LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > antiX / MX Linux
User Name
Password
antiX / MX Linux This forum is for the discussion of antiX and MX Linux.

Notices


Reply
  Search this Thread
Old 11-21-2019, 04:46 PM   #16
freemedia2018
Member
 
Registered: Mar 2019
Distribution: various automated remasters
Posts: 178
Blog Entries: 2

Rep: Reputation: 156Reputation: 156

Quote:
Originally Posted by Ulysses_ View Post
Let's say you make an exception and you include one non-free driver. But you do it in a virtual machine. Can it change the CPU microcode and affect all virtual machines and the host?
You're asking about virtual machine escape: https://en.wikipedia.org/wiki/Virtual_machine_escape

Technically speaking it is always a possibility, however remote.

Also, by the way:

A guy at the antiX forum says you'll need to use the live-kernel-updater to swap out the non-free kernel with the libre one.

Last edited by freemedia2018; 11-21-2019 at 06:39 PM.
 
Old 11-21-2019, 08:24 PM   #17
jamison20000e
Senior Member
 
Registered: Nov 2005
Location: ...uncanny valley... infinity\1975; (randomly born:) Milwaukee, WI, US( + travel,) Earth( I wish,) END BORDER$!◣◢┌∩┐ Fe26-E,e...
Distribution: any GPL that works well on my cheapest; has been KDE or CLI but open... http://goo.gl/NqgqJx &c ;-)
Posts: 3,874
Blog Entries: 2

Rep: Reputation: 1314Reputation: 1314Reputation: 1314Reputation: 1314Reputation: 1314Reputation: 1314Reputation: 1314Reputation: 1314Reputation: 1314Reputation: 1314
I don't think we thought to ask but what hardware are you giving up? Even on laptops you can sometimes switch hardware if there's not a free one available; If you'd worry about the Bios being free you may need to remove the chip and flash it.

Anyone know what they call spy hardware, embedded in your system from whatever shady offices of the world or is it still just plain old spyware? Using one right now...
 
Old 11-22-2019, 11:22 AM   #18
Ulysses_
Senior Member
 
Registered: Jul 2009
Posts: 1,197

Original Poster
Rep: Reputation: 56
Not giving up any hardware yet. I was concerned your script might have a fixed set of packages that it knows to be nonfree and removes them. But it seems that instead you get the list of what to remove with an invocation of apt and then remove them one by one with other invocations of apt. How do we know this list produced automatically is really the complete list of packages that have blobs? What's to stop spooks from forcing debian to include a blob in an update without telling you the updated package is now nonfree?
 
Old 11-22-2019, 01:54 PM   #19
Jan K.
Member
 
Registered: Apr 2019
Location: Esbjerg
Distribution: slackware...
Posts: 126

Rep: Reputation: 49
Wouldn't LFS be the obvious choice for you?
 
Old 11-22-2019, 02:31 PM   #20
Ulysses_
Senior Member
 
Registered: Jul 2009
Posts: 1,197

Original Poster
Rep: Reputation: 56
No because LFS is about teaching, not a production distro. I wonder why no one is promoting a production distro that is fully built from the sources automatically.
 
Old 11-22-2019, 03:24 PM   #21
jamison20000e
Senior Member
 
Registered: Nov 2005
Location: ...uncanny valley... infinity\1975; (randomly born:) Milwaukee, WI, US( + travel,) Earth( I wish,) END BORDER$!◣◢┌∩┐ Fe26-E,e...
Distribution: any GPL that works well on my cheapest; has been KDE or CLI but open... http://goo.gl/NqgqJx &c ;-)
Posts: 3,874
Blog Entries: 2

Rep: Reputation: 1314Reputation: 1314Reputation: 1314Reputation: 1314Reputation: 1314Reputation: 1314Reputation: 1314Reputation: 1314Reputation: 1314Reputation: 1314
People do build Linux from scratch to use as well. Gives a good reason right on their website, build it however you want it.
 
