𞋴𝛂𝛋𝛆

  • 76 Posts
  • 752 Comments
Joined 2 years ago
cake
Cake day: June 9th, 2023

help-circle




  • You might be surprised about places other than SoCal and NY NY. Like growing up in Tennessee Alabama and Georgia, everyone seemed to have some affiliation. The level of engagement varied, but I never met someone that was an openly staunch atheist in real life. There is a deep stigma about such a thing in the South, - sadly. There, even extremists like Church of God are nominalized (screaming you’re going to hell for an hour, exorcism/miracle drama nonsense, mobbing behaviors, religious masochism).

    It is likely one would need to be second or third generation removed from and religious social support network in a family unit before a person would truly answer atheist on such a poll. I don’t think many people grow to the point of self awareness to care to define an anti religious god certainty at this stage in human cultural evolution.





  • The shim is the secure boot key that slides under the Microsoft package key on your machine. There is a US department of defense PDF floating around that goes into how to set your own keys in UEFI but your bootloader form the OEM may not include all of the UEFI stuff to do this in the user interface. There is a way to boot into UEFI ad set keys manually. The tool is called Keytool. Gentoo has a guide but it is written for advanced competency (beyond mine).

    As far as I am aware, only the base vanilla Ubuntu is signed under the shim key for Debian. All of the official Fedora distros are under their shim IIRC. The unofficials like Silverblue are not – again IIRC.

    The shim is only available to the person that is the final package maintainer for the distro. They have a key signed by Microsoft so that you are literally using the Windows key to sign the bootable code of the distro. This comes with headaches as you will not be able to modify and run kernel bootable executable stuff, but that may not matter to you. In particular, it makes Nvidia stuff a pain in the ass if you need to freeze or alter the kernel module driver in some way.

    The Microsoft key is the second level key, sorry I forget the names of the levels. I know one is called the Package Key but I forget the other and which level is higher by name. The higher level key is the one from the manufacturer. They can send or possibly force updates to UEFI using this key. These keys are also compromised from time to time so there is that too. The fact you can boot into UEFI sounds scary AF to me and my paranoid ass but whatever. The MINIX system always running in the background of x86 is another (Intel ME/AMD has equivalent).

    You don’t have to change your keys but you can if you wish, or you’re supposed to be able to. If you sign your own key at the highest level (manufacturer), then you can use a Microsoft website to get a new key at the OS level and use it. Then you fully control Secure Boot and your UEFI. I recommend looking up the PDF. If you search Lemmy I have talked about it with people a few times and linked it but I don’t have it bookmarked and am too lazy to go find it for you right now. That guide goes through the details in a very approachable way intended for competent people in general but not niche IT or CS grad level like how Arch or Gentoo tend to write, it was very RHEL level approachable.








  • The UEFI boot system is tricky and you need to get along with Secure Boot to do this. Secure Boot is outside of the Linux kernel. Both Fedora and Ubuntu have systems for this. Fedora uses the Anaconda system and I believe they do it best. I have had a W11 partition for 2 years and never used it once. It can’t even get on the internet with my firewall setup, but it is there and never had any issues the 3 times I logged into it.

    I think all of the Fedora systems support the shim key and secure boot but I know Workstation does. For Ubuntu I think it is just the regular vanilla Ubuntu desktop that the shim supports. This may be somewhat sketchy with Nvidia or maybe not. Nvidia “”““open sourced””“” their kernel code but the actual nvcc compiler required to build the binaries is still proprietary crap.

    I have a 3080Ti gaming laptop. It isn’t half bad with 16 GB of video RAM from all the way back in 2021. Nvidia is artificially holding back the vram because of monopoly nonsense. The new stuff has very little real consumer value as a result, at least with AI stuff I run. The hardware is a little faster, but more vram is absolutely critical and new stuff that is the same or worse than what I have from 3 generations and nearly 5 years ago is ridiculous.

    The battery life blows and the GPU likely won’t even work on battery. It will get donkey balls hot with AI workloads, especially any kind of image gen. This results in lots of thermal throttling. All AI packages run as servers on your network. If you are thinking along these lines if running your own models, get a tower and run the thing remotely.

    I manage, and need the ergonomics for physical disability reasons, but I still would prefer to have a separate tower to run models from.

    Anyways, you can sign your own UEFI keys to use any distro, but this can be daunting for some people. The US defense department has a good PDF guide on setting your own keys. The UEFI bootloader for the machine may not have all key signing features implemented. There is a way to boot into UEFI directly and set the keys manually but this is not easy to find great guides on how to do it step by step. Gentoo has a tutorial on this, but it assumes a high level of competency.

    Other than signing your own keys, the shim keys mentioned are special keys signed by Microsoft for the principal maintainer of the distro. These slide under the Microsoft key to keep secure boot enabled.

    If you boot any secure boot enabled OS, the bootloader is required to delete any bootable unsigned code it finds. It does not matter if it is a shimmed Fedora or W11. If you have any other OS present in the boot list, it should be deleted. W11 is SB only, and this is where the real issues arise.



  • Wrong question really. The better abstracted question is what class of hardware is comparable?

    It is faster than most routers, so anything along those lines. I like to look at what people have made with a Beagle Bone. That TI chip is a router class chip. Most projects that use a BB have a better intelligence and motivations filter compared to much of what pops up with a Rπ.

    Look and see if there are any OpenWRT images for it. The Rπ foundation stuff is super bloated by comparison. Most OpenWRT images are 8-32 megabytes. You start out with an ultra stripped down POSIX system, but OpenWRT has a built in package manager and all your typical packages needed to expand into a more regular Linux desktop user like experience. If there is an image for the board, you go from underpowered to overpowered monster for the OS image and overhead. It can be a fun challenge just to learn the lower level terminal commands when stuff like compgen is missing and you don’t even know all your commands. You also don’t have manpage docs and help is rare and sparse too. That was my catalyst for really learning grep at a more useful level.



  • 𞋴𝛂𝛋𝛆@lemmy.worldtoLinux@lemmy.mlSecurity Focused Daily Driving Distros?
    link
    fedilink
    English
    arrow-up
    4
    arrow-down
    3
    ·
    edit-2
    24 days ago

    Are you insane? Debian is a base distro like any other and runs more hardware than any other. It has all of the bootstrapping tools to get hardware working.

    Canonical is a server company and Ubuntu server is literally the product.

    Arch is absolute garbage for most users unless you have a CS degree or you have entirely too much time on your hands and don’t mind an OS as your life project. Arch abhors tutorial content in all documentation and therefore dumps users into a rabbit hole regularly. Pacman is the worst package manager as it will actively break a system and present the user with the dumbest of choices at random because the maintainers are ultimately sadistic and lackadaisical. Arch is nearly identical to Gentoo with Arch binaries often based on Gentoo builds, yet Gentoo provides relevant instruction and documentation with any changes that require user intervention and does so at a responsible and ethical level that shows kindness, respect, and consideration completely absent from Arch. Arch is a troll by trolls for trolls. I’m more than capable of running it now, but I would never bother with such inconsiderate behavior.