Chris Laprise: > On 8/10/20 5:22 PM, Toptin wrote: >> Chris Laprise: >>> On 8/10/20 12:30 PM, Toptin wrote: >>>> Jeff Kayser: >>>>> Here is one reason to use Fedora. >>>>> >>>>> https://www.fossmint.com/which-linux-distribution-does-linus-torvalds-use/ >>>>> >>>>> >>>> >>>> Ah, see... Mr Torvalds is your God. That isn't a reason at all. But >>>> thanks you put a smile on my face. >>>> >>>>> >>>>> ~Jeff Kayser >>>>> >>>>> -----Original Message----- >>>>> From: [email protected] <[email protected]> On >>>>> Behalf Of Chris Laprise >>>>> Sent: Monday, August 10, 2020 9:18 AM >>>>> To: [email protected] >>>>> Subject: Re: [qubes-users] Why Fedora? >>>>> >>>>> This email originated from outside the organization >>>>> >>>>> On 8/10/20 12:05 PM, Toptin wrote: >>>>>> Dear Qubes Users, >>>>>> >>>>>> I'm currently digging my way through the exceptional good Qubes >>>>>> documentation. Everything is nicely explained as to why a certain >>>>>> decision / implementation was made, except for the use of Fedora as >>>>>> main distribution. >>>>>> >>>>>> I wonder what's the rationale of that decision; Fedora 25 isn't even >>>>>> supported anymore. No offense or critic intended, just curiosity. >>>>>> >>>>>> Regards, toptin. >>> >>> I think the subtext here is that Fedora gets the changes first and it >>> makes a good development environment (for Linux code anyway). But that's >>> also why they don't curate or test or secure it like a regular >>> production-ready OS. And also why they don't care about having a wide >>> array of apps. >>> >>> I'd rather see a transition to something more stable like Debian which >>> is also flexible enough to let you pull in newer packages from a tiered >>> repository (stable, testing, unstable, and experimental). >>> >> >> That was my thinking too, but still as mentioned in my previous post I >> would have thought something like Arch-Linux or even Gentoo would be >> better choice because both distribution are actually meta-distributions >> (a distribution to build a target distribution). I worked with both and >> wouldn't recommend it to an end-user but for development to build >> something like Qubes? Yes, I would consider that. >> >> Nothing against Debian. Definitely not. Very trustworthy and >> knowledgeable community, but still quite a big system, especially if one >> wants to strip it down. And then those unfortunate version upgrades. But >> once it's installed it's rock solid. > > I don't know if bare-minimum really signifies, at least with the way > most people define it. A lot of the things you would remove to reduce > attack surface won't make a big impact on the install's disk space > usage In regards to the install-image, yes. But I have in mind the modularization (isolation, separation) all such modules should only hold as much code as they need to have to fulfill their function in the system. So, the individual modules are stripped down to the bare minimum, just enough to do the job they are designed for. Having said that it means of course that one gets a lot of modules, which results in an overall bigger system than a traditional OS. That's the price that has to be paid if one wants more security, privacy, and anonymity. In short wants to back in the drivers seat; in control.
Compounding that is Qubes being a PC operating system after all, > and I've found just about the only DE that gets all the GUI and HID > stuff working correctly is big ol KDE. For most users, XFCE is suitable > for already mired-in-Linux users who are conditioned to accept broken or > absent UI features. That's funny. My experience with KDE is exactly the opposite. In my mind there is no perfect DE. For me a good DE is light (does not waste resources (fancy desktop effects)), is fully configurable; knows it's place: managing the desktop. > > OTOH if its the klocs themselves that are seen as a threat (enabling > attacks from upstream) then that's a tough spot bc very low kloc IMO is > a recipe for bad UI w too many missing features that make users feel > paralyzed. At the end of the day these are still computers and their job > is to manage complexity and _that_ requires lots of vertical integration. > I think in the end it boils down to the simple fact that technology cannot replace education, which is certainly true, but to get the average user to sit down and to learn certain basics and certain intermediate stuff is a tough sell. I have such discussion almost on daily basis, and I don't expect that every user is an IT guru. An analogy I like to use is: You don't have to be an engineer to drive a car, but you need to know how it works in principle. That's why we--society--requires a citizen to get a driver license before they are aloud to drive a car. This thread shows clearly that not one distribution or software system could solve the problem; modulariztion could, provided the development system does not imposes to many dependencies like target distribution, unfortunately, do. For example one wants to install only software A, but gets B and C too because it's bundled. That's why I thought that a meta-distribution would suit better to build a target-distribution like Qubes. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/c2969035-fd8a-a6f3-464c-596a3a12f696%40riseup.net.
