You are not logged in.
You're right that script blocking could be seen as security related. However just completely turning off javascript is probably the best approach, though not practical for most people.
Yeah, it's quite funny when look at how Palemoon even warns users about stability problems concerning NoScript. Seems a lot of their bug reports boils down to non technical users installing it "because it's good for security" and then blame Palemoon for broken pages.
I can manage to browse the web by selectively disabling those scripts which just aren't needed (advertising, tracking, etc related), but the average person usually can't manage this or just doesn't know about. This is all assuming that 100% of the issue is javascript and nothing more... you've also no reliable or practical way of knowing which scripts are dangerous and which are not.
Agreed. I'd say i have a somewhat solid grasp on the topic but that sure wont safe me from allowing a bad script while searching for the right combo to get site X to work.
Hence "secure by default" is the best approach and why sandboxing, privsep, etc are preferred and very important.
It's not so much "duct tape", as just correctness - in that the OS should never assume that any installed programme is "safe", never mind the web content it accesses. It really boils down to that the OS should stick to the principle of least privilege.
Well, sure it's probably safe to assume that pretty much any program beyond a simple "Hello World!" will have at least some kind of bug (per 1000 lines of code you add... i guess you know the saying). Still most programs are usually ran as is and most often that's just fine (of course chroots, selinux and so are things but i wouldn't say they are used that regularly outside of high security setups). Personally i've picked up the habit of doing important stuff under a different user account though. So yeah i kinda have my own sandbox.
I won't argue that in the end a safety net is better than a compromise but modern browsers seemingly needing those nets by default is imo telling something about the code. It's kinda like the authors saying: "We don't really know whats going on in our codebase and have no faith in it ever becoming even remotely trustworthy". Given the speed at which browser development moves that's not even a big surprise. There is simply no time to stabilize things when you have to give your browser the functionality needed for making coffee before the competition does.
devuser wrote:Nothing wrong with chromium (chrome on the other hand...). It's a solid product. I've actually considered switching to it too but i can't get used to the UI and it's lacking when it comes to plugins (the main reason i used to use FF).
chromium, like firefox still comes out of the box with google spyware built in and enabled. chrome is worse still. Iridium is a chromium fork which does not. Iridium doesn't seem to be available in Debian repositories, but they do provide a .deb package. It's available in OpenBSD ports and for Windows, hence why I use it.
Interesting. I thought at least chromium would be somewhat clean. Concerning FF my illusions were long gone. Just look at all the google related garbage RAS lets you disable and that's probably just the tip of the iceberg. Not to mention google being the default search engine with URL bar integration to eat your typos and suggestions and what not.
devuser wrote:Regarding security i don't see how process separation (i guess that's what you are hinting at?) is all that important though. While i'll have to agree that it's (at least used to be - i don't follow this all that closely) easier to turn an exploit into a compromise with FF we are talking about last line defenses when there is already major hole in the bucket.
I'm not familiar with "process separation". I am referring to privilege separation (privsep). It's important for browsers, due to the attack surface offered by modern browsers. chromium was designed from day one with sanboxing and privsep in mind, where Mozilla have been retrofitting it to legacy Netscape code.
OK, i see where you are coming from. Process separation was one of the recently hyped up FF features concerning improving security so i thought you were referring to that but mozilla's codebase being quite rusty can't be argued. Tbh i still see those safety nets somewhat as duct tape for the problem of functionality bloat in todays browsers. My hope is for Palemoon to try ironing out the warts of Mozillas codebase without adding new features left and right while staying usable (damn, i'd love to use a reasonable browser but with the websites nowadays it's hopeless) and yeah, i know, that's likely nothing more than wishful thinking.
devuser wrote:(is there anything even close to Random Agent Spoofer for chromium?).
Spoofing user agents is really a privacy thing, rather than a security concern. For example, you can browse with tor, script blocking and random UAs, but a vulnerability in e.g. the browser, kernel, SSL (or in the CPU!) is still a security hole and could still compromise your system, irrespective of any extra privacy measures you've taken.
Point taken even if script blocking imo shouldn't be listed here imo as it in fact stops a lot of exploits.
There are several user agent switchers for chrome, some offer random switching, but I'm not aware if they have the same functionality as the one you refer to, as I've not used them.
