Pantherina

@[email protected]

This profile is from a federated server and may be incomplete. View on remote instance

Pantherina , (edited )

Use MakeMKV. It is really good. It will give you files to work with, and automatically extract all good ones.

Then use Handbrake. You may also directly use handbrake, I dont know I used a total Potato (intel core duo) for the first step, no chance for encoding.

I literally just did that. DVDs have pretty uncompressed video, like an old movie is 8GB or bigger.

Have a look at the back cover of the DVD, mine had "PAL" written on it.

Recommended settings if you only want to use it with VLC or MPV, not strange media players.

  • container: use mkv. It is free, works very well and has a funny name.
  • video: AV1 (it is completely free and really good for the future. For better support use h264, but it is not as good)
    • resolution: 570p or something, PAL
    • compression rate: 25
    • FPS: 22 or something, PAL
  • audio: AAC or opus, AAC is the default
    • bitrate 128kb/s for crappy movies, 160kb/s and up for music. But using more than the original DVD has makes no sense.
    • make sure to add all tracks
  • subtitles: also make sure to add all of them

Save these settings as custom preset "PAL DVDs"

Then run it. If you have multiple files from makemkv, you can "open directory" in handbrake, and then under "queue" "add multiple ones to queue" and select all of them. Make sure to have the preset chosen, and run.

I literally encoded all my DVDs with 720p, artificially increasing the size. I am not redoing everything, my laptop is heating for 50h or so. Working well but damn that takes time.

If the videos have grain, you may want to apply a grain filter. Grain is hard to compress, as it is random noise all over the place.

Like in JPG image compression, pictures are converted to areas of the same color, like this:

image

(More examples)

If you have grain, noise, in videos, the images cannot be compressed that well and the size can be double. So if it works well, use that to decrease the video size.

Jpeg, aac, opus, AV1 are all "lossy" so they will remove information that cannot be gotten back. Unlike zip for example, or jpeg-xl (JXL) for images, or FLAC for Audio.

But encoding something that is lossy, in a lossless format, makes no sense.

You can increase the size of a lossy encoded video, by re-encoding with better presets. Without adding any real information.

So test the presets first, and if you are unhappy, run them again but on the original files.

With the correct settings I got a 6GB movie down to 600MB or less, without notable data loss.

Pantherina ,

Dont use "stable" software people.

Gimp 3 is already very nice! Use it exclusively.

Pantherina ,

I mean I already reported 2 issues, but it still works. I can use it without big problems, I use the beta Flatpak (as explained in my flatpak remotes list).

Using Wayland too, Idk about any problems but if it wouldnt work I would just disable Wayland for the Flatpak and the app automatically runs through XWayland

Pantherina ,

Burner phones are a strange concept. If you want to store sensitive data on it, you shouldnt use some cheap android phone or even a dumbphone without encryption support.

Pantherina ,

All Android phones have Google malware installed by default, as system apps, which means those apps can do whatever they want.

So every piece of data you put on there is possibly tracked and collected.

Then there are 2 more problems

  • the software is proprietary and cannot be externally wiped clean
  • the software is outdated

This makes it vulnerable to Pegasus attacks and others. There are tons of secure practices to avoid getting it, like LTE-only, HTTPS only, encrypted and trustworthy DNS, sandboxed processes, blocked javascript execution from unknown websites...

But still if the phone is outdated there are unpatched and publicly known security issues. Just spamming them at all phones is likely to succeed as so many people run vulnerable versions, as vendors suck.

Then if you have pegasus, the only way for security is to reflash the A/B partitions, both. Factory reset is not secure as it will keep what is already in the system partitions.

The firmware is protected and signed by the vendors, so it is likely clean.

But Pegasus installs itself to the phone storage.

If you A cant obtain factory images or B cant flash the phone at all, you cannot wipe it clean.

