• 6 Posts
  • 51 Comments
Joined 2 years ago
cake
Cake day: October 21st, 2024

help-circle
  • I don’t need to tell you this, but Nix is pretty good:

    • NixOS configurations force you to declare attack surfaces (user groups, open ports) explicitly
    • Nixpkgs is the largest package repository ever, so you rarely have to rely on 3rd-party packages
    • Nixpkgs tends to ship security fixes quickly
    • NixOS and many of its packages are open source

    But it comes with a few pitfalls:

    • Only import Flakes or modules from trusted authors. I would avoid the NUR completely, because it incentivizes the opposite
    • Some far-reaching security fixes (such as the recent one for PHP) trigger long rebuilds before they reach the main nixos channels. Use nixos-unstable-small to override vulnerable packages in the meantime

    I use LUKS disk encryption and Lanzabote secure boot to secure my data at rest. Not because I’m scared of anyone breaking into my house, but for the peace of mind that the data is gone once I erase the encryption key.

    For privacy, I use LibreWolf with default security settings and a VPN.

    Other than that, I don’t feel the need to harden my personal computer. That is of course a different story for servers with open ports. The NixOS wiki entry for Security also contains some useful links.















  • Bricked@feddit.orgtoMemes@sopuli.xyz•systemd
    link
    fedilink
    arrow-up
    24
    arrow-down
    1
    ·
    6 months ago

    … What you’re refering to as GNU/Linux, is in fact, systemd/GNU/Linux, or as I’ve recently taken to calling it, systemd plus GNU plus Linux. GNU/Linux is not an operating system unto itself, but rather another free component of a fully functioning systemd init system made useful by the systemd daemons, shell utilities and redundant system components comprising a full init system as defined by systemd itself.

    Many computer users run a modified version of the systemd init system every day, without realizing it. Through a peculiar turn of events, the version of systemd which is widely used today is often called GNU/Linux, and many of its users are not aware that it is basically the systemd init system, developed by the Red Hat.

    There really is a GNU/Linux, and these people are using it, but it is just a part of the init system they use. GNU/Linux is the os: a collection of programs that can be run by the init system. The operating system is an essential part of an init system, but useless by itself; it can only function in the context of a complete init system. GNU/Linux is normally used in combination with the systemd init system: the whole system is basically systwmd with GNU/Linux added, or systemd/GNU/Linux. All the so-called GNU/Linux distributions are really distributions of systemd/GNU/Linux!