Guess i should have explained that a bit. RAS functionality goes way beyond simple randomization of user agents (and is one of the rare attempts to at least try do more than a halfassed job at it). It offers a wide selection of other options ranging from disabling WebGL, WebRTC, Canvas to manipulating caching, visited link CSS, clipboard events, DOM timing, localization, fonts. You are right it's more about privacy than security though. Sadly the plugin is pretty much dead as it's impossible to port to WebExtensions according to the author. Actually i am thinking of picking it up to provide updates for usage with Palemoon.
This poblem i tested only in Cinnamon in Devuan. By start from CLI skypeonlinux start without errors in CLI and blank GUI (see my previsions post).
So it does work on Devuan using another DE? Not really sure where i am going with this just asking because ruling out incompatible GUI libraries (QT?) would be a good start. If the problem happens to be QT related it might be possible to work around it by preloading another version of it.
I suggest iridium or chromium. Yes an evil google product, but actually better put together, does privilege separation better and as a result is more secure.
Nothing wrong with chromium (chrome on the other hand...). It's a solid product. I've actually considered switching to it too but i can't get used to the UI and it's lacking when it comes to plugins (the main reason i used to use FF).
Regarding security i don't see how process separation (i guess that's what you are hinting at?) is all that important though. While i'll have to agree that it's (at least used to be - i don't follow this all that closely) easier to turn an exploit into a compromise with FF we are talking about last line defenses when there is already major hole in the bucket.
With the switch to WebExtensions FF has lost it's appeal to me anyways. That's also where it made up points in the security department imo (is there anything even close to Random Agent Spoofer for chromium?). Palemoon is obviously a risky choice with it's tiny dev team and the little exposure it gets but atm there seems no real alternative when you are used to classic FF (i've been running classic theme restorer before they killed it with the WebExtensions switch).
How are you installing? The installer on the non-live CDs should be virtually identical for Jessie and Ascii.
getting printers working properly
Not sure what exactly is the problem but for me getting printers working always just came down to installing cups and adding the user to the appropriate groups.
and adjusting screen brightness
No idea about that one sadly.
My experience in relation to non technical users and Devuan has been pretty good though. Even if switching people over from Mint has resulted in the occasional complaint about Devuan being minimalistic noone wanted to switch back stating they just loved the stability and the performance so much.
Yeah, checking plugins would be my first thought too. As for 2) are you maybe working on a laptop with touchpad? It's easy to accidently click something while typing. If nothing a helps maybe you could look into palemoon (not really a solution but imo FF is getting worse and worse by the year).
I don't really have an answer but do you really have to use the .deb file from nvidia? If not switching to the official Devuan version might help with your dependency problems.
Privet!
Could one drop to a shell in the netinstall iso installer for ascii and modify the /etc/apt/sources.list ?
I have my doubts. I don't know the exact inner workings of the installer but i am quite sure it installs the base system using debootstrap (or rather specialized version of it) which by default doesn't care about sources.list. The installer might be smart enough to get it's settings from there but again i doubt it. Also i am not sure sources.list even exists before /target is created (likely when debootstrap is run).
I guess you could debootstrap it from a live CD. Not sure if that qualifies as direct install though.
Or do the security updates come mirrored from the Debian LTS program?
Yes, i guess thats (usually) the case.
Will there be an LTS program for Devuan Jessie too, which will extend beyond the Debian Jessie's LTS?
Doubt it. It's unlikely Devuan currently has the spare resources needed to extend the life cycle beyond what's supported by Debian.
I guess you could post in the after Ascii wishlist thread but your best chances would probably be to follow the official packaging guide and volunteer to maintain those packages yourself.
Is it now receiving updates in the same way as Debian Jessie through the LTS program?
I am guess Devuan Jessie will be supported as long as Debian Jessie is supported but i am not 100% sure. An actual developer will probably chime in soon and give you a definitive answer though.
Is any change needed in sources.list to receive the updates?
Pretty sure you don't need to do anything.
Well, you could try doing chmod u+s /usr/lib/xorg/Xorg if startx works after that there is something wrong with xserver-xorg-legacy or it's config.
