I suppose the most tangible benefit I get out of it is embedding a custom initramfs into the kernel and using it as an EFI stub. And I usually disable module loading and compile in everything I need, which feels cleaner. Also I make sure to tune the settings for my CPU and GPU, enable various virtualization options, and force SELinux to always remain active, among other things.

I have this device and use it to store my keepassxc and onlykey backups, and it’s useful to me because I’ve stopped using passwords (I only need to remember the pins for these devices which can unlock my keepass dbs that have everything else).

It seems secure enough for my use case, especially since the files I store in it are themselves encrypted (the onlykey backup still requires a pin), but I still want them to be difficult to access.

I’ve had to rely on it before but only because I didn’t prepare a backup onlykey ahead of time- ideally it should be one of many recovery methods. But so far it’s worked great for me.

Ah good to know! Will try that if I ever run into issues, thanks

I’ve been using it for years and I think it’s great. Currently on a 6 Pro. It’s true that some apps don’t work without Google Play services, but GrapheneOS has the option to install the google stuff in a sandbox, so you shouldn’t run into any issues if you do that. Personally, I don’t use Play services unless I need to, and use Aurora store for any apps that aren’t on F-Droid.

In any case, you can always revert to stock or try another OS

Edit: as faede has pointed out, it appears that Google Wallet has issues. Also, the usage docs mention issues with banking apps in general, so that’s something to consider

If you’re willing to spend the time to learn how to write custom policies, SELinux can be used for this, to some extent. It’s highly customizable and can sandbox your apps, but the process of doing so is quite complicated. I wrote a small guide on custom policy management on Gentoo in another comment if you’re interested.

There’s also apparently a “sandbox” feature, but I don’t know much about it. I just write my own policies and make them as strict as possible.

As an example, my web browser can’t access my home directory or anything except its own directories, and nobody (including my own user), except root and a few select processes (gpg, gpg-agent, git, pass) can access my gnupg directory.

This only covers security/permissions, and doesn’t include many of the other benefits of containerization or isolation. You could also try KVM with libvirt and Gentoo VMs; that works pretty well (despite update times) and I did that for a while with some success.

For vegetables I throw everything into a big stew with a lot of different things (kale, broccoli, cauliflower, onion, potato, mushrooms, tofu, garlic, beans), lots of hot sauce, seasoning, olive oil, etc. and eat the same thing every day, for the most part. I don’t eat enough fruit but I do have a handful of dried fruit with oats every day

Haha yeah, nicely put. I do enjoy the content, mostly because I’ve been following these creators for some time, and it’s hard to find a replacement for it… there is a lot of great content there, but it makes me feel gross using it. And same, I had no problem finding an alternative for Reddit (this), probably because I was not very attached to individual creators there.

I’m hoping a decentralized solution gains traction, but in the meantime I’ve been trying to limit the amount of information I share with the platform. I’m not actively trying to restrict my usage (most of that was achieved when I stopped using an account), but maybe it’s a good idea to do so. I mostly use it when eating or going to sleep, and there are better ways to occupy that time.

Major bugs usually get fixed pretty quickly- I always check the GitHub to make sure I have the latest version when I have issues. And Invidious can work as an alternative most of the time, but some instances work better than others

I stopped using recommendations years ago and only use NewPipe and Invidious. I did notice a reduction in my watch time, but there is plenty to watch when using a subscription-only feed. I havent added very many channels to my list since then, but personalized recommendations aren’t worth the privacy cost. Hoping to leave the platform eventually

I use Terminus (ter-112n) for TTY, Source Code Pro for terminal emulators, and DejaVu, Liberation, and Noto for others

Had the same issue with Plasma Wayland in QEMU but I never found a solution. Toggling anti-aliasing sometimes helped, temporarily

Try going down the page and looking for the categories with more than a few bits of identifying information. I’m running LibreWolf with just uBlock Origin and Dark Reader (which I don’t think influences results) and I’m able to get nearly-unique, instead of unique (but I do get unique on default settings). TBB gets non-unique, which is a good set of results to compare to.

