• 0 Posts
  • 32 Comments
Joined 11 months ago
cake
Cake day: November 4th, 2023

help-circle

  • I accidentally overwrote /etc/passwd once and I allowed /boot to run out of space during a kernal update and I created a local user with the same user that was also on the realm/domain that I had joined and various bash script issues.
    Some stuff I’ve had to fix that someone else did:

    • named a file rm -rf
    • rm -rf /bin instead of ./bin – Also the fact that they had sudo was crazy and also I guess this was the second time
    • chmod -R 777 /
    • Various software bugs running swap out of space or hitting the inode limit by creating files over and over again with a timestamp in the filename and having to remove all of them because there was no backup to the OS
    • Someone disabled SELinux because something wasn’t working but didn’t tell anyone – ugh
    • Compiled java because they googled some issue and followed some old tutorial without understanding anything instead of using alternatives and symlinked the old java from /bin to /home/theiruser/java – had sudo because he was a Windows domain admin.
    • Cybersecurity guy didn’t know what some VMs did so he turned them off and figured he’d find out if/when someone complained. Caused a massive core services outage.
    • Same Cybersecurity guy deleted a bunch of data because he wanted to see how the sysadmins would respond and witness backup restorations. He did not inform anyone.
    • Cybersecurity guy above still has Domain Admin and sudo everywhere. I would have personally removed his privileged access regardless of what ‘CyberSecurity’ management thought but I was leaving for a new job by then anyway so I figured I’d just let them eventually lie in the bed they made.

    There’s more but I don’t want to keep going because it is Sunday and I don’t want to ruin it.








  • I disagree about ClamAV in-so-far as its vanilla virus signature database. You really should use some third party ones though you have to be careful since some like specifically malware patrol are way too general. For example, malware patrol will identify any document mentioning any drive.google.com URL a virus.

    In regards to MP, I actually submitted the offending signature to MP support and the CSR told said and I quote “Unfortunately that is not a false positive, there is confirmed malware hosted at drive.google.com.” It caught my attention because a bunch of READMEs from some github projects and some HTML files ended up in the quarantine. I asked if future signatures would include this general URL since I’m going to blacklist this specific signature and was told basically ‘yes, probably’.

    I do recommend third parties though and most are free for personal use. Some require a key and therefore some sort of sign up but it isn’t terrible except perhaps in regards to where I’m posting, some would consider it so.




  • Your immutable OS stays stable. For example, running a sudo pacman -Syu with a bunch of stuff from AUR in your Arch container for example will not bring down your OS or otherwise make it unstable. The immutable image you first install has been tested and it is the same image as the testers – same with the upgrades and updates, so long as you don’t overlap the image with rpm-ostree in this case.

    Immutability keeps your OS stable and if something does happen to go wrong, you just roll it back.

    If that isn’t something you need/want then that’s not something you need/want.


  • Yes, though keep in mind containers aren’t like VMs so the hardware isn’t virtualized or anything. The root system and everything in it is still immutable as well. In usage, it doesn’t matter for the container but it isn’t changing the root since what is writable to the container is outside of the root.

    Using containers this way is the way Silverblue was intended to be used for by the user and pretty much any other immutable distro of note.




  • In a memo sent to employees Mozilla says it wants to bring “trustworthy AI into Firefox”. To help it do this sooner it’s merging its Pocket, content, and AI/Ml teams.

    That’s pretty concerning. It could go either way but I assume they are going to try to shove more sponsored content in an effort to further monetize Firefox in spite of getting hundreds of millions of dollars a year in donations. Maybe I’m just cynical about Mozilla though.


  • LibreOffice is compatible with Microsoft’s OOXML spec. They sold every suite on it in the nearly 20 years ago to stop fines from the EU. They sold competing suites on it instead of using anything else available.

    Microsoft however never actually fully supported their own spec and will save as “OOXML Transition” or whatever they call it now because they’ve been in ‘transition’ for nearly 20 years but still have proprietary blobs inside of it. You can however make MS Office save in OOXML Strict which is supposed to be compliant to the now ISO spec that LibreOffice actually supports.

    This isn’t LibreOffice’s fault.


  • Pretty much sounds exactly like I was thinking of doing for the DIY. miniATX/ATX for all the expansion potential + SATA ports + large case to handle it + a CPU with 6 to 8 cores at least. Case would probably be a rack form factor but it doesn’t really matter. Probably 32 GB of RAM + a Quadro GPU/Some cheap AMD GPU or something cheapish like that strictly for encoding + Proxmox + TrueNAS or perhaps just unraid. Probably no desktop environments unless something really needs it for some reason. Not sure if I’ll go with a motherboard with an ILO/IPMI with its own NIC + vlan or not.

    I was going to mix SSD/NVME for performance (if I mix these two, it’d be two separate performance tiers) and HDDs for capacity. Probably two 1+ Gbps NICs bonded and maybe a LACP port channel down the line. VPN with killswitch of course.

    I could def. go cheaper on the hardware if I just wanted to use docker/podman mostly but I want VMs too. I’ll probably manage updates and backups of what I really care about off network via ansible + rclone + restic repos. I might would use zram + lz4 for most of my VMs because why not.