very rare for exploits that can breach a VM. Like once-every-10-years kind of rare.

One important thing to be aware of. By default your VM will have access to the same network resources as the host. So, say, if you use tailscale or some other secure VPN to protect your NAS, but you give your host access, the VM will be able to access it too! You can use firewall rules or bridge networking to fix this, but tbh it isn’t trivial.

For those that like the cli, you can use flatpak remote-info --log flathub com.stremio.Stremio to scroll through the list of past versions, and look for the “Commit” id of the version you want, then do:

flatpak update --commit=<commit id> com.stremio.Stremio

Then use flatpak mask to prevent further updates.

There are methods to detect if a device has been tampered with and disassembled. Like glitter nail polish on the screws.

It’'s not working around the issue, it’s just refusing to update. You shouldn’t need to manually rollback a system that doesn’t boot. And you shouldn’t need to manually troubleshoot or fix it either. Just report the failing update and wait for it to be fixed.

a system no longer set up the way you think it is.

The point of most atomic distros is that it’s set up for you. If you want to manually investigate around and work around the issue yourself, then an atomic distro is probably not for you.

With power comes responsibility. Flexibility is power, and the easier it is to modify core system components, the easier it is for you to mess them up as well.

I am not a Fedora Atomic maintainer or lead, so this is just my perspective from the outside, but the core ideology behind it is to have a tailored opinionated experience for user. I remember Bluefin’s lead dev saying something like “I want that ‘defaults’ lifestyle”. It’s the experience of having everything just work out of the box, and be maintained for you.

With Fedora Atomic, the user chooses less responsibility, and thus has less power.

On the flip side you have NixOS and Arch. Maximum power and maximum responsibility. If the world starts moving towards a new window compositor (think X11 -> Wayland), you now have to figure out how to do that migration yourself. If there are customizations that you added that aren’t Wayland compatible, you have to figure out how to work them out. It’s a ton of little decisions. Whereas for an opinionated distro, you just trust that the maintainers handled it and just update your system. Which is exactly what happened for me, as a Fedora user. One day I was using X11, and then the next I was using Wayland, no manual configuration on my part.

This is why I recommend atomic distros to beginners. Beginners don’t have the knowledge to handle the responsibility of maintaining a distro. They don’t know why X11 is insecure, what systemd is, how linux permissions work. They need these guard rails. Once they get more familiar with the ecosystem they can choose to install a more customizeable distro.

Can’t speak much about OP’s distro or CachyOS, but I can talk about how Fedora Atomic differs from simply doing btrfs backups before every update.

First, updates are not the only thing that can modify the base system. Installing packages, installing plugins or extensions, manual user modifications, etc, can all end up bricking the system. Fedora Atomic makes the base system immutable so that the only way of making modifications is via rpm-ostree, which ensures that you always have a way to rollback.

Second, one of the issues with traditional update mechanisms is that over time, updates might not do proper clean-up and leave artifacts. This is a harder problem than people realize, because users can have all sorts of permutations of packages and versions installed, and the update mechanism has to account for all of them. Over time, and many updates, a system can accumulate tons of small update errors and finally fall over. I’ve had this issue myself and heard of this issue from multiple sources. Fedora Atomic solves this by ensuring that every update is like a complete re-install.

Third, since every Fedora Atomic user uses the same base system as their distro maintainers, they can be sure that their base system is well tested. Bugs are more reproducible, and thus can be fixed faster. None of those “works on my system, you’re on your own” issues.

Fourth, this one isn’t a benefit to the user but the community. Fedora Atomic (and universal blue) distros are easy to fork. This is why there are so many flavors now. Bluefin, Aurora, Bazzite, Secureblue, Wayblue, etc. Instead of one generic distro with a huge community relying on a few maintainers, like Fedora used to have, now you have smaller specialized communities with their own leaders, and users can choose which community they align with more. And you can even switch communities, since rpm-ostree allows you to “rebase” to a different distro (eg Aurora -> Bazzite).

Reason to use Bluefin is to not have any proprietary software (aka Steam) included while still having all the open source bells and whistles from Universal Blue (Distrobox, Just, brew, devcontainers, fzf, ripgrep, etc).

Though I guess Bluefin does include the proprietary nvidia drivers.

A lot of times its tech opinion articles. Stuff like “why AI is bad”. And I read the arguments and judge them for myself.

Beautiful thank you, I’ll check them all out

What extensions do you recommend? Aside from tray icons

I already considered that, and for an untrusted website I already don’t trust the content or the scripts. So it doesn’t matter if it was modified or not, it’s still untrusted.

Facts can be verified with sources you do trust (which should be using HTTPS). Logic can be used to verify others.

IMO when reading random articles on the internet you already have to worry about untrusted scripts. I just use NoScript, and if the website requires Javascript I move on

If you’re just pushing for WebPKI without “thinking too hard” about perpretrating a security system with a large number of failure points, then you’re following that windows method.

SSL/TLS have very specific benefits. None of which matter that much for reading random articles on the web. So I don’t see the problem with this website doing their own thing to bring attention to the potential issues of the current system.

It works fine, just ignore the warning and don’t enter any sensitive info

I bet another reason is security. You might not trust the NUT software. It might be proprietary, and even if its open source, it might not be scrutinized enough to be safe.

Using separate hardware, lets you take in the power loss signal from the NUT and then convert it to a channel you might trust more, like an http request over wireguard. Alternatively you could use a VM with usb passthrough on the main PC…though usb passthrough still has risks.

This is a cool idea, and I love the hacker energy behind it, but I agree with some of the other comments that the receiver would have to trust you quite a bit to allow hardware into their house. Even with the SSH view-only accounr, you could be putting the SSH server in a VM so that the client thinks they’re seeing the whole OS but they aren’t.

Alternative idea would be to provide an open source ansible script or docker compose file to spin up everything you need, and let them verify and deploy it themselves. Then they give you the wireguard configs to remote in.

Nope, I never watched him back when I had a youtube account.

I’ve seen Markiplier a few times on the Invidious feeds btw. I think I got introduced to Markiplier by some Invidious instance actually

Got it you worried me for a sec there 😅

For questionable maintainers decisions I have seen a few

Yeah they definitely aren’t perfect but it’s good enough for me, I’m too lazy to manage my OS myself

I’m probably just too dumb for Nix/NixOS

Probably just didn’t want to put in the time/effort. From what I’ve heard, NixOS takes a lot more time/effort than other distros. Not everybody wants that.