So let me get this straight, they have a windows look by default, but using GNOME for whatever reason, then they give you the option to switch to something more vanilla GNOME but disable all of the gestures and workspaces, and then they advertise it like they invented gestures when they decide to stop disabling all of them
So yeah, people have gotten hrtf surround sound stuff going with pulse audio, some searching around that should get you where you want.
Butt your last statement about games being “unplayable” in stereo is pretty silly, too, so I want to call that out. Don’t be silly. They aren’t “unplayable”, you aren’t “locked out,” thats silly. 99% of people that have ever played that game played in stereo.
I mean when i switched from stereo to surround it was like a whole new chapter. I got pseudo wallhacks I’m never going back. But I agree it’d be pretty silly to play RTS or city builders with it. Anyways thanks for the lead!
You have probably invested a lot of time and effort into this, so please take this as constructive criticism.
Your security systems are probably not going to be sufficient, for a whole number of reasons.
Script Voting
The general public is not able to appropriately audit shell scripts. This extends even to sysadmins and more technical people. The people who can properly audit scripts are a minority, and they may not even be amongst your user base. Anyone who gets a script that “does its job” is going to upvote it as fine, because they may not even be aware of its malicious side effects.
Scripts will naturally need to evolve over time, so script updates will be a normal part of your system. Will the votes reset for new versions? Is there anything stopping someone uploading farming votes with valid scripts, and then backdoor the script once it gets sufficiently popular?
Is there any form of vote manipulation prevention planned? If not, bad actors can create an army of accounts and upvote their malicious content. Can you remove a users votes if they are found to be acting maliciously? Will it even be possible for you to tell the difference between a naive user who doesn’t understand the maliciousness of the script, versus an account actively increasing the rating of a bad package?
User Reputation
This seems easy to game as well. Upload a host of valid scripts, gain reputation, and then when ready, upload malicious scripts.
Collaboration
Allowing non-maintainers to edit and upload scripts seems like a wildly bad idea. There must be some level of maintainer approval for that right? Still will have the same issues, easy for someone to build trust on a script repo and then exploit it when it suits them.
None of these issues are unique to your site, pypi, dockerhub etc have all hit these issues in the past.
I think the only real answer is to have very strong human moderation, but I fear that if your site takes off, the workload will rapidly spiral out of control. Otherwise, interesting idea, Good Luck!
Thank you for the feedback. I think I will remove the voting system for now while I figure out of solution. I will probably not be adding the user reputation system, unless I figure out a way to do it without facing the problems you have mentioned. As for collaboration, I will add a feature allowing app maintainers to set whether or not non-maintainers can add scripts without maintainer permission. Thank you again for the feedback, it was very useful!
It does have a discussion system at the moment where you can comment on a script, but there is no system to rate the script and have the total of all the ratings combined.
Have you considered some form of CI? I.e: Spin up a VM, run the script, reboot, report what changed? Might be a little expensive, but could help auditing?
I have, but I think it would be a bit too expensive on my VPS, but might use it if my site ever catches on. I have also considered using something like Try, but it isn’t a full sandbox.
Very understandable. And from a security standpoint not necessarily indicitive of anything. A good malicious script would just check its environment first.
I wholeheartedly agree, yet this is the same for stuff like the AUR, every PPA, or even just blindly copy & pasting inductions from some blog - all of which are very popular. (Just to name some examples that are closer to what op wants to do).
I still wouldn’t use scripts from a random dump site because they are just likely to mess up the os with junk and cruft that will be there forever. But fundamentally from a security point of few its not necessarily worse than what many are doing - simply because it doesn’t get worse than blindly executing stuff from sources missing the reputation to justify trusting them.
Yup, there is a lot of prior art on how to get this wrong :(, and I dont know of any good solutions either. Curation and moderation are probably the best case, but arent bulletproof either.
I raised this not to kill OPs project, but to make sure they go into it eyes open. I personally would be very uncomfortable if my website was being abused to distribute malware, so they deserve to at least be aware of the risks.
