It would be if it wasnāt for NVIDIA, as usual. On Intel/AMD, you assign the seats, the displays light up and youāre good to go, pretty much works out of the box, especially on Wayland.
But for NVIDIA yeah maybe a VM is less pain since NVIDIA works well with VFIO.
Iām currently watching the progress of a 4tB rsync file transfer, and iām curious why the speeds are less than the theoretical read/write maximum speeds of the drives involved with the transfer. I know thereās a lot that can effect transfer speeds, so I guess iām not asking why my transfer itself isnāt going faster....
SATA III is gigabit, so the max speed is actually 600MB/s.
What filesystem? For example, on my ZFS pool I had to let ZFS use a good chunk of my RAM for it to be able to cache things enough that rsync would max out the throughput.
Rsync doesnāt do the files in parallel so at such speeds, the process of open files, read chunks, write chunks, close files, repeat can add up. So you want the kernel to buffer as much of it as possible.
If you look at the disk graphs of both disks, you probably see a read spike, followed by a write spike on the target, instead of a smooth maxed out curve. Then the solution is increasing buffers and caching. Depending on the distro thereās a sysctl that may be on by default that limits the size of caches to prevent the āI wrote a 4GB file to my USB stick and now thereās 4GB of RAM used for it and it takes hours after finishing the transfer before itās flushed to the stickā.
It doesnāt seem to have any outrageously complicated dependencies to work, just C++, Boost and a few other recognizable names, at least at a glance. They also seemingly have an ArchLinux package, which means itās likely to at least be buildable on latest everything. Mint will fall in between, so the odds itāll compile are pretty good.
For maximum performance you probably want to skip virt-manager, virt-viewer has a hardcoded FPS cap.
If you use QEMU directly and use virtio-gpu paired with the sdl or gtk display, and OpenGL enabled, you can run Ubuntu at 4K144Hz no problem. The VM is near imperceptible, and it works out of the box, thatās not even touching the crazy VFIO stuff.
If I create a OSS app with analytics to detect & log crashes with feature use, is it a bad practice? I think analytics is really helpful in finding:-...
Itās not even always necessarily about trust, but risk management as well. Iāve definitely coded a crash handler that exposed my database credentials in it. Thereās also the network aspect of it: your ISP/job/coffee shop can see the DNS request and TLS server name from the telemetry ping. That can be used to track you, or maybe you trigger some firewall alarm at work because of the ping.
Weāve kind of just started accepting that most apps will phone home and that thereās constantly some chatter on the network from all those apps. But if you actually start looking at what all your devices and apps are doing in the background with say, a PiHole, itās pretty shocking.
Iām not that paranoid and would certainly accept some level of telemetry if asked nicely. āHey Iām a small dev, I appreciate receiving detailed crash reports to make the app betterā. And as a developer, users might be willing to offer way more than what would be reasonable to do in the background. I might even agree to submit a screenshot on crash, but if and only if Iāve been asked before and told what itās used for, and I get the option to disagree if Iām going to be handling private information and donāt want to risk my data be part of a stack trace.
I currently have a server running Unraid as the OS, which has some WireGuard integration built in. Which Iāve enabled and been using to remotely access services hosted on that server. But as Iāve expanded to include things like Octopi running on a Pi3 and NextcloudPi running on a Pi4 (along with AdGuardHome), Iām trying to...
Any reason the VPN canāt stay as-is? Unless you donāt want it on the unraid box at all anymore. But going to unraid over VPN then out the rest of the network from there is a perfectly valid use case.
Hi everyone. I have found many ghost comments in posts. Like one of the posts has 300+ upvotes and 28 comments but when I opened it, there were no comments. I tried different Lemmy apps and itās the same in all of them. Which leads me to believe that it has something to do with defederation done by Lemmy.ml. Which instance has...
Keep in mind, defederation is bidirectional. You can end up on an instance that doesnāt defederate anybody but is being defederated by some major instances and end up worse off. Also, communities are bound to an instance so even if your instance doesnāt defederate with another, the instance that hosts the community might, which also doesnāt solve anything.
Also lemmy.ml had to restore from backup monday because postgres shat itself, so if the post is from monday or around, itās possible it was simply lost due to the technical problems.
Thereās also some federation problems with 0.19.0 and 0.19.1, so itās possible itās been attempted to be delivered to lemmy.ml but failed due to load or whatever.
You didnāt give any details or examples so we can only speculate. We troubleshoot federation by establishing patterns, like from what instance are the missing comments from, what instance hosts the community.
Addendum: Iāve also been experiencing occasional ghost posts, and Iām on my own instance, so there might be some stuff going on thatās unrelated, because I sure didnāt do anything. If they were deleted or retracted I would see them because Iām admin, I see everything.
