Look, I appreciate your enthusiasm, but you are treading into virtue signalling territory and your article has the superior tone of those who bought electric cars in the late 2010s to lord it over the rest of us.

Using Linux is not going to stop your doom-scrolling, nor is using Linux by itself telling the big corpos anything at all. Stop conflating using Linux with “sticking it to Facebook”.

Linux is a tool, and it is a tool that allows freedom of its use. That’s it.

You didn’t really include any details about your current VPN setups, your subnets, your routing rules, etc for anyone to give you a useful answer.

I switched to using Radicale a year ago, and I use my android contacts app to add and maintain that info. CardDAV has enough fields for me to add.

Cinnamon, maybe… But KDE plasma? You must be joking. How do you get KDE plasma down to 300 to 500 mb memory use?

There’s a good reason xfce is the de of choice for low-resource systems like raspberry pi.

Like others here, I use open street maps data, but I’ve found comaps to be the best frontend to it. I can approach the navigation functionality of google maps with it.

Typically this is achieved in x11 with x forwarding. Performance won’t be great.

However: you may want to investigate using a hypervisor and a VM for each seat, and a dedicated GPU for each seat. To share GPU between seats, you will need a GPU and motherboard that support sr-iov, which is hard to find, hard to use, and expensive.

I built a hyper-converged box like this and I can tell you the GPU isn’t the obstacle, it’s peripherals. Mice, keyboard, video output, that is what people want to be flexible.

When I have to console into the old Solaris boxes at work, I’m reminded both of how many quality-of-life enhancements we enjoy on modern Linux, and also why I will always default to vi as my editor.

ntfxfix should only have to be done once, then you can remount. Unless you are using these partitions in windows, in which case you’ll need to do it every time.

777 is read/write/execute for owner, group, and world, respectively. It’s the most permissive POSIX permission that can be set. If something can’t write on a 777 umask, then either the filesystem is mounted read-only, or something is deeply wrong with the storage.

drives are NTFS

You probably have the clean unmount bit unset for the NTFS partition. This is trivial to bypass, but I would suggest not using NTFS in Linux, NTFS is not a great fs and Linux support is… OK.

Really great article.

I was a bit critical of your last post on kernel init stuff, but this one is well laid out and gets quickly to the material at hand: all applications make the same system calls.

Keep it up, I’m going to follow this.

My LDAP PTSD is coming back…

I’ll make the following LDAP assumptions:

• LDAP directory is configured and available
• LDAP uri is configured and a lookup on system level is working and returns the correct POSIX uid/gid with LDAP query
• no POSIX conflicts on the client (no object in passwd has uid/uid 11004) I can assume this because the fail over is root
• LDAP search base is configured and returns expected POSIX values

And I’ll make the following postgres assumptions:

• pg_hba.conf is configured for LDAP server address, port, and search base
• postgres can instantiate and connect to its dbs using LDAP with ldap

Finally, I’ll assume that your nfsv4 mount is active and that POSIX operations work at Pam - level tests.

The line

group:      files [SUCCESS=merge] sss [SUCCESS=merge] systemd

Seems weird to me; either you add success clause to both uid and gid, or none, but not one and not the other.

This would also hint that Pam has not been updated to use LDAP.

That’s where I’d start.

Side note: LDAP is by default unencrypted on the wire, so to complete this exercise, you may want to setup secrecy on the server. This is especially important for db creds.

If everyone has a copy of my passwords and authenticator keys, that wouldn’t suddenly make 2 factor auth a compromised idea.

Not sure how this relates. If you’re saying it was a good idea at the outset, then sure… If the keys hadn’t almost all been leaked by AMI and Phoenix. MS was supposed to have created a Microsoft Certified hardware vendor program for this, which fell apart pretty quickly.

Secure Boot is a joke, both practically (there are many, many tools in use to bypass it) and in my professional circles, it is considered obsolete like WEP. My audit controls for Secure Boot demand that an endpoint management solution like InTune is deployed.

You don’t have to take my word for it, obviously. I’m not trying to tell you how to live your life.

Secure Boot keys are considered compromised.

https://arstechnica.com/security/2024/07/secure-boot-is-completely-compromised-on-200-models-from-5-big-device-makers/

If you are recommending secure boot as a security measure, you should stop doing so.

Nice, and good job.

With respect:

• You are describing the init process, after the boot stuff is done. Not sure if you meant that or not.
• vmlinuz is the bootable kernel image distinct from the kernel itself. It contains the compressed bootable ELF kernel image (which itself contains bvmlinuz) and gzip decompress function, bsetup code, bbootsect system.map, and a handful of commands for the kernel image to bootstrap itself.
• Kernel space doesn’t stop once user space is allocated memory and initialized, they both run at the same time. Maybe I read that wrong, but it didn’t seem right to me.

I want to be careful here not to discourage you, this is great exploration!

I realize I’m handing out unsolicited advice here, but when I was first learning about Unix/Linux kernels in the Solaris and HP/UX days, the thing that helped the process “click” for me was compiling a kernel and building an ELF. And if you’re going to continue on this journey (which I hope you do), you should probably read a bit on memory segmentation and broadly about assembly instructions.

Good luck!

Are you just reverse-engineering this for fun, or are you trying to learn how qemu builds on a bootstrap?

Permissive licensing can create what is effectively “software tivoization” (the restriction or dirty interpretation of distribution and modification rights of software by the inclusion of differently-licensed components).

The Bitwarden case is a good example of how much damage can be done to a brand with merely the perception of restrictive licensing. obviously, bitwarden has clarified the mess, but not before it was being called ‘proprietary’ by the whole oss community.

So I don’t think op is referring to direct corporate takeover, but damage caused by corporate abuse of a fork.

Modern phones (after about 2016) use two boot slots for for the bootloader.

“Italian”?

I’m also on not-quite-supported hardware (surface pro 6) and I feel your pain. We have a special kernel for most of the functionality, but neither camera.

At this point, I’m grateful for a commodity x86_64 tablet with most everything else working perfectly, so it’s a small price.

Saving for later, pretty cool.