styanax

You may have missed this, it's only been ~11 days since the post but they've got a solution now, with the first release having happened:

https://discuss.grapheneos.org/d/27068-grapheneos-security-p...

> Spreadsheets are a fundamentally important tool—the original "killer app" for personal computers such as cellphones

I do not agree with your supposition. Like the parent using the G1 as I did (and still have it), never used a spreadsheet app on any of my many, many phones both personal and work. I am/was a systems engineer by trade.

> Last I checked, there was no spreadsheet in F-Droid

The most popular viewer is the LibreOffice one[1], which can handle ODS and XLS (amongst many others) formats. You may have meant editing/creating which I agree they're not around. See item (1) above though.

> largely because it's a relatively small ecosystem, and most Android users still aren't using F-Droid

Or possibly, a large number of users simply do not need or use generic spreadsheet apps on their mobile devices, which is why I disagree with your opening statement as I am a direct counterexample.

[1] https://f-droid.org/en/packages/at.tomtasche.reader/

> I agree, but why not also apply the same logic to the other two communication platforms you are using (Discord and GitHub)?

Aside, this infuriates me - "here's our open source project/website, join our Discord!" (even Lemmy instances). sigh

Sharing undocumented gotcha: nginx default config (/etc/nginx/nginx.conf) now has `server_tokens off` set with a comment that it's "common practice" (agreed). This is not in upstream's git version of the file[1], I therefore presume it's a Debian maintainer change.

The operational upgrade failure is if you have any existing drop-in config that sets `server_tokens off` already a hard fail Nginx error about duplicated keywords will occur, causing the apt process to exit with failure code(s) during the standard upgrade process.

[1] https://github.com/nginx/nginx/blob/master/conf/nginx.conf

[ eldritch noises intensify ]

As an actual answer, it's not too bad on Debian; we only really use/need: systemd (system and user), -logind, -journald, -udevd. All in all, not too many tentacles but there are a few...

We're partially there, under Storage is an option allowing you to set how long to keep messages and I've set mine to one year. Possible: forever (default), 1y, 6mo, 30d - and it works, my old chat messages (not the whole chat, just individuals) are properly culled over time.

Edit: in context, Google Messages has none of these features and I have friends still married to Google Voice who send me tons of pics. Culling SMS requires using a third party tool to export and re-import etc. leagues behind Signal. None of it's backed up without the same third party tools as well and no built in image management.

> I just ran a backup, and it was 850MB. So having my phone upload something of that size every day would be a bit annoying

It may be inconvenient but this can be solved by using the features in the app to review your storage and save those thousands of images/audio/file sequestered inside the app out to the filesystem, then delete them from the app. You're not backing up "chats" you're backing up your image library being stored inside a chat app.

(yes I get the argument that you need to store them "in context" so save those and do the rest. there's no way 100% of that 850MB is "must have saved inside the app in chats" data, I'll bet $10 USD on it)

Been running Linux on laptops since around 97 (Dell Inspiron 4000 clone, PII-400 I couldn't afford the PIII-450, Red Hat 5.x); over many years and laptops it comes down to: use a Thinkpad T-series or a Dell Latitude/Precision (modern times, not the XPS or Inspiron) and your Linux experience will be quite smooth. (sometimes card reader hardware doesn't work if they used some weird chip, which Dell seems to like to do with those devices)

KeepassXC (Linux) can import Bitwarden files directly as well, as both programs support H/TOTP there's a solution here. Not what I do, but I can see the use case aligning to the GP's comment - using Bitwarden (e.g.) as the TOTP app could allow importing it's backups to KeepassXC if your main/only mobile device fails and you only have a laptop etc.