[ 43.712] (EE) modeset(0): drmSetMaster failed: Permission denied
[ 43.712] (EE)
Fatal server error:
[ 43.712] (EE) AddScreen/ScreenInit failed for driver 0Upgraded to Ascii yesterday and also got this in Xorg.0.log.
Tried everything mentioned in previous posts with no result, downgraded back to Jessie (for now)
Is there a way out of this mess?
Did you install xserver-xorg-legacy and set needs_root_rights=yes in /etc/X11/Xwrapper.config?
devuser wrote:cynwulf wrote:To my knowledge backports ... does/did not, by default, allow automatic upgrades anyway.
Exactly. This is how it was and how it is right now. I just remember a brief timespan where adding backports actually resulted in apt wanting to upgrade my whole system to backports versions if available and i had to use pinning to keep it in check. Not sure if it was something i broke though. At some point it just worked again like we are all used to.
No, it wasn't something you broke. Early on, auto.mirror had the wrong priority on backports, and it got fixed. Then pkgmaster had the wrong priority on backports, and that got fixed. I keep it pinned, just in case.
/etc/apt/preferences.d/releases
Package: * Pin: release a=ascii-backports Pin-Priority: 100
Thanks for clarifying. Good to know my memory isn't all that faulty yet. Also who doesn't like hearing he wasn't the culprit after all
To my knowledge backports ... does/did not, by default, allow automatic upgrades anyway.
Exactly. This is how it was and how it is right now. I just remember a brief timespan where adding backports actually resulted in apt wanting to upgrade my whole system to backports versions if available and i had to use pinning to keep it in check. Not sure if it was something i broke though. At some point it just worked again like we are all used to.
Interesting. I didn't know leaving backports enabled was considered harmful (at least not more than using backports in the first place). I was under the impression the pinning issue had been "fixed" as in by default apt would only use backports when instructed or on upgrades when the original package already came from backports and not try to to upgrade random packages if there was a newer backports version available? I understand that backports are a moving target and might have unclean packages slip through but an official stance to manually disabling them is new to me.
I'm not sure why it should influence the console resolution after linux was booted...
Yeah, once the system is booted it's up to the OS to use it's own settings. My guess is the kernel by default simply doesn't bother changing the resolution and just uses whatever grub has left behind. Way later console-setup kicks in and maybe changes stuff a bit. Just had a quick look and /etc/default/console-setup seems to have a VIDEOMODE option too. Not really sure what it does as i just use it to set an oldschool ascii friendly font. Besides all of that would happen way after the kernel boot messages are done anyways.
I had the idea that grub2 looks for other OSs and boots them according to what the grub.conf file in the drive hosting that OS says.
ie: the screen size set by GRUB_GFXMODE.
Not entirely sure here but i don't think so. Imo grub only reads one associated config which controls to which mode it switches and if it keeps the resolution when loading the kernel. So if Devuan gets loaded in a higher resolution is controled by the config of the grub installation in PCLinuxOS. No guarantees, i might be completly wrong here.
Gems of knowledge into my sea of ignorance .. I hope the OP gets to mark this as solved soon.
Sorry, i hate coming across as a smartass Anyways, i also hope there will be a satisfying solution.
Makes me wonder if there's some kernel compilation magic that could be missing.
Don't think so as the grub screen is shown before the kernel is even loaded. Iirc it's just a matter of getting the right combination of settings in /etc/default/grub. Sadly all i remember is that it was annoying to figure out but grub being bugged nowadays is of course also an (imo unlikely) possibility.
Yeah, i'd try what emanym said. Get grub to use a higher resolution can be a bit annoying but i've done it in the past (sorry forgot the exact combination of settings) so it should be possible.
As for boot messages i'd try editing /etc/default/grub to remove quiet from GRUB_CMDLINE_LINUX_DEFAULT and also run update-grub.
I wish Devuan installer will have option to use-and-NOT-FORMAT existing swap partitions.
Hehe, true that would be awesome when abusing future swap partitions to store ISOs. Not that hard to setup the swap after the install has finished though. Still would be a nice feature.
To me the single best thing would be support for live kernel upgrades. Well, OK the support is there but there are no easily available patches. Given that hardly any distribution (only Ubuntu i think) supplies those that would have a major impact for server use. If i find the time to look more closely into this i might also volunteer to maintain those. Rebooting servers is bad, mhhk?