc.

Sounds like the same thing as you’re describing in chrome (though I haven’t tried the chrome implementation)

Firefox account containers are very clean and easy for this. The tabs get colour coded based on which account is logged in and you can configure certain sites to always open in certain containers.