• 2 Posts
  • 68 Comments
Joined 3 years ago
cake
Cake day: April 19th, 2022

help-circle






  • applications from the Play Store or App Store are something people have to get and use everyday

    I haven’t made the full switch to mobile Linux yet, but my Android phone has 0 proprietary apps besides the firmware and it’s 100% usable

    in my country, if you exclude browser-based banking no bank will work

    Well, the question is why are you excluding web banking? While it’s less convenient at times, banking apps collect every piece of info about you they possibly could collect, they try to prevent you from “messing” not only with the banking app, but with the phone itself - they are one of the most egregious cases of “normalized privacy invasion”, so web banking is much preferable to banking apps. If you’re allergic to webapps for some reason (which would be a very weird thing to say for someone who installs banking apps), fine, switch to a bank that allows doing operations via SMS (that’s the only feature I miss from Sberbank).

    the NFC / contactless payment system here requires either Apple Pay, Google Wallet or a proprietary app develop by a banking alliance

    Why are you using contactless payment? Unsatisfied with the amount of data your bank collects, you want to give the same data to Apple/Google? What’s the problem with just carrying a card with you? I genuinely don’t understand. This certainly isn’t a “100% unavoidable requirement”, but just a fad you didn’t even think whether you could do without

    Govt provides electronic versions of your identity card, driving license and a ton of other cards related to the govt that also require an Android/iOS app they make…

    That’s absolutely true, which is egregious. You should petition your government to open-source those apps (public money = public code), you should reverse engineer those apps to get their functionality without the proprietary code (if they just show a barcode/qr code/picture, it’s easy, but it gets harder if it uses NFC). Either way, this isn’t something you “need”, as carrying your documents around really isn’t a problem… for me, anyway, YMMV I guess

    Even something simple like setting up a TP-Link Tapo wireless security camera will require an app these days.

    …first you buy an IoT device that connects to “the cloud”, then you say you need proprietary software to access it. Of course you do, that’s the kind of device you bought - the vast majority of IoT devices are made with zero regard to the user’s privacy and security, to hackability or right to repair.

    That said, it’s very easy to find hackable devices if you do the bare minimum research. Examples from my home - Valetudo (FOSS robot vacuum firmware) on Viomi V2 Pro, Tasmota (ESP32 firmware) on an AiYaTo light bulb. This is not a problem with mobile Linux, but rather you choosing a device that’s made to collect data from your phone.

    In conclusion, everything you listed so far isn’t a problem with mobile Linux, but a problem with your approach to software/hardware freedom. Chances are, you aren’t a hacker, and by extension aren’t a part of the target audience of a Linux phone. That’s fine, but don’t pretend there’s some insurmountable barrier preventing anyone from using it - it’s just that you don’t need it. Waydroid exists, which makes all of the claims in your comment invalid (besides maybe banking apps which may detect Waydroid), but you won’t consider Linux phones viable anyway - because, again, you don’t need it.






    • full disk encryption on everything except the router (no point in encrypting the router)
      • the server doesn’t have a display connected for obvious reasons, so I’m manually unlocking it via ssh on each boot
        • obviously, the SSH keys are different, so the server has a different IP in initrd. That said, I still don’t have any protection against malicious modification of initrd or UEFI
    • the server scans all new SSL certificates in realtime using certspotter and notifies me of any new certificates issued for my domains that it doesn’t know about (I use Cloudflare so it triggers relatively often, but I still do checks on who the issuer is)
    • firewall blocks outgoing 25 so nobody can impersonate my mailserver




  • In short, Nix reduces the setup time, both for your system and for your projects. If you find yourself spending a while setting stuff up (for example, after a reinstall; or maybe you want to run your project on another PC and need to install the right dependencies), Nix will help. Otherwise, if your desktop is vanilla Fedora or whatever and you don’t do much programming (or you don’t have any dependency management problems), Nix probably isn’t for you.



  • sway with tabs (i usually dont use actual tiling)+4-5 workspaces

    waybar for status display and on mobile also for menu access

    rofi as the app launcher (i also plan to write a proper rofi menu for my phone for quick access to useful commands/config but it’s heavily wip)

    i patched sway for push to talk because wayland spec doesnt support keybindings in a way required for push to talk for now

    i also plan to patch it on the phone to completely forbid fullscreen apps (as they hide the menu which i use for workspace/window switching) and show the window bar on all windows (for example, firefox extension/downloads popups)



  • strictly speaking, NixOS doesn’t have repositories.

    NixOS has “derivations” (rules are written in the Nix language to generate a script that builds a package, which is called a derivation - yes, everything is built from source to the extent possible/reasonable) and “platforms” (the system that builds the derivation OR the system the derivation is built for). A “platform” is e.g. the CPU architecture, the libc used, the target kernel (there’s most support for Linux and Darwin, which is the macOS kernel, but e.g. FreeBSD is supported to some extent too). The derivation code may well be shared across platforms, though often platform-specific workarounds are required.

    Of course, different platforms have different support. Some platforms have derivations from nixpkgs (the NixOS git repo) regularly built for them and put into the official binary cache (which stores the derivation outputs, i.e. ready-built packages for a certain set of inputs, which generally match what you would’ve built from source because Nix strives for reproducibility, you’re still free to override a package’s inputs and build it from source). linux-aarch64 is one of such platforms. Other platforms may only have a small set of core packages like gcc built for them, or simply require building absolutely everything from source.

    The reason nixpkgs is not a repository (though I guess you could call it one) is because it only provides rules to build a package, but not the package itself. Some derivations (e.g. for Gog games) even require you to add some non-redistributable files to the Nix store manually. The derivations may or may not build correctly for each platform they’re supposed to work on.

    The reason the binary cache is not a repository is because it’s just a cache for nixpkgs - it stores every derivation’s output (if the build doesn’t fail), even if that derivation is one that downloads a package’s source code (yes, that’s a derivation too), even if the derivation is from many years ago (which has historical value, as you can revert nixpkgs to an old version and still be able to download prebuilt versions of packages).

    Together, they form something like a repository, but it’s still way too different. For example, unlike on Arch, I can stay on the same nixpkgs version for a long time without updating, which I really prefer because I have to build 3 kernels on each update, since I’m syncing the nixpkgs version of my 4 NixOS devices, only 1 of which doesn’t require a custom kernel config. Or I can always revert back to an older version of nixpkgs if a new one breaks something and it will still work. Or I can fork nixpkgs and change some stuff, and the stuff with changed inputs will have to be rebuilt locally, with stuff that didn’t change still available from the binary cache.