It’s not wrong that free RAM is wasted RAM, at least not if properly used for caching in a way that is simple and fast to release when the system does need more RAM.

What are you talking about? I don’t know what you use to browse Lemmy, but I use Voyager and it shows clearly that this was posted on the programmerhumor lemmy community/world/instance 😂

It’s literally in the programmerhumor community 😂

I deleted the whole /usr/bin to be sur

That’s why mixing OSs is a good way to spread the eggs in more baskets, so do consider using BSD. However, you are wrong on both claims, WireGuard is UDP only, it doesn’t use TCP, and my Alpine guest has had SSH disabled since the beginning, it can only be managed through the virtual serial port from the host OS, so locally only (unless someone manages to escape the VM), plus the SSH vulnerability was only possible when using OpenSSH, but one of the reasons for going with Alpine with musl was to avoid using the same packages as on my service hosts and use those that are smaller with less moving parts, so I’d have used Dropbear instead anyway.

Greg Kroah-Hartman (the 2nd person in command in Linux) recently had a public talk where he discussed the whole situation with vulnerabilities. There he predicted that this would calmn down for Linux eventually, since, due to it being open source, there was always attempts to uphold a certain level of code quality, so the number of issues are quickly reducing as they are being addressed. However, having spoken to some developers working on closed source projects, he revealed how terrified they all are with the current situation, since they never had this kind of pressure to keep good code, so the technical debt is crazy for them.

Yeah but you need to draw the line somewhere. With a VPN the attacker needs to compromise 2 different layers, which is far harder and less likely, especially if you put the VPN in a dedicated VM on a separate VLAN. If you are especially paranoid, you’d use a simpler VPN, like WireGuard, that has less chances of having unnoticed issues (code is small and well vetted), and use a different OS to run the VPN from the one running your services, so a critical flaw in one of the OSs is not enough for a full compromise.

Personally, I run all my services in Debian/Ubuntu systems, but they are behind WireGuard running in Alpine Linux VMs, which use musl instead of glibc, though I’ve considered using BSD there.

Having its own data connection would just drain the battery faster. In theory, a Pebble has an open SDK, even the firmware is open, so you could hack whatever you want into it (as long as the resources suffice)

Put everything behind VPNs abd migrate services from Docker to VMs

How is crashing on an unhandled path in a security context not better?!

However, Vaultwarden only implements the webvault, the client apps are still only supplied by Bitwarden, which they could make incompatible with Vaultwarden at some point.

I’ve also seen some sites use POWBlock, though, don’t know anything about it.

WireGuard is stateless, so running it “on” 24/7 is cheap, set it up once for them and leave it on, ideally they wouldn’t notice a thing.

The crux of the issue, at least as I understand it, is that traditionally you’d build the system components in a way that they were interchangeable by defining some standard-ish API. While you can interchange some Systemd components, since “ststemd-xyz” is just the umbrella name of the project as a whole, so some components are completely independent, the core ones can’t really easily be swapped, and it’s only getting worse, especially as systemd is starting to become a hard requirement, a lot of people are rightfully feeling peeved. There’s a great talk made by a BSD developer that admits the virtues of Systemd while bringing the downsides, so no blind hate, you can google for the video “The tragedy of systemd”.

Amazing talk, was hoping somebody would’ve linked it and was not disappointed

Proxmox VM snapshots and backups, plus proxsave I assume?

I actually did that. Or well, I was planning to upgrade the Debian version and instead of doing it in place I replaced the drive (kept the old around for a while just in case) and did a clean install. I didn’t make any new backups or moved configs or anything outside what I already had, the system was back to operations faily quickly. The main reason, I have a markdown file describing every configuration and recovery step needed to get a fresh system to a fully working state in case of a disaster, and my test showed that it worked great. It does take a bit of effort to keep it up-to-date, but as shown, really worth it, and it douples as a small wiki for accumulated knowledge. I do wish to play with Ansible at some point if I have the time, but this works for now.

Did you restart the browser/phone in between? Maybe the old cached list was being used? Heard some recommend restarting the phone just to be sure.

Huh?!

Wouldn’t be surprised if the big guys got first dibs before everyone else