In the distant past there was plenty of times I tried to fix dying web servers by logging in and restarting a rogue process or cleaning up a memory leak... only to have my SSH session and shell sessions being repeatedly killed by OOMs.
Not as big of a problem as it used to be. Both because OOM killer has gotten better and also web servers are such a commodity that remotely cycling them isn't going to cause a outage and is the quickest and cleanest way to get them back into production.
It just meant that you spent too much on servers. Either that or they could of been doing more.
Not a big deal. Being efficient isn't really all it is cracked up to be. Sometimes having a big server that sits mostly idle is a good trade off for what you want to accomplish.
There are lots of very good reasons why running small root partitions on Linux desktops is a very bad idea.
The smart money is on a single large partition for home and root and everything else. This way you get 100% disk availability with zero extra effort and you get maximum performance. No need to shuffle disk space around with resizing partitions or thing volumes or anything like that.
Unless you have some sort of special use case were root partition can't be shared with root then on most desktop setups having a single large partition is the most straightforward way to do things.
Hibernation isn't really something really useful anymore. If people really really want it then I don't see why they shouldn't get it... but I really don't see the point.
> There are lots of very good reasons why running small root partitions on Linux desktops is a very bad idea.
Go on then: name them.
I give root about 2x the space I expect it to take when fully populated. 4x if it's a very big disk. The rest is for me, not the OS.
> The smart money is on a single large partition for home and root and everything else.
With all due respect and deference:
Drivel. Absolute piffle. This is in fact the reverse of the truth.
Maybe you are young and inexperienced but I have bad news for you: OSes crash sometimes.
When (not if) they crash, volumes that they they have open files on tend to get corrupted. This is an especially key problem with some filesystems such as Btrfs that do not have working repair tools.
You should always keep your own data on a separate partition at least, and ideally, a separate physical drive. It will have less wear and that makes SSDs last longer.
In the last decade, keeping my OS on a different volume from my data in `/home` has saved my work at least 5-10 times. I work in the Linux industry. I work with testing OSes. But even on stable OSes, I've seen them crash far more than I'd like. Sadly, in my extensive personal experience, Btrfs is notably unstable and unreliable, and it fails frequently in normal routine operation, especially on snapshotting OSes such as openSUSE.
Always keep `/home` somewhere else, on a different disk format, for safety. XFS is good, but difficult to resize or repair. Plain old ext4 is very good in terms of repair tools.
> This way you get 100% disk availability
Until it fails
> with zero extra effort
Extra effort in setup is FAR preferable to extra effort in data recovery later.
> and you get maximum performance.
The opposite of the truth.
Swap on a different physical drive is faster.
Spread the load across multiple media for performance. That is how server OSes do it, because it is faster.
Any decent NAS OS will compel you to install the OS on different physical media from the data volumes for this specific reason.
You literally could not be more wrong.
> Unless you have some sort of special use case were root partition can't be shared with root then on most desktop setups having a single large partition is the most straightforward way to do things.
Easiest does not mean best. Best is usually not simplest or easiest.
I, uh, would be more careful of making that statement given our public comment history. I know I can't cast any stones here.
More than interesting though, I will vouch for many of the points they presented in practice. Spreading partitions and taking advantage of the flexibility of Linux with how and where they are mounted has been a part of best practices for decades now. Many cloud-based solutions for Linux workstations I've used take full advantage of this for easier management of space (i.e. volume expansion) as well as security considerations, to say nothing of keeping your /var/log separate to avoid running out of space because you turned on verbose mode for something.
> In the last decade, keeping my OS on a different volume from my data in `/home` has saved my work at least 5-10 times.
Mine is of course just another anecdote, but despite seeing some crashes or hangs over the years, I can't remember the last time I've even had to manually fsck my ext4 filesystems, and I'm honestly not sure I've ever seen any unrecoverable corruption on ext4 or ext3. (I'm not saying it doesn't happen, as it certainly can, but I wouldn't think it's that common unless you're operating on a fairly large scale. And before journaling filesystems, crashes were of course a whole different deal.)
