First only their flagship models. Economy of scale, it is likely that other models might adopt the same chips.

Though as we see from Pixels you can still buy top tier chips without MTE, or with shorter firmware updates. The EU mandates 5 years afaik but that is less than the 7 or so that Pixels have.

I am happy I got a Pixel 10, even though it still has bugs due to missing drivers and configurations I suppose.

It is likely that Motorola will still not produce secure enough lower end phones in the future.

There is a microG compatibility table, it is only a limited subset but by far less invasive than google play services

To be honest they also kinda suck for not promoting coreboot at all.

They gave some coreboot devs a few laptops, didnt like the result and gave up. Meanwhile people are still working on that in their free time, apparently it isnt even that complicated and kinda just works?

I would generally not recommend running official google apps at all. MicroG works quite well for the things you actually need. I would research on how to flash microG with adb and add the correct elevated privileges.

Or if you need to flash gapps, use this file to only flash the needed apps like playstore and play services and nothing else.

Then afaik you can still disable them on the main profile and only use them in work profile (shelter, island), which would be a big privacy advantage

uBlue also has other variants like Aurora or Bluefin

This was an about:config before, didnt actually need a patch

Yes but what the hell is going on in that linux install window

Somehow remove edge

I am in the EU and the removal doesnt do anything. WinUtil and BulkCrapUninstaller both fail too

Yes I am also a fan of atomic desktops for mass deployments of tailored systems

I just dont like the main ublue images or Fedoras main ones. I used kinoite-main from ublue for 2 years or so, and added a bunch of changes as overlays. It was kinda bad but also kinda good. Things like no longterm kernel being available at all for example.

NixOS is waay harder to use, also less secure for example from the perspective of a non-wheel user, like they have no polkit rules. You have snapshots, automatic updates etc though. And I just replaced my kernel with a longterm cachyos build which also works!

Fedora atomic desktops are fantastic, I really like ostree (which they get rid of, well…) but as soon as you need to change something, you have problems.

I have 3 machines and all have different configs so not even there could I use the same image really.

Well, I tried installing MicroG before and that doesnt just work. You need to flash it as privileged module and put an xml file somewhere to give it elevated permissions.

I found this issue, there seems to be a hole in the docs. The same user also opened another ignored issue that does seem to match my impression of very lacking docs and a low focus on security for microG too…

Yeah that would be the “cloud native” way XD

I have used Gitea actions and container registry before, it is okay.

It is the fastest, nothing more

No transparent compression is important too, you will need more storage than when using BTRFS with zstd compression

Also no deduplication, so again more storage

Hello from the fediverse!

Your specific NixOS problem it not unique

They do check some packages but not all, only the critical ones. And there is a tool to check if there a hydra build failures before updating.

But yeah it is problematic that NixOS is primarily source-based, most importantly as hydra builds everything and if a binary is not there, that is like always a build failure. Requesting those infos from hydra all the time also makes no sense, so this should really be solved on the branch/channel level

VanillaOS and OpenSUSE immutable ones use BTRFS snapshots dont they? Not sure how VanillaOS does their A/B root.

These systems always involve copying things around and deduplicating them.

Filesystem snapshots are well deduplicated, nixos does that well too though.

On fedora atomic desktops /etc is completely writable so you can configure some things. And using rpm-ostree it is possible to do weird things too

But you should have a look at how Bazzite is actually built. A bunch of containerfiles, scripts, ujust files, … not hard to understand but kinda messy. And you kinda need a server. On NixOS you do this on your machine.

And do note that there are presets online and people help you set things up.

I can recommend universal blues base kinoite image as it includes distrobox, all video codecs and has an nvidia variant for the poor nvidia users

Works, fedora atomic desktops with ostree and no changes. If you want changes using rpm-ostree that will become really slow.

NixOS is also immutable and if you dont stumble over something that needs compilation as it is not in the binary caches, it runs very fine on lower end hardware like my Chromebook. Not a potato but pretty damn slow

The install docs are extremely barebones, incomplete and unsafe

Also their way of installing is hacky and incompatible with verified boot

IodeOS is significantly better for this use case, although they support less devices. They base off LineageOS but the installer, installation method and the resulting OS are better, more secure and private.

If you consider buying new, a Pixel 10 or 9 with GrapheneOS is still the best.

If not that, maybe CalyxOS is fine currently? I dont expect it to be much better than iodeOS.

Stay away from /e/OS. Be aware that “LineageOS for microG” is a separate distribution and only ships updates every second month.

There is also APXOS which would be better than iodeOS I guess, but limited device support.

RestlessOS is very interesting but I dont know how the kernel is updated. Really worth considering though

Framework if you dont mind relying on the Community for coreboot support.

Otherwise System76, Novacustom, Starlabs, Nitropad, … there is a handful of sellers of coreboot laptops which is a market you should totally invest in. Coreboot is amazing and there is quite a variety!

Also not to forget Chromebooks, but they are extremely limited and mostly unrepairable.