For KDE specifically I think thereās a dbus interface that can be called to switch it. You can find it with QDBusViewer or D-Feet.
Iād imagine XWayland would follow the same since itās essentially a Wayland client. But if you ran the xmodmap under xwayland, that may have inverted it in xwayland, and itās already inverted in KWin which would double invert it aka put it back to default.
Otherwise doing it at the evdev level will definitely work. Itās a bit of a nuclear option but if it worksā¦
The ads come from an ad network where there is very little visibility into whatās going to be displayed in your app. And bad people also keep managing to get their ads published even though the ad network doesnāt allow them
And it all ties into the whole targeted advertising, where they also make sure very few people get the bad ad, and tries to target people they think may be more susceptible to these kinds of tactics. Depending on the amount of interactivity allowed, the ad can even display two different things if it deems you too savvy to fall for it.
Itās basically unescapable unless you only use apps without ads, or pay for the ad-free versions.
The whole advertising industry is sketchy, more news at 10.
If we allow derivatives, Iād say SteamOS despite being Arch. Itās putting Linux in non-technical peopleās literal hands and itās not a locked down and completely different platform that happens to run Linux like Android is. Itās almost designed by Valve to give people a taste of Linux by the addition of its desktop mode, and people that would be modding consoles are now modding SteamOS and learning how much fun an open platform can be. Iāve seen people from sales talk about their Decks on my work Slack.
Otherwise, NixOS, no contest. Itās been a really long time since weāve last seen a fundamentally different distro thatās got some real potential. For the most part, Arch, Debian and Fedora do similar things with varying degrees of automation and preconfiguring your packages, but theyāre still very package oriented. Weāve been mostly slapping tools like Ansible to really configure them to our liking reproducibly, answer files if your package manager has something like that. And then NixOS is like, what if the entire system was derived from evaluating a function, and and the same input will always result in the exact same system? Itās incredibly powerful especially when maintaining machines at scale. Updates are guaranteed to result in the exact same configuration, and theyāre atomic too, no halfway updated system the user unplugged the system in the middle of.
Internally itās even stored as a vote of either +1 or -1, so sending an undislike of a like probably also results in the voteās removal. Lemmy just sums up all the votes and you have the score.
A like and a dislike activity are also contradictory, so even if you donāt unlike something, if you send a dislike it replaces the like as well.
Yes but by doing so youāre using the same principles as MBR boot. Thereās still this coveted boot sector Windows will attempt to take back every time.
Whatās nice about EFI in particular is that the motherboard loads the file from the ESP, and can load multiple of them and add them to its boot menu. Depending on the motherboard, even browse the ESP and manually go execute a .efi from it.
Which in turn makes it a lot less likely to have bootloader fuckups because you basically press F12 and pick GRUB/sd-boot and youāre back in. Previously the only fix would be boot USB and reinstall syslinux/GRUB.
I remember reading somewhere (probably my high school textbook) that one of the reasons people donāt like wind power being built is they cause visual pollution....
Sometimes āuglyā is even ānot pretty and wealthy lookingā.
Wind turbines arenāt pretty but theyāre not any more of an eye sore as overhead power lines or whatever. And at least itās a symbol of caring about being sustainable.
A lot of people like to move all the āuglyā elsewhere out of their sight and then call those places shitholes. It doesnāt bother them theyāre just moving the infrastructure where the less wealthy have to deal with it. Theyād rather a coal plant destroy a lower class city in pollution than see wind turbines near their upper class neighbourhood.
Both Docker and Podman pretty much handle all of those so I think youāre good. The last aspect about networking can easily be fixed with a few iptables/nftables/firewalld rules. One final addition could be NGINX in front of web services or something dedicated to handling web requests on the open Internet to reduce potential exploits in the embedded web servers in your apps. But other than that, youāve got it all covered yourself.
Thereās all the options needed to limit CPU usage, memory usage or generally prevent using up all the systemās resources in docker/podman-compose files as well.
If you want an additional layer of security, you could also run it all in a VM, so a container escape leads to a VM that does nothing else but run containers. So another major layer to break.
Kernel exploits. Containers logically isolate resources but theyāre still effectively running as processes on the same kernel sharing the same hardware. There was one of those just last year: blog.aquasec.com/cve-2022-0185-linux-kernel-contaā¦
Virtual machines are a whole other beast because the isolation is enforced at the hardware level, so you have to exploit hardware vulnerabilities like Spectre or a virtual device like a couple years ago some people found a breakout bug in the old floppy emulation driver that still gets assigned to VMs by default in QEMU.
Security comes in layers, so if youāre serious about security you do in fact plan for things like that. You always want to limit the blast radius if your security measures fail. And most of the big cloud providers do that for their container/kubernetes offerings.