I used to keep /home separate on my personal devices (and maybe some other partitions as well because it was "a good practice"), but for more than a decade now my personal devices have had everything on a single large root fs, save for /boot and swap.
I've stuck with rather conservative fs choices and haven't used btrfs much, so I don't know if the story is different there.
What you gain with a single large root partition is of course that you don't need to know in advance how much software you'll want to install under /usr or how much space you'll need for /home or /var.
Multiple partitions can certainly be a good idea from a system management point of view, for cases where people either want to actively manage the system, or when their needs are demanding enough that it's warranted. If I were deploying a server for any kind of real use, yeah, the database or the server logs would certainly not be on the root volume.
But in case of desktops or laptops, most people, even engineers, don't really want to be meticulously managing their personal computers. Nor are most people's personal computing needs that demanding. The convenience of not running out of space on a single partition because you guessed the your future needs wrong wins over.
> Swap on a different physical drive is faster.
> Spread the load across multiple media for performance. That is how server OSes do it, because it is faster.
Of course it is, but in contrast, laptops don't really tend to have separate physical drives on which to put swap. I doubt most people would care enough about swap performance to install a separate high-performance drive for it even in desktops.
With that said, I also do keep a swap partition even on personal computers, and hibernation can be useful. (I think there are some issues with hibernation and encrypted swap in Linux, though, so I haven't bothered with it in a while).
There is a few other people documenting the same thing if you look around.
As far as Linux and swap goes, very generally speaking: if you don't have a application that specifically advises against having swap you are almost always better off with it.
If you don't end up using it then it costs you almost nothing. If you end up using it then it just makes your system more efficient because you are giving up performance for less used memory to make way for more used memory. Zswap sweetens the deal.
In the distant past having swap on a desktop was irritating because file system operations from nightly crons would end up pushing your applications into swap. Then when you go to use your desktop in the morning it will grid away at the disk until the memory was loaded back into main. This sort of behavior has been mostly solved for a couple decades now, but somehow the idea that "swap is bad and slow" still persists.
> I've never really understood why we chase Android-alikes on mobile platforms instead of trying to build on mainstream Linux.
Because there is no such thing as "mainstream Linux" when it comes to anything related to user-facing consumer software. Not on desktops, not on tablets, not on phones.
I mean you invoked "mainstream Linux" and "Nix" in the same paragraph. That alone should clue you into why this, absolutely, does not work.
"Linux enthusiests" would rather muck around with rewriting the same software over and over and over again because they dislike using GTK or whatever, and put monumental amount of efforts making new package managers, then, say, getting the ability to take simple photographs using a phone camera.
I mean... In that page there is no less then 25 different "Linux Phone OSes" listed.
None of them actually work.
They are all going to be slow, they are all going to burn through battery life. There is no meaningful security to speak of.
If I handed a unlocked "Linux phone" to somebody and said "take a photograph of me"... The chances of that actually working is slim to none.
Meanwhile we have Android OS that is proven to work. It is open source. It is used by, literally, billions of people. The security model is as good as it gets. It has better application support then Windows.
Taking something that works and then making it more secure and more open and more privacy focused is infinitely more productive and meaningful then trying over from scratch because you want a phone based around Nix packages or whatever.
Even if Google decided to close source Android from now on and be actively hostile to any open source kernel modules... Forking the Android that exists today and trying to make it work is exponentially more likely to yield positive results then, say, starting on a Debian-based "Linux phone OS".
And Android can still use nix-pkgs if you really wanted to.
It is my understanding that XACE doesn't actually provide any security features itself. It just provides the "hooks" to implement security extensions. Like LSM feature in Linux kernel. You have to install a additional X11 extension to do something useful with it.
So the most common X11 security extension is going to be xcsecurity which enables the SECURITY extension. It allows a course permission model were applications can be designated as "Trusted" or "Untrusted". That is going to show up in many Linux distributions.
However all applications default to "trusted" because if they are untrusted they tend to cause lots of other annoying problems and crashes a lot of apps, apparently.
In practice the only place it shows up is if you are using "ssh -X". That uses the security extension by default. Which is why there is also a "ssh -Y" that disables it for applications that it breaks.
