I'm a noob to local LLMs. I want to use an LLM to create Python and Bash functions from well-defined specs written by me. I've used Claude's Sonnet for this mostly.

I'm a light user of LLMs and almost never hit the request limit on Claude.

It seems like cloud LLMs are in a price war right now and last-gen capabilities are bottoming out in cost? Is that correct?

I pay about $0.12 per kWh, probably going up as more AI data centers get built.

Hardware I have:

• <16GB VRAM - AMD BC-250 APU - "16 GB total with approximately 12 GiB assigned to GPU UMA and 4 GiB left for the OS" (hardware unlocking changes by the day)
• 8GB RAM - 11th gen Intel laptop with Xe graphics
• 8GB RAM - Pixel 7a
• 32 GB DDR3 - 2nd gen intel - doubt this does anything

Hardware I'm eventually selling:

• 8GB VRAM RTX 3070 + 32 GB DDR5 + 1TB NVMe SSD - AMD Ryzen 5 7600X CPU - putting this here in case it's substantially better than the BC-250

Among this hardware, I should look for a model that fits on the BC-250?

I ran compsize on my debian box. Most files on my btrfs drive are around 20 GB. Almost all are uncompressed. I have 6000 files and 221000 regular extents.

Is that too much fragmentation? The ideal case is 1 extent per file.

I am reading around 100 MiBps from the drive out of a theoretical max of ~119 MiBps on a 1 Gbps line.

edit: On a local read I am getting 130-150 MiBps which exceeds the 1 Gbps network. pv /path/to/file >/dev/null

edit 2: For reference, this is a WD Red 6TB drive from around 2018-2020. Max speed should be in the 200 - 250 MBps range.

I defragged a ~300 GB folder and deleted some unneeded files. Extents per file actually went up, but I think that's because the remaining files are heavily fragmented (many 70+ extents per file). Somewhat surprisingly, most/all of the defragged files still had 3-10 extents. Each file is under 2 GB.

Before: ~35 extents per file. After: 55 extents per file.

compsize /path/to/folder
Processed 2648 files, 145287 regular extents (145287 refs), 1 inline.
Type       Perc     Disk Usage   Uncompressed Referenced
TOTAL       99%      1.5T         1.5T         1.5T
none       100%      1.5T         1.5T         1.5T
zstd        19%      236M         1.1G         1.1G

Follow up of https://lemmy.frozeninferno.xyz/post/60352426

A good use case to have: I want to ensure my OS is authentic. I want to run Ubuntu from the Ubuntu people, Qubes from the Qubes people, and so on. Once the OS is booted, it is assumed that native tools inside it can verify the authenticity of the software that is run. If this is not the case, leave a comment and I'll reply or make a new post.

Comment:

I don't think you understand how apt works. Anyone can roll out a mirror.

Also, again, the hashes need verification. Trusting the transport rather than a signature is obviously going to lead to compromise somewhere in the chain.

Look buddy, you do you. If you clearly already aren't using the signatures provided with hashes when you use hashes, so it's no bother to you. Apt, and I, will continue doing so.

So what is the threat here?

Trusting the transport rather than a signature is obviously going to lead to compromise somewhere in the chain.

This makes no sense to me. The transport = the HTTPS chain? If so, that's all encrypted. It's like saying that my bank password is going to be slurped off public wifi (when the site is HTTPS).

My "plan C" and "plan D" remain viable threats against the "hash, don't check signatures" strategy. Any OS worth hashing is worth signing, so plan D is the one to look at.

❌ plan D

• good guy creates software.org
• distributes legit software and public keys
• bad guy compromises software.org at a later date
• did not compromise the public key (created years prior by the true owner)
• bad guy cannot distribute software that matches the public key
• software is malware, served over valid https, and verifiable with malware hashes served by bad guy
• hashes would "validate" the malware, but key verification would fail

What good is a PGP key?

Something I did not think about in my OP, but realize now after reading up on PGP - the good guy's PGP key would have to be available to me as an end user. There could(?) be two Ubuntu PGP keys fighting for authenticity. Such an attack would be very gutsy and obvious. But as someone new to this ecosystem, it seems you must first trust one party.

In the ideal case:

• I physically verify someone's identity documents (passport, etc.)
• I get their key
• their key is connected via a short number of hops to the software I want. Let's say 4 hops to an Ubuntu developer.
• now what?

