• 66 Posts
  • 1.5K Comments
Joined 3 years ago
cake
Cake day: March 21st, 2022

help-circle
  • Crazyy!

    Btw I am XWayland free since today!

    I have a list of recommended apps here

    Some apps need environment variables:

    Qt:

    • qpwgraph

    GTK

    • GPU Screen recorder, I guess

    Electron

    • Nextcloud Flatpak
    • MullvadVPN RPM
    • Signal Flatpak
    • (Element, I switched to the Webapp in Librewolf)
    • Freetube Flatpak

    You can use xlsclients -l to detect apps using XWayland.

    Some may even want to run apps through XWayland on purpose, like KeepassXC for Clipboard access or autotype. Lets see how long it takes to implement all the needed protocols.


  • Yes I know, and I want to try DivestOS one time. But they do incomplete patches.

    They cannot update the kernel themselves or even worse the firmware. The kernel needs to be built and patched for the specific hardware, GrapheneOS relies completely on Google here. And the firmware needs to be signed by the vendors, so no chance either.

    And especially baseband, cellular stuff has extremely many vulnerabilities in the code.




  • All Android phones have Google malware installed by default, as system apps, which means those apps can do whatever they want.

    So every piece of data you put on there is possibly tracked and collected.

    Then there are 2 more problems

    • the software is proprietary and cannot be externally wiped clean
    • the software is outdated

    This makes it vulnerable to Pegasus attacks and others. There are tons of secure practices to avoid getting it, like LTE-only, HTTPS only, encrypted and trustworthy DNS, sandboxed processes, blocked javascript execution from unknown websites…

    But still if the phone is outdated there are unpatched and publicly known security issues. Just spamming them at all phones is likely to succeed as so many people run vulnerable versions, as vendors suck.

    Then if you have pegasus, the only way for security is to reflash the A/B partitions, both. Factory reset is not secure as it will keep what is already in the system partitions.

    The firmware is protected and signed by the vendors, so it is likely clean.

    But Pegasus installs itself to the phone storage.

    If you A cant obtain factory images or B cant flash the phone at all, you cannot wipe it clean.

    So a good activism phone needs

    • trustworthy and minimal system apps / stock software
    • modern software updates
    • possible to reflash whole device externally
    • nice to have: ability to verify checksum of system partition, like GrapheneOS Attestation

    This makes them poorly pretty expensive. I think a slightly outdated GrapheneOS phone is okay though.













  • We dont live in such a perfect world. Linux has a small marketshare for non-server software, so packaging is done by your distro.

    You would need to have user-facing settings for Apparmor or SELinux to replicate what already exists with Flatpak.

    Principle of least privilege.

    Maybe you prefer native packages, but bubblejail or SELinux confined users are complicated as hell and both are pre-alpha in my experience.

    So yes you add bloat, dependencies etc. But you also add stability, a small core system, take load of OS developers and unify the packaging efforts so that it is done by developers not packagers.

    This reduces complexity a lot, as the underlying system is not as important anymore, and you can just use whatever you want. Software is separated from the OS.

    Flatpak is the only good format, as explained in this talk

    (Snap has no sandboxing outside of Ubuntu and is thus not portable, Appimages are inherently insecure)