Very interesting question, I have no experience here. What I do instead is scan my QR codes into two apps on different devices when I make them (I do not make them very frequently so it's not a chore). Because I'm sort of pessimistic after a lifetime working in tech - everything that uses electricity breaks and fails. I build redundancy into all my (things) and just expect one of them to fail. Goes for email providers, hard drives and OTP codes - if I could have a backup washing machine, I would. :)

Replied to another comment with the same recommendation before seeing this, here's the URL for those interested:

https://github.com/beemdevelopment/Aegis

I would recommend Aegis Authenticator [1] - available in the Play store or F-Droid. It's been featured on HN now and again. One thing it can do is import the data of all the other OTP apps, and create backup files (the seeds) which you can do whatever you want with.

[1] https://github.com/beemdevelopment/Aegis

That's a common thought, but it depends what you touch. I have hundreds of user.js customizations related to local browser behaviour (e.g. null out a lot of upstream URLs, I caught FF making DNS queries to services I disabled) - https://coveryourtracks.eff.org/ reports I have extremely strong anti-fingerprinting. The "failures" are not related to Firefox.

Reading the details of the results, my unique values as reported come from factors which are hard to address; I have an Arch Linux user-agent (small population) and I have Linux fonts installed (we'll fail the span-font test easily compared to Windows or macOS) are the two huge outliers. These two are my heavily identified traits, the rest are a wash or normality ("1 in 3").

The fonts one is funny - the span-font metric for my system is 16.82 of 115876.67 kinda showing just how using Fonts you can pick a Linux user out of the results with ease. I have "the usual" font packages installed, nothing too fancy just enough to see CJK / UTF-8 around the web like everyone else. (for completeness I do remap 2 or 3 esoteric fdnts on my side due to a site using them).

Side note: I have webgl disabled in user.js; the site reports I'm 1 of 85 statistically, this being the third largest and only outlier in normality.

You can preload them now in your profile `user.js` - FF will ignore any settings it does not know about, it's "safe" to leave old things that got deleted and add new things coming in the next ESR without harm (that I'm aware, been doing it for years). A user.js is portable, not relying on any given vendor configurations.

Use the EFF version, it's been around a long time: https://coveryourtracks.eff.org/

Trivia: CIS Guidelines (security tasks applied to a server to pass an enhanced security audit to be compliant with a standard, in a soundbite) has an item requiring /var/tmp to be a bind mount to /tmp (as well as setting specific security options on /tmp). A server attempting to pass CIS audits (very common in my work-related experience w/Enterprises) may well not have a unique /var/tmp.

> Today, we’re pleased to announce full offline support for all our customers, in our apps and even on the web. (2025-08-26)

> I miss GameSpy, the original application, not the service it morphed into later

You drove me down nostalgia lane, looked in email and have my GameSpy receipt with unlock code. We paid $21.55 after tax in March of 1998 - my memory is really fuzzy but besides CS I think Quake III Arena was also popular at the time.

The readme clearly directs the reader to the F-Droid package, which are built on their buildservers and signed with their APK keys. This does not answer the security question directly, but it's the same model as say Debian repos. There are eyeballs on it by an independent third party packagers who use code scanners and manual review to detect malfeasance, and often have to tweak builds and code to get rid of unwanted things present in some upstreams.

> because you end up doing multiple searches in parallel and merging results

This reminds me of the design model of SearX/SearXNG - instead of a distributed forge index, it would distribute the search endpoints of forge instances to facilitate the next steps you outline. It almost feels like a central coordinator or maybe a CDN-like network set of search proxies would be needed to do the actual combining and filtering of results. Maybe it could fit in the Codeberg operational umbrella in some future plan.

In practice Nostr does this step on the client side - one subscribes to relays, then when querying for new content it asks all relays, gets all the duplicate metadata and filters on the client. Huge network use and battery drain on your handheld device, Nostr bouncers have emerged for this exact same reason, a popular software is "Bostr", easy to find examples run by random volunteers but it requires money (disk/cpu/ram): https://bostr.azzamo.net/

Sadly, as soon as I open the site in a private window with access to Notifications denied, a full page error screen about "Odoo Client Error" appears asking you to report... something.... to someone...? Not a good look at all.