The one person I verify could show me fake documents. Not very likely. But I feel like neither is compromising ubuntu.com ? Especially with nobody noticing? A lot of major software is mirrored on Github too. So PGP is better than hashing two files because? The examples here don't help.

I think the commenter assumed I was arguing that the OS should not do verification in apt or other tools. What the OS does is none of my business. I just want to defend against (or even better, understand) threats. If you can install a 100% authentic Ubuntu ISO and have apt install curl lead to a version of curl other than what the maintainers of curl and/or Ubuntu intend for you to install, I would hope I know that by now.

A lot of software is distributed with PGP keys. These can theoretically be used to verify that the software was created by the person who owns the key. (Sorry if I get the PGP details wrong, I have no practical experience with it.)

Software also comes over HTTPS. With Let's Encrypt, the verification is tied to ownership of the domain (DNS records I think). So if you're on ubuntu.com with HTTPS, you're getting files only approved by whoever owns the ubuntu.com domain.

HTTPS is super convenient. If you're paranoid, or the entire chain is not HTTPS (HTTPS links to HTTP downloads), you can use a hash program. Hash programs are implemented on all major OSs. It's visually inspectable.

PGP on the other hand is such a mess that even some cryptographers don't like it.

What practical threats would be stopped by a PGP key that are not stopped by HTTPS?

✅ plan A

• good guy owns software.org
• encrypts with let's encrypt (only provided if they prove DNS ownership of software.org)
• https page serves software download

✅ plan B

• good guy owns software.org and has at some point signed a public key
• serves page on software.org with software verifiable with PGP key import

❌ plan C

• bad guy owns software.org
• software is compromised, but you would never know
• software is malware

❌ plan D

• bad guy owns software.org
• did not compromise the public key (created years prior by the true owner)
• they cannot distribute software that matches the public key
• software is malware, served over valid https, and verifiable with malware hashes served by bad guy

Writeup from 2022 that I assume is mostly still valid. TLDR:

1. Mainstream Linux is less secure than macOS, Windows, and ChromeOS. (Elsewhere: "[iOS/Android] were designed with security as a foundational component. They were built with sandboxing, verified boot, modern exploit mitigations and more from the start. As such, they are far more locked down than other platforms and significantly more resistant to attacks.")
2. Move as much activity outside the core maximum privilege OS as possible.
3. OP doesn't mention immutable OS, but I assume they help a lot.
4. Create a threat model and use it to guide your time and money investments in secure computing.

Once you have hardened the system as much as you can, you should follow good privacy and security practices:

1. Disable or remove things you don't need to minimise attack surface.
2. Stay updated. Configure a cron job or init script to update your system daily.
3. Don't leak any information about you or your system, no matter how minor it may seem.
4. Follow general security and privacy advice.

This is extremely encouraging to me. I am not affiliated with the project but here is what I've gathered. Run by Mike.

• Nix (with the functional declarative design)
• Cinnamon (DE mostly used by Linux Mint, Mike and I think Cinnamon doesn't get enough respect)
• Two versions, main and "lite".
• zero config auto update is a huge selling point imo
• flatpak is a nice touch

Main:

• "4 core and 4GB of ram" target
• Flatpak integrated and auto-updates
• Zoom flatpak
• Chrome flatpak and Firefox
• Libreoffice flatpak

environment.systemPackages = with pkgs; [
    git
    firefox
    libnotify
    gawk
    gnugrep
    sudo
    dconf
    gnome-software
    gnome-calculator
    gnome-calendar
    gnome-screenshot
    flatpak
    xdg-desktop-portal
    xdg-desktop-portal-gtk
    xdg-desktop-portal-gnome
    system-config-printer

Lite:

• "2 core and 2 GB of RAM" target
• no flatpak
• firefox

  zramSwap.memoryPercent = 100;
MemoryHigh = "500M";
environment.systemPackages = with pkgs; [
    git
    firefox
    libnotify
    gawk
    sudo
    gnome-calculator
    gnome-calendar
    gnome-screenshot
    system-config-printer
  ];

Github

Installing

boot the special ISO and connect to wifi via the system settings via the start menu (rough edges here). install.

secure boot is not first-class supported in nix but it 'can' be done.