In my case I noticed that my fonts were really unique so I set browser.display.use_document_fonts = 0. Also I use my WM to set my page resolution to 1920x1080, which seems to have a better fingerprint than the default LibreWolf floating resolution of 1600x900 (and even the letterboxing resolutions, from what I can tell).

I just spent some time testing again and checking for anything else. RFP does force a generic user agent, but unfortunately it keeps the version information and I can’t figure out how to change it with RFP on. Would be nice to set it to the ESR version used by TBB (which has lower bits), but I’m not sure if that would lead to a more unique fingerprint (if, say, a feature was detected that is available in later versions but not ESR).

Edit: just tried Mullvad browser, and it’s non-unique! Might be the best option.

Was getting 71% on Librewolf with only uBlock Origin. Enabled every blocklist in the extension and am now getting 100%. Thanks for sharing!

Yes! Depending on how much time you want to spend figuring things out… there is a learning curve, but the documentation is quite extensive. And you do learn a lot about Linux by diving in. The compile times aren’t really an issue today if you have decent hardware- I run it at home and on all of my servers (some of them not very powerful). You can do other things while it’s compiling.

It’s great if you want to customize everything and learn how your system works, or are interested in optimizing everything for your specific CPU architecture. There are a few pitfalls (especially when learning), but I’ve generally been able to learn how to fix any issues as they arise.

Also, the package availability is great. If you can’t find something in the gentoo repository or in an overlay, you can usually find its dependencies and build it yourself.

No problem! And yeah, it’s good to see people talking about it over here. I think it’s the best tool for online privacy OOTB (depending on your threat model), and it gets better the more people use it.

The difference is that your ISP doesn’t know where your packets are headed, and the destination doesn’t know where your packets came from. The ISP sees you connect to the entrance node and the destination sees you connect from the exit node, and it’s very difficult for anyone to trace the connection back to you (unless they own both the entrance and exit and use traffic coorelation or some other exploit/fingerprint). Regardless, both parties are generally able to tell that you are using TOR if they reference lists of known entrance/exit nodes. Also the anti-fingerprinting measures taken by TB are a bit more strict than other privacy-focused browsers

It’s great for anything low bandwidth that isn’t tied to your identity, and helps for peace of mind, despite its issues. You do run into captcha or DDOS protection issues occasionally, but the new tor circuit for this site button sometimes works. Also it uses letterboxing to prevent resolution-based fingerprinting, which isn’t very pretty, but leaving it at its default size (or locking the size using the WM) works well and is good for privacy.

An extension would be cool! I’m currently trying to do something similar, in some sense; I’ve patched my instance to filter out DB results from public queries so that only my posts and comments are visible (unless I am logged in).

The only thing I’m not sure about yet is if it’s possible - if I create a Post on an instance that’s not my home, who is hosting the data? Do I only send ActivityPub Create Post with the data and the instance then saves it, or do I create the post on my own instance, send an ID, and if someone requests the Post data on the instance I posted to, it will be requested from mine?

I believe it might be possible, but I’m not sure. It seems that the protocol itself is mostly geared for synchronizing data and distributing updates. From my limited understanding, servers follow users or communities on other servers, which inform those servers that updates should be sent to the requesting inbox. These updates are then used to build up a local copy of the remote page. In the case of a remote community, users interact with their local copy and notify the remote community of those changes.

For example, I am viewing a local copy of this post that I received from lemmy.ml, and my reply to your comment will be stored locally. My server will notify lemmy.ml of this comment (including its contents), and lemmy.ml will notify my inbox if anyone interacts with it (because I am a follower).

It seems that at least some of this syncing might not be necessary… a lightweight frontend could rely on the API of each site it connects with to build up the activities it sends. However, this would probably cause some unnecessary traffic, as such a follower would both receive updates and query the API. Also it would probably break some things, such as ap_id (see the multicolored fedilink icon, which points the original copy of the content on my instance).

Also a fan of sway! Plenty configurable, and swaymsg+jq bash scripts can go a long way. Hoping we’ll see more development in lightweight DEs as well- Wayland is pretty great, and sway could use with some more features. also nice username :D

Absolutely! I haven’t had any problems setting up dependencies for various projects and have only needed overlays a few times. Sometimes USE flags can be tricky but most things are pretty well documented