Screenshot: https://postimg.cc/WFDzQndC

A problem I've seen emerge in the Lemmy side of ActivityPub is that it relies on a hub and spoke model. In practice this has failed when the hub goes offline, all the spokes are now left with independent copies of it's last known state and destroys the community progress (have to rebuild elsewhere, lose old content and references, etc.) if even you can regrow the community.

Mastodon has the similar problem but worse with content discovery; a user is not "seen" remotely by anyone until one remote person finds them and subscribes to their content explicitly. On every single remote instance, which of course is undesirable but that's how ActivityPub is designed.

I don't believe in ForgeFed terms this matters as much as being able to search across the federated network for repos, etc. which I think is a key feature. Sure issues and user accounts and whatnot, but an AP-linked FF-wide search would be insane on how useful it could be for users (and how to implement a "distributed search index" seems like a tough nut to crack).

A tough question as everyone's needs are different; I might recommend you create an account on https://codeberg.org as it's the largest, most popular instance of Forgejo running with many FOSS projects hosted there.

Codeberg devs have to disable some features (pull mirrors e.g., only push is allowed to prevent abuse) and they use some custom code (abuse mitigation - spam, etc.) but in general you're getting the latest Foregjo experience "test drive" which only gets better when self hosting when you can use all the features.

The solution works really well though - a reliable, name-brand SSD (sic) in an old $100 Dell Latitude as the workhorse. The Latitudes allow changing the charging profile in BIOS to "always plugged in" amongst the other power friendly things (disable TurboBoost, etc.). Built in UPS, keyboard, monitor, wifi/eth; portable, quiet and with the right tuning (disabling a lot of modules in GRUB or module blacklists) runs most of the time without kicking the fan on. I run 2, one doing all the work and another backing it up. I run with only a partition encrypted (requires manual unlock after boot, my choice) so that I can remote login after boot to mount that, never have to actually open the laptop unless, say, wifi goes south. Laptop dies (they never do), just pull the SSD and slap in another one it's Linux it'll boot.

95% XEP feature coverage. https://compliance.conversations.im/server/Quicksy.im/

> but I blame the "everything is an extension" model ...

100%. If you're not keen on self-hosting and want to use any one of the many, many public servers this becomes such a pain, and leads to the same "decision deadlock" trying to get friends to join Mastodon or Lemmy ("which one do I want? there are so many, how do I know if it's good"). Because this is a thing:

    https://compliance.conversations.im/

"Hmmm, does xyz.com support XEP-1234 for message archiving?" or whatever it is; there's a real uphill social battle unless you make those choices for your friends to get started. While Signal is not perfect, it's easy onboarding without confusing XEP which-server choices for the average human. $0.02 I struggle to get people on Signal as it is.

Edit: found it, it's XEP-0313 and only 92% of public servers support it. Only 86% support Push Notifications, 94% OMEMO. One can argue server operators have disabled them but it points back to decision deadlock.

The ARGS_MAX (`getconf ARGS_MAX`) is defined at the OS level (glibc maybe? haven't looked); xargs will also be subject to it's limitation like all other processes. One can use:

    xargs --show-limits --no-run-if-empty </dev/null

...to see a nicely formatted output include the -2048 POSIX recommendation on a separate line.

Much appreciated, thanks.

I cannot seem to find the RSS link anywhere on this site, can you share which url you have directly in your RSS reader? thx

The site is built with a content creation tool which has used a lot of JS and CSS, but the CSS is atrocious in it's automated output so it's triggering the browser to have to interpret the mess of directives in every code block. The tool is generating HTML trash like (brackets replaced for comment to not parse):

    [span style="--0:#E1E4E8;--1:#24292E"] [/span]

...over and over, essentially giving style directives for every blank space in the code block. A less capable mobile CPU may well have issues rendering this site due to the presence of so much trash CSS inside it guts. $0.02 hth