Old 11-22-2019, 03:58 PM   #22
freemedia2018
Member
 
Registered: Mar 2019
Distribution: various automated remasters
Posts: 178
Blog Entries: 2

Rep: Reputation: 156Reputation: 156
Quote:
Originally Posted by Ulysses_ View Post
Not giving up any hardware yet. I was concerned your script might have a fixed set of packages that it knows to be nonfree and removes them.
That is how you would do it, yes.

Quote:
But it seems that instead you get the list of what to remove with an invocation of apt and then remove them one by one with other invocations of apt.
That is another example of roughly the same thing, done slightly differently.

Quote:
How do we know this list produced automatically is really the complete list of packages that have blobs?
That's how these things are typically done.

Quote:
What's to stop spooks from forcing debian to include a blob in an update without telling you the updated package is now nonfree?
Speaking in the long run? Deterministic builds.

As someone else mentioned, the only other way to be sure is to build all the binaries yourself.

But that has two flaws-- one, it doesn't address hardware problems. I don't mean driver issues, I mean if your goal is to be as spook-free as humanly possible, you have to delve into hardware issues regardless of drivers (stuff like ME and CPU vulnerabilities.)

For that, there really isn't a distro-- just ongoing research and paying attention to Black Hat conferences, etc.

Removing non-free software and non-free drivers is a great start, but you also probably have hardware with its own operating system on-board to worry about. Such as your CPU running Minix.

The other issue is that even free software can have what's called "bug doors." Linus Torvalds has talked about those.
 
Old 11-22-2019, 05:13 PM   #23
Jan K.
Member
 
Registered: Apr 2019
Location: Esbjerg
Distribution: slackware...
Posts: 126

Rep: Reputation: 49
Quote:
Originally Posted by Ulysses_ View Post
No because LFS is about teaching, not a production distro..
No. The point was to build a production setup, where you literally will know each and every bit gone into it...

Quote:
Originally Posted by Ulysses_ View Post
I wonder why no one is promoting a production distro that is fully built from the sources automatically.
Apart from the "automatically" part, aren't they all?

And even if not, would you trust it? How about Slackware?

Last edited by Jan K.; 11-23-2019 at 10:50 AM. Reason: Spelling...
 
1 members found this post helpful.
Old 11-22-2019, 09:47 PM   #24
Ulysses_
Senior Member
 
Registered: Jul 2009
Posts: 1,197

Original Poster
Rep: Reputation: 56
They are all pretending to be open source and the exceptions that seriously try to eliminate blobs do the building themselves. Instead, I was talking about the end user having the option of automatically building everything at installation time, not following complex instructions but just waiting however long it takes.
 
Old 11-22-2019, 10:03 PM   #25
Ulysses_
Senior Member
 
Registered: Jul 2009
Posts: 1,197

Original Poster
Rep: Reputation: 56
Freemedia, where do I download the antix or devuan version of your script?
 
Old 11-23-2019, 12:34 AM   #26
freemedia2018
Member
 
Registered: Mar 2019
Distribution: various automated remasters
Posts: 178
Blog Entries: 2

Rep: Reputation: 156Reputation: 156
Quote:
Originally Posted by Ulysses_ View Post
Freemedia, where do I download the antix or devuan version of your script?
Let me help you here. First, I've made this script before. It works-- it produces a bootable iso that is modified from the original version of antiX. I've used it to do things like replace systemd in Trisquel with Upstart, even in the Live version. I've used it on several distros including antiX. Look what it says on the left <- for "Distribution".

Using it to do exactly what you want was a goal at one point, but to give you a script to download I would have to spend at least a day or two (not all of a day) updating that work to do what you want.

I've joined the forums and I may well work on that anyway.

With that said, it doesn't sound like you're going to be happy with anything-- not even LFS. That doesn't mean I refuse to work on this, rather it means that I want to be sure what you want before I take the time to do this in a hurry. It's likely I will work on it either way, but I want to be sure what your needs are before I make it my top priority-- you know? A lot of people here have asked some good questions, and I'm not sure even you know exactly what you're looking for. But I'm still watching the thread with interest. Keep in touch, don't be a stranger. You'll find me here or the antiX forums if you need me.