Does the market need this?

It feels like yes. See what do you install on other people's computers?. A zero-support OS that isn't tied into ChromeOS is a tall order. There are a lot of distros that are "semi" friendly but which are strong enough to give to a stranger and never hear from them again?

The pitch is compelling enough that I put it on my small laptop. I used it for about 20 minutes. That laptop is not a project laptop, and if I could just browse and do basic linux stuff and never think about maintaining it again I'd be happy. I can report back (and contribute to nixbook) if it serves my needs. If it passes my tests I may transition the family Win10 PC to nixbook. I'm getting spooked at how many more threats target Windows than Linux.

tweaking

I'm an ultra noob with nix but you should be able to edit this and have it work. Mike has a post about which config file to edit but I can't find it. https://nixos.wiki/wiki/Nixos-rebuild

$ # Edit your configuration
$ sudo nano /etc/nixos/configuration.nix
$ # Rebuild your system
$ sudo nixos-rebuild switch

I added silversearcher tldr tilde and seemed to work.

Cool tweet

https://fosstodon.org/@codemonkeymike/115582530036847888

I want to make Linux my main OS. I've used Windows for decades. Since Vista or 7, the Windows security model is this, from what I understand:

1. unprivileged programs have limited/no ability to do scary things to your computer. they might be able to read some data, but it's not going to implant malware in the boot sequence for Windows.
2. if a program wants escalation, it triggers a UAC popup and the user has to accept it. Remote programs cannot accept UAC on a physical person's behalf. Escalated programs have admin level control and can do the scary things.
3. As with any OS, there may be privilege escalation vulnerabilities that escalate (1) into (2).

I've only had Windows malware a few times since Win7, and the entry point was fairly avoidable. (Running a sketchy EXE, and a possible drive-by malware install via an advertisement. I could never prove the latter.)

I have never run a password on my Windows machines.

On any system, physical access is game over.

On Linux, the password is paramount. I've tried to understand the security model and I keep failing. Synthesizing from arch wiki

SSH

Equivalent to local physical access as the user. If it's a sudoers or root account, it can do scary things. Not a threat if ssh is disabled or well secured (password or key pairs).

If a network has a well configured firewall (on the router), it should block ssh requests from outside the network unless the admin specifically wants SSH outside the network.

As with any OS, there may be bugs that allow remote access outside of SSH.

Local login / password prompts to physical users

Without a password, you can't escalate to root and install new software. Some software, often dealing with hardware (smartctl) requires sudo/root to run.

Encrypted drives

Passwords can decrypt drives if they are encrypted.

Keyrings

Some DEs (KDE) offer a 'keyring' that stores passwords. It's locked/encrypted with a password, usually the same as the login password.

So what am I missing? Is Windows + UAC + no password secure? What is Linux protecting us from by using passwords?

I recorded a video and went through the bugs / quirks that make the KDE launcher menu feel so awful.

I have a laptop with an 11 inch screen and 768p display. Naturally, my usage breakdown is:

• 80% one window in fullscreen
• 15% two windows side by side
• 5% other

I've considered tiling window managers. I used i3wm on this in the past. It was a little complicated and I customized the bottom bar to show commands for dummies.

alt-Enter: term | alt-D: launch | alt-F: fullsc | alt-1: new workspace | alt-shift-1: move to workspace

That plus some battery, wifi, time info. I never got 'good' with i3 and would consult the cheat sheet regularly.

Is there a paradigm (tiling or otherwise) that would let me quickly and simply launch programs with the keyboard (like most distros these days) and switch between fullscreen windows? and set them side by side as needed?

My usage is keyboard-first but mouse-available. i3 didn't seem tailored to mouse usage the way some other tiling wms are. and sometimes you'd launch a program like the wifi settings window and it wasn't built to be resized for a twm, so it looked weird. (no floating window support.)

edit: Tried

• cachy+LxQt
• cachy+niri
• AntiX + IceWM

Couldn't figure out how to remap keys in LxQt. Niri was cool but a bit overwhelming especially on a laptop with just kb+touchpad and it's easy to back yourself into a corner (window wider than the monitor).

IceWM allows for super+arrows to move windows side by side like Windows. I don't love it but it works okay. Performance is also a big concern and my idle RAM seems to be around 300M for AntiX vs 700+ for cachy+niri.