This sort of thing is why to fix X11 security you have to give up backwards compatibility and create a new X version.
Oh, wait, that is what the X developers did with Wayland.
This is rather incomplete. For instance, gtk devs already threw out tons of old code in GTK4. Wayland also has fewer features than xorg; and there are also fewer choices available. I noticed this with regards to WMs/DEs. I am not even going to issues wayland has with regards to certain video graphics - that's another not mentioned issue here.
You are trying to pick individual cherries.
> This sort of thing is why to fix X11 security you have to give up backwards compatibility and create a new X version.
Let's have a look in a little while. I myself hope for better and more transparent information at all times. Probably others want better security overall. Would it not be somewhat interesting if wayland were to be abandoned eventually due to having too few useful features compared to xserver?
> Wayland also has fewer features than xorg; and there are also fewer choices available
Because Wayland is a strictly a window management protocol focused on policy over mechanism.
> I am not even going to issues wayland has with regards to certain video graphics - that's another not mentioned issue here.
We also aren't going to mention issues Xorg or XLibre have with some graphics setups, because that's neither here nor there. This is a thread about security.
> I don't think so: <XLibre github repo link>
Didn't XLibre break some applications when launched?
> Would it not be somewhat interesting if wayland were to be abandoned eventually due to having too few useful features compared to xserver?
It would be interesting to see Wayland abandoned for a better protocol/set of protocols, xserver is neither a protocol nor really better.
Wayland is a new protocol, without an established implementation; X11 is an older protocol, while Xorg was an established implementation and XLibre is trying to modernize its codebase. Recall https://xkcd.com/1172/ .
> In practice the only place it shows up is if you are using "ssh -X". That uses the security extension by default. Which is why there is also a "ssh -Y" that disables it for applications that it breaks.
Unless your distro changes the default to make "ssh -X" and "ssh -Y" behave the same which popular distributions do.
for example standardized window management, left as an exercise to the GUI lib and the compositor? and woop woop X11 GUI apps need to be rewritten to support window management on WSL (Wayland based) and the network reconnect on hybernate also broke.
Lobbyists turning into government regulator is a lot more common then people realize. It is normal regardless of what party occupies the Whitehouse.
This is one of those things were most people don't realize this goes on because it is rarely reported on. Also who is involved in running administrative agencies is largely irrelevant and very boring subject. It isn't like you get to vote for any of them.
Loabyist-as-head-regulator situation is a reflection of how the administrative state actually works and the role that large public corporations play in that administration.
The 'ELI5' explanation is...
Modern politicians are career politicians. Meaning most of them they start off by getting their law degrees and then immediately pursue a political career using whatever connections they have. This means that they have no real experience of the world outside of law and internal bureaucracy of their parties and governments.
This means they are extremely unqualified at regulating any sort of industry. They just don't know anything about 'the real world'. They know nothing about how to make cars, smelt steel, drill for oil or designing light switches.
It is a similar situation for career administrators in the 400+ administrative agencies in the Federal Government. They get degrees in public administrator or in fields related to their regulatory function. Many of the top administrators will have masters and PHDs. But as anybody with experience in the "private sector" there is a very significant gap between what you can learn in a University setting versus what gets applied in actual practice.
So to fill the gap they require the participation of the major corporations in these industries. They help draft legislation, they have representatives in regulatory committees, the provide the information necessary for economic analysis, and so on and so forth.
This, after 80 years of USA history of the modern administrative state, even involves having corporate representatives participate in party politics, sometimes even becoming politicians, and having positions in the agencies that regulate them.
The term for this is "regulatory capture".
There is a trade off for having highly regulated industries. The main one is that by accepting control of the government the government takes on the responsibility of making sure these corporations remain profitable.
The cost of regulatory overhead is very significant and forms a massive barrier of entry for new businesses. So the established corporations are likely the only corporations that are going to exist for some major industries. Once you lose them they are gone forever.
So the more regulation you have the more protective the government needs to be of these businesses and their profits.
The other part was that it kinda matched the money you were spending on the machine.
The guy with 128MB of ram could likely afford to spend the extra disk space on a swap partition then the guy stuck with just 32MB.
reply