• 0 Posts
  • 158 Comments
Joined 3 years ago
cake
Cake day: June 18th, 2023

help-circle





  • I generally feel more comfortable having /home as a separate partition. It makes editing my partitions with external tools like gparted very easy, and I can just wipe /root whenever I like without having to think too much about. Also, are we considering btrfs to be reliable now? Last time I looked at it, it was still in the prototype/unstable phase and I chose ZFS for my server instead.

    Another reason I keep /home separate is that I have systems with multiple Linux versions installed. Each has their own /root, and they share /boot, /swap and /home.


  • You’re welcome, and yeah growing pains every time with a new install. But you do it a little better each time.

    One recommendation - when you do reinstall, don’t use the default/automatic partitioning. Manually set up your /home directory as a separate partition from /root. This lets you reinstall the OS without having to touch your user files. When you reinstall again, all you have to do is select the existing /home partition to use as the new install’s home (and make sure not to format it). This makes your install a lot more flexible, and your OS a lot more disposable.

    If you do manual partition configuration, don’t forget to also create a /swap partition that is at least 1.5x the size of your RAM.


  • I could probably backup most of my important data to a flash drive but I’d rather not.

    You should ALWAYS back up any important/irreplaceable data before making any changes to your hard drives, even if you think the risk is low. Accidents happen.


    You can move the drive from one slot to the other, the drive’s UUID should not change. You’ll just need to change the boot drive selected in UEFI. Physically swapping the drives will be faster, easier and less failure-prone than trying to move your boot and root partitions between drives.

    For editing drive formats and partitions, the best tool is gparted: https://gparted.org/

    It’s convenient to have gparted installed on a USB drive so that you can live boot it and use it to make changes to the system drive(s). With gparted you can simply erase the Windows drive and create a new partition formatted for Linux (probably ext4).

    If you are not already familiar with editing disk partitions and formats, you should read some tutorials first: https://gparted.org/articles.php

    As for encryption, some Linux installers have this as a selectable option during the install process. If Mint does, you should consider reinstalling anyway to use that, as you are more likely to have it working properly.

    If you just want to encrypt your data partition(s) you can implement LUKS with cryptsetup: https://linuxvox.com/blog/linux-luks-encryption/

    Note that this is the most basic use, it does not cover FDE. If you want to also encrypt /boot so that your computer will not start without being unlocked, that is more complicated to set up:

    !! YOU SHOULD READ A LOT OF INFORMATION BEFORE ATTEMPTING THIS !!

    https://askubuntu.com/questions/1470391/luks-tpm2-auto-unlock-at-boot-systemd-cryptenroll

    https://cryptsetup-team.pages.debian.net/cryptsetup/encrypted-boot.html

    Be aware that doing anything wrong in this process is likely to leave you with an unbootable system, and unable to recover any data from the encrypted partition/drive. You need to be sure that the steps you’re going to take are relevant for your hardware and OS before you start, and that you have all of the necessary utilities installed.

    Again, if Mint has a selectable option for this in its installer, you will have much better chances of success reinstalling with that.

    Don’t skip the backup.


  • This is what organic growth looks like. It spreads in fits and starts, bits of it clump together and pile up, pieces of it separate and take on life of their own or die. When part of it rots (hexbear) the larger organism cuts it off to limit the spread of disease.

    Lemmy (and more generally, ActivityPub) is growing, not like a rose bush, but like a field of grass. Some pieces of it are blooming, some pieces of it are dying, some pieces are adapting to different environments, but the spread is inexorable and the horizon unlimited.

    If you want to see what the field is like on the other side of that hill, well it won’t just come to you, you’ll have to get up and go to it.


  • Your first concern should be your boundary firewall. You should have all ports closed except the ones that you are definitely using for external services. You should know which ports you have open and why, and what traffic, how much and how often you expect to see on those ports (8080 will have regular Internet use traffic, but your reverse proxy port should only have traffic when you’re away from home and actively using it), and you should monitor that traffic at the firewall every so often, and especially when you make changes to your network. Closed ports should be configured to drop packets rather than respond that the port is closed (stealth mode). On a home network, preventing unwanted incoming connections will protect you from the majority of malicious activity. It’s the most effective single thing you can focus on.

    The next thing would be to separate untrusted devices onto dedicated VLANs. This would be for IoT devices, gaming consoles, “smart” appliances, anything that connects to the Internet whose software you don’t have control over. They get isolated on a VLAN that only connects to the Internet and doesn’t allow local connections to devices on other VLANs, so the rest of your network doesn’t exist as far as they’re concerned. This should cut down on things like “smart” appliances taking inventory of your home network and reporting it back to the manufacturer’s servers.

    If you do these two things, and you’ve got your reverse proxy configured properly so that other people can’t break into it, you should minimize unwanted connections to your network and your server/containers should be fine with default internal firewall policies. The only reason you would need to do more is if you expect a direct/intentional attack by a motivated hacker, but in that case there’s not much you can do unless you’re an expert.

    If you want to go further, try implementing the community version of runZero:

    https://www.runzero.com/platform/community-edition/

    https://help.runzero.com/docs/self-hosting/

    https://www.cisa.gov/resources-tools/services/runzero-community-edition

    This is a network visibility tool that will discover and identify devices. To get a really complete look, you would run it from inside your network and deal with anything that you don’t think should be accessible, then run it again from outside your network to see what a potential attacker would see.








  • Cleaning isn’t an inherently undignified job

    So what? It is still a job that most people don’t want to do. It is a job that people do when they can’t find other work. And typically the working conditions are poor.

    The point isn’t whether anyone would “do fine in a job like that”. The point is that very few people are signing up for those jobs voluntarily.

    For work that is genuinely unpleasant, there’s no reason I know of there can’t be non-monetary perks that would make it worthwhile.

    This I agree with. As a society we should be rewarding people who fill these very necessary roles. Janitors, especially those who work in medical facilities and have to regularly deal with biological waste, should be getting a lot more compensation.

    Regardless of whether that compensation is in the form of money or not, I don’t think that’s an example of anarchy. Providing such compensation would require some form of organized group that distributes it to the people doing the work, which means that group would have to collect whatever resources are necessary in order to distribute them, and then we’ve just reinvented taxes.