I got an old HP laptop for a good price. (HP ProBook 650 G4.) It was cheap because it's BIOS locked and requires secure boot. (I believe this is the same as "HP Sure Start".)

Game over, right? Not quite. It still boots secure boot enabled Linuxes. I've installed Fedora with no problems. But I would like the ability to install any modern Linux OS.

To be clear, I have no security concerns subverting secure boot. I only have it on because my BIOS is locked.

There are a few methods that are too hard/expensive:

1. creating my own exploit by referencing the patch notes of later firmwares (theoretically possible)
2. dumping the BIOS myself and getting the BIOS password that way (it's been done on this model)
3. Figuring out the undocumented backdoor HP used until around 2018 to reset BIOS passwords. (It's unclear if the backdoor is patched, or just no longer being used.)

I almost got what I want. I booted Ventoy via USB, and the laptop prompted me to enroll the Ventoy key in the secure boot system. I can boot any ISO I want from Ventoy. I can also boot Ventoy, and do LocalBoot (F4) via Ventoy into an unsigned locally installed OS. I booted Arch this way.

I just installed Mint Cinnamon and it prompted me during install for "3rd party drivers" as well as "enable secure boot". It required an 8 character password (mint requirement or UEFI requirement?) which was required in UEFI on reboot (one time). Then I enrolled the key in secure boot and now I can boot straight into Mint. The install prompt was:

Installing third-party drivers requires configuring Secure boot. To do this, you need to choose a security key now, and enter it when the system restarts (Learn more)

You have chosen to enable third-party software as part of your install, which this system includes hardware drivers for graphics and/or Wi-Fi hardware. Your system also has UEFI Secure Boot enabled. UEFI Secure boot needs to be configured to allow the use of this third-party drivers.

According to Reddit:

• No, third-party drivers do not _need_ Secure boot
• No, the installation wizard also doesn't say you need Secure boot for those drivers, it is warning you that you have secure boot enabled, thus special considerations will be necessary

What's the easiest way to get insecure-boot-like behavior on this device? I was thinking I need to get rEFInd on here so it can search for any relevant OS. I also am not clear on how to install OSs properly in this environment (OSs want to change/configure the bootloader themselves). I'm hoping to install to an NVMe drive, but SATA, USB, and network boot (ha) are options too.

Alternatively, how can I do what Mint did on the install on other Linuxes?

I have a basic understanding of the secure boot "shim" and the cryptography in secure boot, but definitely no practical knowledge.

(I prefer to say BIOS over "UEFI" despite being technically incorrect.)

edit: Still don't know what I'm doing, but Fedora (and thus Bazzite) supported secure boot. I just ran the Bazzite installer, rebooted when prompted, and entered secureblue as the key password. https://docs.bazzite.gg/General/Installation_Guide/secure_boot/

I am a prolific retweeter. I also see many instances prohibit nsfw, or some prohibit nsfw without a cw, or without a specific cw. Many servers have 5 or 10 categories of content that must be CWd. If I boost/retoot a post from another mastodon instance, what does that look like for other users of my instance? Does it show up in the local feed? If I boost an untagged nsfw or otherwise 'bad' content under the local rules, is that moderate-able (bad for the retooter)?

I intend to mark my profile as sensitive and put every post of mine behind a CW.

Sorry for the blatant n00b question. I searched online, the FAQ etc. and didn't see what to me is an obvious question. Supporting old devices is great. In the PC world we have general linux, but on Android and some other consumer devices, solutions have been limited. There are Android forks(?) or implementations like LineageOS that run great. I've used non-Google Android since 2018.

So what is the motivation for yet another OS solution? There must be a reason for this project to go on and have so much enthusiasm.

We think computers should act in the interest of their users. For example, they should not participate in the privacy nightmare of targeted advertising, as it is directly built into the operating systems from Amazon, Apple, Google and Microsoft, as well as the apps and services recommended by them.

This is kinda FUD, right? Google-Android has a lot of privacy invasion. But there are all kinds of Android versions that are de-Googled.

My best guess right now is that it is attempting to provide a "full featured" distro for devices that run phone and tablet OSs now. So if you want a server or full coding environment on a phone, pmOS may be better suited for that than an Android "fork".