Well, they have – I think. When you download an edited image, it supposedly downloads an image with edits applied. The original is optionally available too.

If you download the edited image, this is effectively equivalent to the status quo of image editing.

The issue is not the instruction set of the processors. That’s actually quite well standardised with ARM (albeit unfree) and there is plenty of generic support for it because of that.

The issue is all the “peripheral” devices such as WiFi, WWAN, display etc. that are wired up in extremely bespoke device-specific ways. They are usually implemented in vendor kernels with millions of lines of divergence to mainline at best and/or proprietary blobs at worst.

Changing the ISA from one well-supported closed standard to a less well-supported open one will not change that issue one bit.

SearXNG is not a search engine, it’s a search engine proxy. The actual search engines that are being proxied are still the same old google, bing etc.

Yikes, lot’s of bad advice in this thread.

My advice: Go develop an actual threat model and find and implement mitigations to the threats you’ve identified.

If you can’t do that, that’s totally okay; it’s a skill that takes a lot of time and effort to learn and is well-compensated in the industry.

You will need to pay for it. Either through an individual assessment by someone who knows what they’re doing, managed hosting services where the hoster is contractually liable and has implemented such measures, by risking becoming part of a botnet or by not hosting in a world-public manner.

My recommendations:

• Pay for proper managed hosting for every part of your system that you are not capable of securing yourself. This is a general rule that even experienced people follow by i.e. renting a VPS rather than exposing their own physical HW. There are multiple grades to this such as SaaS, PaaS and IaaS.
• Research, evalue and implement low-hanging fruit measures that massively reduce the attack surface. One such measure would be to not host in a manner that is accessible to the entire world and instead pay for managed authenticated access that is limited to select people (i.e. VPN such as Tailscale)
• git gud

Kagi is a search engine where you just simply pay with money rather than being instrumentalised in all kinds of awful ways in order to make the operator money.

I was very sceptical at first too. I highly recommend to simply try using it with the gratis 100 searches. That lasted me for a few days and I quickly noticed what there is to love about it.

It’s the best (and to my knowledge only) search engine money can buy.

The first two points have nothing to do with HTTP‽

The last one is just August before Eternal September ¯\_(ツ)_/¯

That’s for encrypting your data to protect against an untrusted storage back-end.

They also have e2ee for users though where the server cannot see the plaintext either.

https://nextcloud.com/encryption/

Tab groups are one of the best features to come to modern browsers the past few decades. Especially the ability to save and close them greatly aided me as a rehabilitating tab hoarder.

Haven’t tried vertical tabs yet but it’s great to see them implemented in Firefox properly now.

Great to see that PWAs finally coming back, even if it’s only on Windows now. Didn’t catch that they are working on that again!

I find the link previews to be distracting but they’re easy enough to turn off.

Great to finally be able to undload tabs manually. That would have been extremely useful back in my tab hoarding days. Tab unloading is generally quite a neat feature.

The LLM shit can go away for all I care but it’s not really that invasive IME. It’s one entry in the right click menu that’s easy enough to turn off right from said menu for me.

PDF editor upgrades are very welcome.

Right click to search for an image sounds like such an obviously good UX feature; great to see they’re thinking about such things again. Sad to see it’s Google-only for now but that makes sense given how small and non-standardised the market for reverse image search is.
@kagihq@mastodon.social could you perhaps get in contact with Mozilla so they can implement your endpoint for this too?

I get the sentiment but it does not seem appropriate in this case‽

2/14 features in the article are related to slop. The other 12 are actual, genuine improvements; some of them quite significant if you ask me.

Blame where blame is due but please don’t forget to praise where praise is due too.

Thanks for the explanation!

Though it ought to be possible to only respond with the new self-signed cert when LE does the challenge and with the previous, properly signed cert otherwise.

I found https://codeberg.org/neilpang/acme.sh/wiki/TLS-ALPN-without-downtime which demonstrates one method to achieve that but I lack practical experience judge whether that’s optimal.

Forgive my ignorance but why would that incur a downtime?

The only way I can think of for downtime to happen if you switched certs before the new one was signed (in which case …don’t) or am I missing something?

It also strikes me as weird that LE requires 80 but does allow insecure 443 after a redirect. Why not just do/allow insecure 443 in the first place?

https://blog.kagi.com/small-web is the closest I’ve seen but it is indeed quite small and often not useful.

Kagi is generally a tool that can be made to clean your search results of poorly incentivised content. It already categorises “top 10” click farms as such OOTB and lets you disable them entirely.

The ability to block websites from appearing in your results is the most useful though IME. If I stumble upon a poorly incentivised website, I can simply block it and it will never appear again.

It’s not all you’re asking for but it gets you the closest that I know of.

Sources claim an up to 100% mortality rate!

There’s also the option of just leaving an offline disk at someone’s and visiting them regularly to update the backup.

Having an entirely offline copy also protects you/mitigates against a few additional hazards.

If you don’t process any user data beyond what is technologically required to make the website work, you don’t need to inform the user about it.

None of this puts the user out of control; they’re free to add the Flathub repository should they wish to do so.

He

I hate to be that guy but OP gave no indication of their gender. English has the luxury of having a “natural” neutral pronoun; please just use that.

which these suggested Fedora Spins are designed to integrate with as tightly as possible

Could you explain what exactly this “tight integration” pertains? AFAIK these are just regular old global-state distros but with read-only snapshotting for said global state (RPM-ostree, “immutable”).
Read-only global system configuration state in pretty much requires usage of Flatpak and the like for user-level package application management because you aren’t supposed to modify the global system state to do so but that’s about the extent that I know such distros interact with Flatpak etc.

Bazzite is completely the opposite of an OS designed to run one app at once, which means you haven’t tried it before rubbishing it as a suggestion.

That is their one and only stated goal: Run games.

I don’t know about you but I typically only run one game at a time and have a hard time imagining how any gaming-focused distro would do it any other way besides running basic utilities in the background (i.e. comms software.).

Obviously you can use it to do non-gaming stuff too but at that point it’s just a regular old distro with read-only system state. You can install Flatpak, distrobox etc. on distros that have mutable system state too for that matter.

Could you point out the specific concrete things Bazzite does to improve separation between applications beyond the sandboxing tools that are available to any distribution?

It’s true that I haven’t used Bazzite; I have no use for imperative global state distributions and am capable of applying modifications useful for gaming on my own. It’s not like I haven’t done my research though.

“No your honour, we do not offer users any patented software, we merely ship a system which directs users to this other totally unrelated entity that we are fully aware ships patented software.” will not hold up in court.

I also imagine RH would simply like control over the repository content they offer to users by default. Flathub acts more like a 3rd party user repository than a “proper” distro.

I don’t assume you to be stupid, so lack of information is the most likely explanation for not knowing what “it” refers to here.

Read the linked issue first perhaps.