Fedora Magazine

Yes, and I think we're already seeing that in the general trend of recent linux work toward atomic updates. [bootc](https://developers.redhat.com/articles/2024/09/24/bootc-getting-started-bootable-containers) based images are getting a ton of traction. [universal blue](https://universal-blue.org/) is probably a better brochure example of how bootc can make systems more resilient without needing to move to declarative nix for the entire system like you do in NixOS. Every "upgrade" is a container deployment, and you can roll back or forward to new images at any time. Parts of the filesystem aren't writeable (which pisses people off who don't understand the benefit) but the advantages for security (isolating more stuff to user space by necessity) and stability (wedged upgrades are almost always recoverable) are totally worth it.

On the user side, I could easily see [systemd-homed](https://fedoramagazine.org/unlocking-the-future-of-user-management-with-systemd-homed/) evolving into a system that allows snapshotting/roll forward/roll back on encrypted backups of your home dir that can be mounted using systemd-homed to interface with the system for UID/GID etc.

These are just two projects that I happen to be interested in at the moment - there's a pretty big groundswell in Linux atm toward a model that resembles (and honestly even exceeds) what NixOS does in terms of recoverability on upgrade.

This is macho-computing bullshit, the same as the 1980s "it's a toy unless it's a command line".

For most users, SIP increases ownership and control. Chrome can no longer make your Mac unbootable.[0] Journalists and human rights activists can be slightly less afraid of rootkits that can put their lives at risk. Teenagers can worry less about RATs that access their webcams and blackmail them. Companies can deploy these machines with greater confidence that trade secrets won't be stolen.

There's a reason Microsoft, Apple, and even Fedora[1] are all moving in the same direction. Most of the time, modifying system binaries is not done in users' interest: it's either malware, or it's "legitimate" large software vendors who couldn't write proper code at gunpoint, yet feel entitled to take over your kernel, make it unstable and increase its attack surface (look at Windows antivirus makers in the '90s and early '00s. Just look at how ISVs lobby against these security measures: [2]).

[0]: https://arstechnica.com/information-technology/2019/09/no-it-wasnt-a-virus-it-was-chrome-that-stopped-macs-from-booting/

[1]: https://fedoramagazine.org/what-is-silverblue/

[2]: https://en.wikipedia.org/wiki/Kernel_Patch_Protection#Criticisms

The "new" way of doing this would be using systemd-cryptenroll [0]. I did this recently on Ubuntu 24.04. I actually tried the default LUKS+TPM shipped with Ubuntu 24.04 at first [1], but it was a bit disappointing because it locks you into using snap-based kernels. This means you cannot install custom DKMS modules (which I needed). Although Clevis is very interesting software (you can even unlock based on some other computer in your network [2]), it's not absolutely required anymore for LUKS+TPM.

[0] https://fedoramagazine.org/use-systemd-cryptenroll-with-fido-u2f-or-tpm2-to-decrypt-your-disk/

[1] https://ubuntu.com/blog/tpm-backed-full-disk-encryption-is-coming-to-ubuntu

[2] https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/security_hardening/configuring-automated-unlocking-of-encrypted-volumes-using-policy-based-decryption_security-hardening

You could have been a little clearer, but the main communication problem is that I didn't know that was a problem that could exist so it was easy to not follow. After a few minutes of confused web searching, I found https://fedoramagazine.org/thunderbolt-how-to-use-keyboard-during-boot-time/ which appears to describe the problem and some solutions (that don't involve homed, not least because this article predates it). AIUI, the problem is that you have to log in so you can approve the keyboard; that might be a pain point with an encrypted root (albeit it looks solvable), but if it works with homed I struggle to believe that it wouldn't work with any other encrypted home setup. Mostly because that part of homed is mostly a thin wrapper of code and convention over existing stuff.

I would highly recommend this also,- but firstly you need to understand how it fits into an organisational system.

I founds this YouTube very informative as to how [all these things hang together](https://youtu.be/cUQcNi_obIc?si=HtZ9iLc76KF2iB2L). [This is perhaps relevant for passkeys](https://fedoramagazine.org/fido2-for-centrally-managed-users/)

Alternatively you can go down the OIDC or SAML paths (generally the path of a developer)

While I've worked with keycloak I've always found the [Curity's resources](https://curity.io/resources/openid-connect/) for understanding OIDC core and extensions very good.

The order in which you learn these things isn't really important but they're both important (but really depends on your problem domain)

> In windows, I can just shut the lid and not worry about it, because it will sleep first, and eventually hibernate. Ubuntu would just sleep until the battery dies.

It's really funny because this is one of the things I absolutely do not like about Windows. I absolutely hate it that I put the computer to sleep and when I come back the next day it has hibernated. That said, I agree that hibernation has always been finicky on Linux, however, I would say Ubuntu is not the best distro for this use case. I have been using Fedora and they even publish official guides for it[0] that's how seriously they take it.

0: https://fedoramagazine.org/update-on-hibernation-in-fedora-workstation/