I think one puzzle piece of improvement is flatpak:
It has a verification system, such that users can see which apps are packaged by their developers. For those apps, this eliminates the need to trust a separate maintainer entirely
It targets almost all linux distributions with a single package. This cuts down the packaging effort for covering the majority of the linux landscape so much, that the number of package maintainers required to be trusted collapses - in the ideal case to just the developers themselves as in the first bullet point
It makes use of sandboxing, so in case of a malicious app it (in theory) only has access to the stuff the user gave it permission to.
In reality there’s a plethora of problems obviously:
verified apps are the minority
some people don’t like the additional storage needed for runtimes (although the more flatpaks you use the more runtimes can be shared and its overall impact gets smaller)
A lot of apps do not yet use all the portals, and require the classical full access to the system to work properly (in some cases the user can still remove some permission if certain features of the application are not needed by them though). This is just a question of ongoing development work, and hopefully we reach a point in the near future where a flatpak app without tied down permissions raises eyebrows
Nvidia nuked power managment mid-Maxwell. Gladly, at least one vulnreability has been discovered, that theoretically allows nouveau load their power manager.
It's rare that I get to feel anything remotely comforting about not being able to afford new hardware, but if I understand correctly, my BIOS-only dinosaur can't be exploited.
Still vulnerable to thousands of other exploits no doubt, but not this one.
There’s not really any benefit of running Manjaro over Arch, it will only introduce problems over time. If you want a “pre-configured” Arch with a nice installer, go for EndeavourOS, it’s great!
You can but there isn’t a lot of choice, Octopi is pretty much the only other pacman GUI besides Pamac that’s sufficiently fleshed out. All the others are either just package searchers or CLI-only.
And Manjaro also has the Manjaro Settings Manager, which includes the kernel management module and the hardware drivers management module.
3 and 4 are nice but as something someone would set themself. Too much character and detail to be the default when Plasma do not target any specific demographic.
1, 2 and 5 are nice abstract wallpapers, but honestly boring as we have stuff like that for years.
6 is the best. This is wallpaper with some style, but not too much character.
Edit: Just in my opinion and for my eye of course.
Thanks a lot for your answer. How would you encrypt a server? Typing a password every time it boots isn’t possible for me, since I would need a monitor for my headless server.
I use Luks/Tang to unlock the server at boot from another computer that is always on too. If that one is down I’ll need to type it or power the other PC on, but otherwise it auto decrypts for me as long as I’m on the same network.
Is this for your home? If it is, you don’t really have to worry about someone stealing your desktop. If someone breaks into your home, they’re looking for quick cash and jewelry and TVs. They’re not going to bother stealing your server to dig through files for something usable.
I’ve had quite a bad experience with police for example.
30 cops raided my home because of something trivial (I ordered a bit of non-psychoactive CBD-weed, which is, even in the most restrictive country you can imagine, ridiculous).
Of course, I got the whole experience-pack, including strip searches and confiscating all electronics.
Even though I believe them getting hold of any data wouldn’t have changed much, I’m still glad I had my devices encrypted.
Just knowing they didn’t see my cringy pictures of my teeny-me, where I discovered Snapchat filters, is a big relief. 😅
Yeah… that traumatized me a bit and maybe that’s the reason I’m worrying.
Also, you could never know what will happen in the future. Maybe my GF will turn crazy tomorrow and use those embarrassing pictures against me. Who knows?
I believe everyone should use encryption, even if they don’t have much to hide…
If Linux, use LUKS but you need to enter the passphrase at boot, you can securely put the key in TPM2 I think (à la Windows) but it may be complicated to setup, or just seal the phrase in TPM2 but if you boot on grub you can break grub and replace init with a shell in boot option and have access to the system I think :-/ but a simple crackhead thief would not understand that.
You can also have the key on a USB key, but if on the server and the server get stolen, it’s useless. You can setup a “anywhereUSB” and have your USB key in another room/place, etc, there is others possibilities.
I wanted to unlock with bluetooth but having the bluetooth HW driver and stack in initramfs was nightmarish a little bit :-/
Windows 11 finally made me tell my boss “i’m not using that anymore.” I’ve used Linux exclusively at home and Windows at work, but got fed up just like you. I have a VM for testing purposes as the security admin and it’s actually improved my workflow since I can tear down and bring up VMs instead of using my main OS for testing.
Glad to hear you’ve had a positive switch as well.
linux
Top
This magazine is from a federated server and may be incomplete. Browse more on the original instance.