If you run portainer for example and that one gets breached, thatās essentially free container escape because you can trick Docker into mounting and exposing what you need from the host to escape. Itās not uncommon for people to sometimes give more permissions than the container really needs.
Itās not like making a VM dedicated to running your containers cost anything. Itās basically free. I donāt do it all the time, but if itās exposed to the Internet and thereās other stuff on the box I want to be hard to get into, like if it runs on my home server or desktop, then it definitely gets a VM.
Otherwise, why even bother putting your apps in containers? You could also just make the apps themselves fully secure and unbreachable. Why do we need a container for isolation? One should assume the appās security measures are working, right?
(a) Yes. Instance admins have the ultimate say in whatās on their server. They can delete posts, entire communities, ban remote users and delete remote users. At least they had the decency of notifying you!
Since lemmy.ca owns the post, lemmy.world canāt federate out the removal, so itās only on lemmy.world.
(b) You have to go appeal to lemmy.world. Each instance have its own independent appeal process.
Thatās the beauty of the fediverse: instances can all have their rules to tailor the experience to their users, and it doesnāt have to affect the entire fediverse. Other instances linked to lemmy.ca can still see and interact with your post just fine, just not lemmy.world.
Moderation does federate out, but only from the originating instance, the one that owns the post on question.
If someone post spam on lemmy.ca and lemmy.world deletes it, it only deletes on lemmy.world. If a mod or admin on lemmy.ca deletes it however, it federates and everyone deletes it as a result (unless modified to ignore deletions, but by default Lemmy will accept it).
Thereās some interoperability problems with some software, notably Kbin where their deletions donāt federate to Lemmy correctly, so those do need to be moderated by every instance. But between Lemmy instances it does federate.
I think the best way to visualize it is in terms of who owns what and who has the authority to perform moderator actions.
As a user, you own the post, so youāre allowed to delete it no matter what. That always federate.
An admin always has full rights on what happens on their instance, because they own the server. The authority ends at their instance, so it may not federate out unless authorized otherwise.
An admin can nominate any user from the same instance to moderate any of its communities, local or remote. That authority also ends at that instance. In theory it should work for remote users too, but then itād be hard to be from lemmy.ml and moderate lemmy.worldās view of a community on lemmy.ca.
The instance that owns the community can also do whatever they want even if the post originated from elsewhere, because they own the community. That federates out.
The instance that owns the community can nominate anyone from any instance as moderator. Theyāre authorized to perform mod actions on behalf of the instance that owns the community, therefore it will federate out as well.
From those you can derive what would happen under any scenario involving any combinations of instances.
You may disagree with it and may even be right, I didnāt bother watching all those videos. But the thing is, itās always a potential liability for admins, and weāre at the mercy of what the law says and what a potential judge or jury would rule if brought to court.
And we all know how that goes when underage people are involved: everyone goes ābut the children!ā. Therefore, admins side with caution, because nobody wants to deal with legal trouble if they donāt have to. Just blur it and make everyone happy.
Plus, in the current AI landscape, the mere availability of nude children imagery even if itās not sexually suggestive at all means someone can alter it to become so. People have already been arrested for that.
Nothing to do with people being too prude to see naked children. Itās about consent and what nasty people will inevitably do with it. Does that girl really want videos of her naked all over the porn sites even through heroic actions? Probably not.
It indeed doesnāt, its purpose is to show the differences and clarify why/where OP might have heard you need special care for portable installs on USB sticks.
All the guides and tutorials out there are overwhelmingly written with regular USB sticks in mind and not M.2 enclosures over USB. So theyāll tell you to put as much stuff on tmpfs as possible and avoid all unnecessary reads and writes.
We have to define what installing software even means. If you install a Flatpak, it basically does the same thing as Docker but somewhat differently. Snaps are similar.
āInstallingā software generally means any way that gets the software on your computer semi-permanently and run it. You still end up with its files unpacked somewhere, the main difference with Docker is it ships with the whole runtime environment in the form of a copy of a distroās userspace.
But fair enough, sometimes you do want to run things directly. Just pointing out itās not a bad answer, just not the one you wanted due to missing intents from your OP. Some things are so finicky and annoying to get running on the āwrongā distro that Docker is the only sensible way to install it. I run the Unifi controller in a container for example, because I just donāt want to deal with Java versions and MongoDB versions. It just comes with everything it needs and I donāt need to needlessly keep Java 8 around on my main system potentially breaking things that needs a newer version.
Docker is one kind of container, which itself is a set of kinds of Linux namespaces.
Itās possible to run them as if they were a virtual machine with LXC, LXD, systemd-nspawn. Those run an init system and have a whole Linux stack of their own running inside.
Docker/OCI take a different approach: we donāt really care about the whole operating system, we just want apps to run in a predictable environment. So while the container does contain a good chuck of a regular Linux installation, itās there so that the application has all the libraries it expects there. Usually network software that runs on a specified port. Basically, āworks on my machineā becomes āhereās my whole machine with the app on it already configuredā.
