• 0 Posts
  • 41 Comments
Joined 3 years ago
cake
Cake day: June 30th, 2023

help-circle
  • sloppy_diffuser@sh.itjust.workstoLinux@lemmy.mlshould i switch to linux?
    link
    fedilink
    English
    arrow-up
    10
    arrow-down
    1
    ·
    20 hours ago

    https://grapheneos.org/usage#web-browsing

    Chromium and their particular fork have much better exploit hardening via sandboxing.

    My understanding is Firefox has better anti-fingerprinting and uBlock origin via manifest v2 support (or v2 features ported to v3).

    The argument often used is malicious ads. Sandboxing and hardening largely mitigates ads that contain exploits, but it doesn’t protect against social engineering, crypto mining, tracking, etc.

    So I guess it comes down to your threat model and desired experience.

    I personally prefer the uBlock origin experience, but an ad free experience and escape from targeted advertising was my target opsec when venturing into privacy.



  • My experience is you have to close as many degrees of freedom as possible. Its tedious as hell for generating quality code.

    Its great at debugging if you require it to manage its context window by delegating tasks to scoped subagents, generate evidence with references, and verify that evidence with a minimal reproducible example. Expensive… I’ve seen them run for a solid 30 minutes before responding back (not including the “thinking” log), but it usually finds the issue.

    A similar technique can be used for code generation but again it burns tokens and takes awhile. Have it generate and verify isolated reference implementations for anything nontrivial. Much easier to review with the rest of your domain and layered on complexity stripped out. The “thinking” log is interesting to watch as it bangs it head against bad assumptions or documentation and needs to start digging into dependency source code to work it out.

    Only then apply the implementation to your project from the reference implementation. Takes breaking down the tasks though to small enough units and closing those degrees of freedom.

    Anecdote on degrees of freedom: This one didn’t require a reference implementation in particular. I was reviewing a PR (LLM assisted, I wasn’t the authoring dev) to add signature validation to OAuth tokens. It duplicated the entire header/token parsing logic. It needed that path closed with a pointer to where the existing logic was and explicit requirements to enhance it. Refactor was great upon reviewing and the PR size was reduced by more than half.




  • what did you like more about rclone than Cryptomator?

    I wanted to leave Dropbox and ran across it. I liked the number of supported backends under one tool. I use it to access things beyond Backblaze like gdrive, SharePoint, OneDrive, Proton Drive. Well documented config file format. I was able to manage the config with Nix due to this.

    Is it suitable for sync, or is it more for backups

    It works great for one way sync. Bisync I never got working well enough to trust it. Bisync is nice for 3-way merges (two devices modifying files on the same cloud drive). Dropbox, gdrive, OneDrive win here. I’ve learned to live without it.

    I’m ideally looking for near-ish to real-time sync for contacts, notes, files, and pictures

    On a computer the fuse mounted volumes are near live. Cahce locally in a VFS. Anything else you’d have to script probably. There is rclone-watch but can’t say I’ve tested it

    With Round Sync you can browse with live refresh when you move between directories, but syncing would be on a schedule. Looks like a 15m interval is the fastest frequency.

    Are there any frontends for Linux you’d recommend, or do you script out the functionality you’re looking to implement?

    I mostly just mount on login with the VFS cache. Use my normal file browser. One command per mount. Its rare (practically never) that I need to work on something without internet, so I don’t deal with trying to script syncs. I tried in the early days of playing with it, but fuse mounts ended up meeting my needs.

    No GUI that I use outside of my normal file browser. The only thing I need to use the CLI for is cleaning up soft deleted files and old versions (Backblaze specific thing).


  • It might not have the functionality you are looking for as far as app integrations, but my progression was Dropbox -> Cryptomator over Dropbox -> rclone over Backblaze B2.

    You can nest a “crypt” remote (end-to-end encryption with your own private key) over tons of cloud providers. You can mount it like a drive in Linux.

    Round Sync is an Android client that can schedule cronlike backups. Pretty much set it and forget it on my phone. I delete things on my phone when I need space and every couple years go cleanup what’s in B2.

    Dropbox was better priced at max capacity when I used it ($120/yr for 2TB?). My Backblaze bill started at $1/mo and is like $4/mo now. Its been a couple years since I cleaned things out and could probably cut that in half.








  • Passkeys are worth learning. Linux / GrapheneOS (de-googled Android) only household. This isn’t some Microsoft thing they are trying to push.

    Passwordless logins (or 2FA depending on the site). Uses the same public key cryptography primitives that pretty much the whole internet is built upon.

    Way more secure than passwords. The secret is never sent to the server you are logging into while passwords are which makes you a phishing target (noteable exception is opaque-ke). Users are trained to make crappy passwords and with passkeys there is nothing to memorize.

    The big commercial operating systems I’m pretty sure all support storing them with cloud syncing across your devices.

    If you care about privacy, password managers like BitWarden can handle them as well.

    Not sure if vaultwarden (self-hosted BitWarden) stores them if you don’t trust any cloud provider.




  • Additional issues I’ve not seen mentioned:

    • Ticketing systems have been an issue for me. I don’t do sports but went to a MLB game for a friend’s group event and it was hell. No paper ticket and can’t have someone show the ticket on your behalf from their phone. One ticket per phone. With sandboxed GPS the app didn’t show in the Play Store. Had to sideload. I probably could have used Aurora in retrospect but used Universal Installer from f-droid and a mirrored APK. Then had to disable exploit protections and VPN before I could get access to a ticket. Its random situations like this, while infrequent, it can get frustrating.
    • Managed work profiles. Work apps usually require GPS but the allow list of installable apps don’t include GPS (why would it, its available at the system level). So I can’t install or use any apps for work. I honestly prefer it this way, they can give me a work phone.