Also, I’ve heard about the dev(s) and community being a bit toxic, or at least not being a pleasure to collaborate with. But I can’t verify that.

FWIW, this hasn’t been my own experience. If anything, it may give of some “know-better”-vibes like one might recognize from engaging with some of GrapheneOS’ community members.

Does anybody in this sub using Fedora Secureblue?

I do. And have done so for almost a year now.

What is your opinion?

It’s pretty neat. Though, don’t expect to roll your way in without any troubles if you don’t take the effort to read its documentation. Fedora Atomic already does things its own way. However, secureblue, by virtue of its superior security standard, adds its own set of ‘rules’ that one should abide. Personally, I absolutely love how this is enforced. But I can understand why it might be a bit overwhelming for those new on the block. But I have personally helped introduce relative newbs to secureblue and they managed (with some help). So you should be fine; their community on Discord also has been pretty helpful in my experience.

So, if your first priority for your desktop operating system is for it to be Linux-based and your second priority is that it’s properly hardened, then you simply can’t go wrong with secureblue.

I was about to write a long piece comparing different security-focused systems, but I retracted for the sake of brevity. Please feel free to ask a specific comparison if you will.

I’ll keep it relatively brief for fearing unwieldiness.

I’m really not a fan of the “we can’t do anything so let’s sit and wait until everything gets worse” philosophy.

I agree. I hope you’re not implying I’m stating otherwise.

but it was accepted because it was the best thing available at the time for the purpose

More like Red Hat pushed it as the new standard and the rest followed suit. Distro maintainers are pragmatic and reasonable people. They’ll more often than not go for the path of least resistance.

A clear cut example of this would be how most distros don’t opt for btrfs in combination with time shift or snapper for snapshot functionality. So clearly, they are not really trying to offer the best solution. Instead they just try to push a system that’s as easy as they come for them to maintain and act accordingly.

the community needed a standard

And we already had one: SysVinit. Don’t try to rewrite history.

I initially started writing a reply on the remaining text but noticed that my writings were continued to be misunderstood. Therefore, I decided to retract any further reply and will choose to stop engaging in this conversation. Thank you for the engagement. However, I would like to offer a small piece of advice as a fellow Lemmy user:

In future conversations, whether they are debates or discussions, please try to understand what the other person is saying. Avoid creating a straw man argument. If needed, ask for clarifications to ensure you fully grasp their point. If you continue to have difficulty understanding, consider alternative approaches to gain a better understanding.

I don’t know how this conversation deteriorated, but I’ll let it be. Thank you once more. For the record, I don’t think this conversation will be productive moving forward. You seem to be focused on your own points without trying to understand the other side, which is fine. You don’t have to try to understand me; I may not be important. However, the ideas I try to convey might be, and it’s more important to consider and understand those.

Anyhow, I wish you the best.

I think I better understand you now. Btw, I had changed my previous reply moments before I read your reply. My bad*.

I meant that I support this distro as long as it’s not immutable because I’m an opponent of immutability on the desktop. If they’re also making other kinds of systems, immutability may be beneficial there.

Have you been around since before the introduction of systemd? Systemd’s introduction was a lot more invasive and threatening to ‘traditional’ distros than immutables are today. Distros changed to systemd over night. Only Arch and Debian had communities that succeeded in establishing systemd-less derivatives. By contrast, the interest for immutability in existing distros (almost always) means a parallel distro is created with (at least initially) immutability tacked on.

So, please correct me if I’m wrong, but I feel as if you’re being too aggressive/overreactive considering how nonthreatening immutable desktops are to traditional distros.

Sometimes innovation change is bad or rushed (such as removal of X11 on Fedora).

Fixed that for you 😉.

Often only people with the newest hardware can benefit from it anyways.

Fair, but as unfortunate as it is, that’s basically a consequence of consumerism. I don’t like it, don’t get me wrong.

They don’t care about regular users making the products worse for them which is basically egoism.

I don’t think this applies to Linux overall. Fedora (and Red Hat by extension) have a vision that made them default to Wayland by default. So you’d be right to blame their policy. But this is nothing new for Fedora; they’re known to push bold changes. You might not like it or disagree with them. Fine. But is it important enough to hate them for it? Isn’t life too short for that?

There is a reason for proprietary products having legacy support after all.

Are you implying that doesn’t apply to Linux? I don’t understand. On an open system like Linux is, this doesn’t really seem to hold much weight. You can swap stuff around as you see fit.

They claim to have a lot of features.

What features are you referring to?