And then we were like well this is nice, but what if we have multiple things that need to talk to eachother to form a bigger application/system? And thatās where docker-compose and Kubernetes pods comes in. They describe a set of containers that form a system as a single unit, and links them up together. In the case of Kubernetes, itāll even potentially run many many copies of your pod across multiple servers.
The last one is usually how dev environments go: one of them have all your JS tooling (npm, pnpm, yarn, bun, deno, or all of them even). Thatās all it does, so you canāt possibly have a Python library that conflicts or whatever. And you canāt accidentally depend on tools you happen to have installed on your machine because then the container wonāt have it and it wonāt work, youāre forced to add it to the container. Then thatās used to build and run your code, and now you need a database. You add a MongoDB container to your compose, and now your app and your database are managed together and you can even access the other containers by their name! Now you need a web server to run it in a browser? Add NGINX.
All isolated, so you canāt be in a situation where one project needs node 16 and an old version of mongo, but another one needs 20 and a newer version of mongo. You donāt care, each have a mongo container with the exact version required, no messing around.
Typically you donāt want to use Docker as a VPS though. You certainly can, but the overlay filesystems will become inefficient and it will drift very far from the base image. LXC and nspawn are better tools for that and donāt use image stacking or anything like that. Just a good olā folder.
Thatās just some applications of namespaces. All of process, network, time, users/groups, filesystems/mount can be independently managed so many namespaces can be in the same network namespace, while in different mount namespaces.
And thatās how Docker, LXC, nspawn, Flatpak, Snaps are kinda all mostly the same thing under the hood and why itās a very blurry line which ones you consider to be isolation layers, just bundled dependencies, containers, virtual machines. Itās got an infinite number of ways you can set up the namespaces the ranges from seeing /tmp as your own personal /tmp to basically a whole VM.
Lemmy instance admin snooping at votes (monero.town)
So I was going through /all and this admin is snooping at vote counts for posts in his instance and then posting it publicly....
Multiseat gaming with two identical RTX 3060s on EndeavorOS
Hello yāall!...
Linux file transfer speed bottlenecks?
Iām currently watching the progress of a 4tB rsync file transfer, and iām curious why the speeds are less than the theoretical read/write maximum speeds of the drives involved with the transfer. I know thereās a lot that can effect transfer speeds, so I guess iām not asking why my transfer itself isnāt going faster....
Can I install Ubuntu 18 software on Ubuntu 22.04? (Technically Linux Mint 21.3)
Hope these kinds of questions are allowed here. On this occasion Iām just looking for a straight answer....
If I create a OSS app with analytics to detect & log crashes with feature use, is it a bad practice?
If I create a OSS app with analytics to detect & log crashes with feature use, is it a bad practice? I think analytics is really helpful in finding:-...
VPN to home network options
I currently have a server running Unraid as the OS, which has some WireGuard integration built in. Which Iāve enabled and been using to remotely access services hosted on that server. But as Iāve expanded to include things like Octopi running on a Pi3 and NextcloudPi running on a Pi4 (along with AdGuardHome), Iām trying to...
Lemmy instance which has not defederated with any other instance.
Hi everyone. I have found many ghost comments in posts. Like one of the posts has 300+ upvotes and 28 comments but when I opened it, there were no comments. I tried different Lemmy apps and itās the same in all of them. Which leads me to believe that it has something to do with defederation done by Lemmy.ml. Which instance has...
Is it possible to change mouse to left/right handed mode via CLI on wayland?
On X I use...
The Boost android client for Lemmy is displaying these dark pattern ads pretending to be system notifications. What security/privacy conscious Lemmy clients do you recommend? (lemmy.ml)
What's your current favorite distro that isn't Arch, Debian or Fedora?
Iām wondering what the current favorite distros are besides the most popular ones like Arch, Debian and Fedora.
(Resolved) Lemmy sends out an Undo of a Dislike as an Undo of a Like
Original dislike:...
Can't relate to be honest, I still use MBR boot (sh.itjust.works)
Does wind power cause visual pollution in your opinion?
I remember reading somewhere (probably my high school textbook) that one of the reasons people donāt like wind power being built is they cause visual pollution....
How to secure (podman or docker) containers for public-facing hosting?
Context...
Alaska Airlines grounds 737 Max 9 planes after section blows out mid-air (www.bbc.com)
"Post has been removed"...on a different server?
Yesterday I created a post on a regional community on lemmy.ca....
Help me lift my permaban from Lemmy.world please
thefreespeechforum.com/threads/ā¦/page-2...
How to use a portable SSD for a travel OS with Linux?
Hello! The TL;DR is:...
deleted_by_author