• 3 Posts
  • 82 Comments
Joined 9 days ago
cake
Cake day: January 6th, 2026

help-circle








  • You could self-host a shared “source of truth” git repo that you access over ssh or filesystem. That can be anything from a USB thumb drive, a small clean server or a container on your existing desktop with ssh access, to an entire Forgejo deployment. Then you only need the “secret zero” of an ssh key to get everything set up and syncable.

    If fresh setup is more common, you probably have other parts like package installation and network configuration that you also want to automate. Enter configuration management like ansible or salt, image builders like packer or archiso, “immutable” solutions like Nix or rpm-ostree. Once you get there you typically manage that in git anyway and you could put your dotfiles repo as a submodule and copy them over as part of OS setup.

    If it’s just for once in a blue moon, manual ad-hoc copying gets you pretty far.

    No matter how you slice it I think you have to either frequently spend time syncing changes or just accept the drift and divergence between machines and the sources.



  • It’s been continuously improving. There are devices that are a hassle but you’re a lot more likely to have things Just Working compared to a few years ago.

    My understanding is that Ampere and others should run perfectly like any old x86 with a normal dist like vanilla Debian mostly due to a lot of hard work from individuals in the wider community.

    Much of the time, dtb (device tree) and device drivers are what it comes down to.

    For more estoric or finicky hardware, I think the dists with the best ARM support are Armbian, OpenWrt, and PostmarketOS.

    Jeff Geerling has been reporting a lot about his experiments. https://www.jeffgeerling.com/

    I wrote about getting Debian running on a device based on a popular Rockchip SoC last year. I assume the kernel situation has improved since trixie. https://blog.kumio.org/posts/2025/01/bananapim7-hvm.html





  • Some things that happen when I go to duckduckgo.com that also go against that:

    • Harvesting the third-party cookies it can (example: github.com)
    • Attempting to enumerate browser extensions
    • Attempting to enumerate crypto wallet addresses from extension wallets like MetaMask

    It’s extremely nosy. They used to do canvas fingerprinting until browsers started prompting about it.

    IDK about the claim of directly selling searches to IG and likely it’s a bit more convoluted than that (or OP has malware) but it’s a more believable idea than that of DDG actually being respectful of user privacy. There is absolutely no legitimate reason for DDG to gather this data for the purpose of providing their search service, yet they do.





  • Right, there’s the immutable root aspect. Guessing the other answer you got fills in the missing piece there and that Silverblue perhaps mounts the system flatpaks on a different r/w filesystem than the read-only /. Check output of mount to see.

    At the end of the day it’s up to you if you prefer to keep the system clean and run flatpak unprivileged, or centralize updates under root.

    The one catch I can think of with flatpak --user is that it obviously won’t work if /home is mounted with noexec, which is otherwise a good security measure (and IMO not doing that defeats a lot of the security wins of immutable distros). Unless you apply the same mounting strategy to the flatpak xdg user dirs, which is certainly an option but not something everyone will bother with. But then again maybe that’s exactly what you want anyway to make your Flatpak installations smoothly portable across distros.