As I understand it, it’s basically trying to answer the following question: What if we could start over and use existing building blocks to make a simple yet complete system using the Linux kernel? All changes have been made in accordance to that basic premise. From replacing GNU in GNU/Linux with BSD, to choosing dinit over systemd as init system.

I hope they succeed (as long as it’s not immutable)

Are you one of those with a raging hateboner towards everything immutable? I ask this as I don’t see any reason to bring this up in the first place.

FWIW, I absolutely hope for it to succeed as well. Innovation (of any kind) pushes the industry forward. When people oppose innovation for whatever reason, it always reminds me of Henry Ford’s famous quote: “If I had asked people what they wanted, they would have said faster horses.”

Sorry for late response.

Also didn’t know about secureblue

Yup. It’s a relatively new project and doesn’t try to be very newbie-friendly. Hence, will not be talked about commonly in threads. Rightfully so, as I’d argue exquisitely hardened systems simply have to prefer security over convenience.

But it’s definitely neat and had its fair share of users. As the folks over at GrapheneOS and Privacy Guides seem to be enthusiastic on it, I wouldn’t be surprised if it receives a new influx/stream of users once community members of GOS have launched a dedicated website on it (which is already in the works) and the peeps responsible for PG’s recommendations have finally included secureblue as their de facto Linux recommendation.

hopefully it can all work together

So do I 😊!

Thank you for the chitchat! I wish you the best!

That sounds a bit funny, when those technologies are just (despite me not liking to use this term) inferior

Perhaps I should have worded that better 😅. It was meant as a textbook example of status quo bias; anything found by default on a ‘product’ that’s deliberately opinionated will see its audience gravitate towards said defaults. Even if those defaults are inferior to other options.

So, in this case, uBlue initially had a script within ujust (or just) that installed the Nix package manager. It wasn’t necessarily the perfect fit, but it definitely had its use cases:

• Installation of CLI software was better handled by Nix than the alternatives (read: either Toolbx/Distrobox or layering with rpm-ostree)
• Flatpak was even more restricted than today. So Nix offered an additional avenue for installing GUI software without layering.
• The nixpkgs repository supersedes even Fedora’s own repositories in terms of available packages, effectively making it their atomic AUR.

But then, not long after the troubling conflicts between Nix and SELinux, brew was inaugurated as the de facto alternative for CLI and the rest is history.

in terms of packaging, only flatpak really shines because of its embedded permission model

Yup, can’t agree more.

Yeah, I think you should at least give it a shot and see how you like it, it’s not as easy right out of the box as the other 2 you mentioned, of course, so you should find out for yourself what you feel more comfortable using.

FWIW, I have actually used Nix sparingly in the past. IIRC, it broke on me at some point 😅. That could be on me, though. Unfortunately, I don’t recall the details. It could also be related to the hardening found on secureblue.

I agree 😜.

lol. I initially had a better written reply that I was about to send, but I clicked on cancel instead of reply. RIP.

First of all, thank you for sharing your own experiences!

Secondly, in short, looking at the discord servers that are related to the uBlue project, general folk seem to have moved past Nix and use flatpak and brew instead for GUI and CLI respectively. Though, some community members happily report to be content with Nix. So, perhaps I shouldn’t be necessarily opposed to home-manager.

Finally, I didn’t expect to find a crossover between brew and chezmoi to effectively become a quasi-home-manager.

Honestly, you could be absolutely right. I haven’t revisited Nix since Bazzite Buzz #12 informed us on the following:

“The Nix ujust script has also been removed due to conflicts with SELinux policies. Users can still install the Nix package manager manually if they so desire at their own risk.”

However, the above could be outdated; I simply don’t know. Are you aware of any developments that have changed things for the better?

So, the basic premise of the impermanence module is to flush all state on (re)boot. By default, NixOS is already capable of rebuilding your entire system from the config file(s). The impermanence module simply aids in achieving the desired system workflow for no state without reinventing the wheel. In effect, It’s as if you’ve just done a reinstall and setup everything as you like. But you get to experience this on every reboot. For someone that’s perpetually disturbed by state, which has been the case since my Windows-days*, this would finally grant me a peace of mind that I’ve been yearning for years. So, to answer your question, it would help me get (at least one step) closer to stateless Fedora Atomic without giving up general usability.

You would have been right if the entire filesystem were to be immutable. However, for Fedora Atomic, /var and /etc are writable. Thankfully so, as most people wouldn’t want a totally locked down operating system. Heck, no general-purpose distro (or OS otherwise) tries to achieve that level of immutability by default.