Last edited by freemedia2018; 11-23-2019 at 12:36 AM.
 
Old 11-23-2019, 07:32 AM   #27
hazel
Senior Member
 
Registered: Mar 2016
Location: Harrow, UK
Distribution: LFS, AntiX, Slackware
Posts: 3,681
Blog Entries: 10

Rep: Reputation: 2017Reputation: 2017Reputation: 2017Reputation: 2017Reputation: 2017Reputation: 2017Reputation: 2017Reputation: 2017Reputation: 2017Reputation: 2017Reputation: 2017
Quote:
Originally Posted by Ulysses_ View Post
I was talking about the end user having the option of automatically building everything at installation time, not following complex instructions but just waiting however long it takes.
There are automated LFS derivatives that do that. What you install is basically a script and it downloads source code and builds your system. I think Arya Linux works like that.
 
Old 11-23-2019, 02:28 PM   #28
Ulysses_
Senior Member
 
Registered: Jul 2009
Posts: 1,197

Original Poster
Rep: Reputation: 56
Freemedia, definitely do NOT make it a priority, it is only a convenience as far as I can tell, one can always follow the instructions in this thread and come back here for help if they get stuck.

Make one thing clear. Is the blob-free antix we are talking about as secure and privacy respecting as devuan or more? Antix's ability to run on older hardware is an attractive feature when you want it for both the host and guests in virtualization, as low ram and cpu usage are greatly appreciated when you run lots of VM's. Also the stability of a debian derivative like antix is attractive. But my core motivation in this thread is security and privacy. Without sacrificing ease of use.

Antix is also attractive because it is perceived as a people's distro, as opposed to a corporation-serving one. But then I have no idea who finances its development and decides things. Who does?

Last edited by Ulysses_; 11-24-2019 at 03:10 AM.
 
Old 11-23-2019, 07:23 PM   #29
freemedia2018
Member
 
Registered: Mar 2019
Distribution: various automated remasters
Posts: 178
Blog Entries: 2

Rep: Reputation: 156Reputation: 156
Quote:
Originally Posted by Ulysses_ View Post
Antix is also attractive because it is perceived as a people's distro, as opposed to a corporation-serving one. But then I have no idea who finances its development and decides things. Who is?
As far as I know, "anticapitalista" makes the final decisions, but cedes to trusted volunteers, if that tells you anything.

I am going to guess that antiX and Devuan are on similar levels in terms of being secure. I would take the one that has non-free binaries removed over the one that doesn't. Neither remove those by default.
 
Old 11-23-2019, 08:16 PM   #30
jamison20000e
Senior Member
 
Registered: Nov 2005
Location: ...uncanny valley... infinity\1975; (randomly born:) Milwaukee, WI, US( + travel,) Earth( I wish,) END BORDER$!◣◢┌∩┐ Fe26-E,e...
Distribution: any GPL that works well on my cheapest; has been KDE or CLI but open... http://goo.gl/NqgqJx &c ;-)
Posts: 3,874
Blog Entries: 2

Rep: Reputation: 1314Reputation: 1314Reputation: 1314Reputation: 1314Reputation: 1314Reputation: 1314Reputation: 1314Reputation: 1314Reputation: 1314Reputation: 1314
Transparent is not more vulnerable then anything you make it to be...
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Conky display gets corrupted since updating Antix-16 to Antix-17 hazel Linux - Distributions 3 12-18-2017 09:55 AM
LXer: Dealing With Contentious Kernel Blobs LXer Syndicated Linux News 0 01-04-2008 07:30 PM
LXer: Binary blobs mean few apps are purely open source LXer Syndicated Linux News 0 08-27-2006 08:21 PM
Suse desktop displays as distorted large blobs penrynpirate Linux - Newbie 10 07-10-2006 08:43 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > antiX / MX Linux

All times are GMT -5. The time now is 01:50 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration