Dev1 Galaxy Forum / Devuan

Devuan Server compromised

dummy@example.com (chris2be8) — Wed, 16 Sep 2026 16:30:51 +0000

For a home system it's best not to allow any inbound connections from the internet to reach it (unless you have a really good reason to allow them).

Remote systems will need to allow remote access. Changing the port ssh listens on will cut the amount of noise in the logs but doesn't provide much real security. The one I help administer has root logons disabled and the accounts on it have non-obvious names and strong passwords (we normally log on with SSH keys anyway). So an attacker would need to guess both an ID and it's password.

And we have backups so it's not a disaster if it did get hacked.

packagit vulnerability

dummy@example.com (tux_99) — Wed, 16 Sep 2026 12:16:57 +0000

Could it be that the fix has been backported?

The Changelog says:

packagekit (1.3.1-1+deb13u1) trixie-security; urgency=high
* Non-maintainer upload by the Security Team.
* Do not allow re-invoking methods on non-new transactions
-- Salvatore Bonaccorso Tue, 21 Apr 2026 16:45:57 +0200

It doesn't mention the CVE number (which IMHO it should have to make it clear that it fixes this CVE) but this security update has been released around the same time of your article so my guess is that it relates to this CVE.
https://metadata.ftp-master.debian.org/ … _changelog

As an extensive user, GIMP 2.10.x is unusable. 2.8.x is great though!

dummy@example.com (yurimodin) — Mon, 10 Aug 2026 20:19:04 +0000

Could be an opportunity to fork it at 2.8 and possibly release it as a flatpak.

Devuan and KDE on Excalbur

dummy@example.com (Tatwi) — Tue, 04 Aug 2026 21:25:43 +0000

When I tried it in late June 2025 on my ThinkBook 13s G4 IAP I had a few issues; No sound without a workaround, system monitor required systemd so it would work, and I wasn't able to get power profiles to work.

I have been using KDE Plasma 6.3.6 in normal Debian 13 since, because the battery life on Devuan was even worse than normal ("thin and light" + good CPU/GPU = HAHAHAHA! Your battery is too small!). Debian is fine, great even, but I would rather use Devuan as a matter of principle, I just can't be arsed to make it work. I suppose that makes me a bad person. Oh well.

Do we like green?

dummy@example.com (golinux) — Sun, 26 Jul 2026 16:29:04 +0000

Just for future reference, I am posting links to some of the previous themes which will hopefully help guide the future evolution of the desktop theme(s) for Devuan. Themes should try to evoke the essence/ethos of the chosen release title.

"ASCII" used a very dark "Purpy" (very close to black) for obvious reasons.

Meet cinnabar (Beowulf default theme)
https://dev1galaxy.org/viewtopic.php?id=2646
Beowulf was a bloody mess!! Cinnabar captured that quite nicely.

Meet Chimaera's deepsea theme
https://dev1galaxy.org/viewtopic.php?id=3896
The Deep Sea Chimaera lives in dark blue depths.

Meet the Daedalus sapphire theme
https://dev1galaxy.org/viewtopic.php?id=4885
Daedalus was surrounded by the magnificent jewel-like blues of the Mediterranean.

IOW . . . the colors of the theme should tell the story of the chosen release title.

[SOLVED] machine-id

dummy@example.com (EDX-0) — Fri, 24 Jul 2026 23:54:47 +0000

it is intentional, as i said that initscript specifically targets debian sysvinit-core, not devuan, hence conforming to the file topology from debian, the way the file topology on devuan works is a subset of debian, but having /etc/machine-id as a volatile file linked to /run which exists only in memory is something that works across both debian and devuan, now if dbus finds a /etc/machine-id then /var/lib/dbus/machine-id is created as a link pointing to the machine-id file.

again if i manage to get this polished and accepted on debian all it would require to have the devuan way of a volatile machine id per booth would be just 1 config file, which is a benefit for debian to devuan install migrations

Debian LTS/Extended by Freexian and Devuan EOL - best practices

dummy@example.com (IdeaFix) — Tue, 14 Jul 2026 05:13:33 +0000

I use virtualization and understand how to gain experience independently. I asked the question because I wanted to learn from the community's experience.

Why not use runit? Do you guys use runit?

dummy@example.com (Marjorie) — Fri, 10 Jul 2026 19:41:19 +0000

I've always stuck with sysvinit and in practice I've found it unproblematic.
Away from my desktop system I do run a mail (postfix/dovecot/fail2ban)+time (chrony)+dns (dnscrypt-proxy) server on a box in a cupboard and for that I run Monit to monitor its critical programs.
As well as monitoring Monit will attempt to restart programs that fail.

Age Verification

dummy@example.com (zapper) — Mon, 06 Jul 2026 16:25:39 +0000

ID Verification... is more accurate

Devuan without elogind

dummy@example.com (Valera) — Thu, 18 Jun 2026 18:18:36 +0000

Without Elogind, LXQT works great and is versatile. On my system, the Turnstile+ Seatd+ Turnstile-dbus+ Dinit-dbus+ Dinit+ Polkit-turnstile bundle works perfectly. Sleep and Hibernate do not work with XFCE- requires Consolekit . Patched Turnstile-dbus a bit and now I can run KDE(X11) without elogind.

More systemd is coming - what is the plan?

dummy@example.com (golinux) — Tue, 09 Jun 2026 22:30:10 +0000

A brilliant and oh so helpful observation . . . NOT . . .

Will Wayland on Gnome etc. work on Devuan 6 in the future release?

dummy@example.com (yurimodin) — Fri, 29 May 2026 19:32:17 +0000

JMHO but Gnome is unusable for a desktop traditionalist like me......I have been Gnome free since Gnome3

Why has no one enhanced sysvinit?

dummy@example.com (EDX-0) — Wed, 27 May 2026 01:06:00 +0000

ought to wonder if since i wrote shed based on the sysvinit architecture it can be considered an augment to sysvinit or just another component that can be used in conjunction to it

New to Devuan

dummy@example.com (soulstenance) — Thu, 14 May 2026 23:42:40 +0000

Thanks!

Yep, method one is what used on Debian 12 and I imagine it should work the same on Devuan. Worst case, I have to do a manual install, or stick with ESR, which is fine. I used to hate ESR since streaming DRM content was broken/unsupported, but I don't stream anymore so that's irrelevant.

Missing GRUB Bootloader in installer images, since Daedalus.

dummy@example.com (soulstenance) — Wed, 13 May 2026 19:14:42 +0000

Ventoy is cool, but I stopped using it when I found certain Linux ISOs to be flaky or have issues at boot or install. This sounds similar to what I experienced though it was too long ago to recall what issues I had. If you want the convenience of having a ton of distros on one USB to test and mess around with, Ventoy is fine, but I'd recommend ditching it and just flash the specific distro you want onto your USB drive the normal way.