So a good activism phone needs

  • trustworthy and minimal system apps / stock software
  • modern software updates
  • possible to reflash whole device externally
  • nice to have: ability to verify checksum of system partition, like GrapheneOS Attestation

This makes them poorly pretty expensive. I think a slightly outdated GrapheneOS phone is okay though.

Pantherina ,

I think 3a is already too old. I think 4a is a better minimum, but this is still insecure of course.

Pantherina ,

Yes I know, and I want to try DivestOS one time. But they do incomplete patches.

They cannot update the kernel themselves or even worse the firmware. The kernel needs to be built and patched for the specific hardware, GrapheneOS relies completely on Google here. And the firmware needs to be signed by the vendors, so no chance either.

And especially baseband, cellular stuff has extremely many vulnerabilities in the code.

Pantherina ,

Not sure if VPN eliminates all risks with 2G and 3G, maybe it does.

Sandboxing, javascript

Vanadium has sandboxing but its javascript blocking is useless (no granular control)

Mull has no process isolation at all, but support for UBO and Noscript. Bad situation

it's a walk in the park for it to modify any of the partitions

These cannot be written without TPM verification or stuff, ask GrapheneOS devs about that, I dont know. The firmware signing is required, the verification will not be done inside the OS, that would be totally flawed.

If they have the firmware signing keys, they can fuck you. If they dont, they can only write to the system partition, and Attestation can see that.

Reading data has nothing to do with that. They likely can, but that doesnt matter.

My 6 years old phone still receives LOS updates

This will not include firmware and likely even the kernel.

Pantherina ,

Yes that is one definition.

But what if you get it back? Or if you just keep it?

There is a chance that you have Pegasus on there, and I wouldnt want a phone without the detection of this.

GrapheneOS can likely detect pegasus with their Attestation and if you have it, use an external device to reflash it.

Pantherina ,

Not sure but GrapheneOS has an "LTE only" mode, stock Android only has preferred Network afaik.

visiting only known websites is not a scaleable option, a browser needs to be secure. Kiwix is the browser that basically runs desktop Chromium on Android, so it has Addon support. But that is also soon manifest v3 restricted, and likely pretty insecure.

of course the user data partition is not checked, but every other important one. I have not tested what would happen when it is modified though.

I dont know what magisk did, but I think that is only about Google Play adding their "safety" scanning to the OS. Nothing regarding boot. But yes, likely there could, can or should be OS components scanning things too.

Googles stuff is pretty insecure, for example the latest SafetyNetFix simply disabled hardware cryptography, as they still support insecure phones.

For sure this is very complex and there are always vulnerabilities found in Android and GrapheneOS.

Pantherina ,

The Best Secure Email Providers in 2024 ( blog.thenewoil.org )

Like it or not, email is a critical part of our digital lives. It’s how we sign up for accounts, get notifications, and communicate with a wide range of entities online. Critics of email rightfully point out that email suffers from a significant number of flaws that make it less than ideal, but that doesn’t change the...

Pantherina ,

Mailbox.org missing, pass

Pantherina ,

What, source?

How would you block an OS?

And btw there are some reasons why GrapheneOS may be criticised

Pantherina ,

Thanks! TLDR spamhaus (a big spamlist provider) has them on their spamlist, or maybe not, and they are using some fancy CDN.

It is VERY likely just a technical error.

kbal , to Linux
@kbal@fedia.io avatar

Update available! This version is very old.

Xscreensaver has apparently been checking for updates and is disappointed that it hasn't had one for 14 months because Debian is too stable. Can anyone recommend a linux screensaver which would work with xfce and can be trusted to never do that?

Pantherina ,

Nice for the paranoid people, but this means false errors when there simply are no updates.

Pantherina ,

I dont get why people would care for influencers

Pantherina ,

Do gorillas kill babies of other animals, monkeys or humans?

I just dont really believe that Harambe would have done anything to that baby.

Pantherina ,

There is no existence or Harambe anymore 🥲

Pantherina ,

For sure...

Pantherina ,
  1. Good that only you do this, as a whole company setup is complex
  2. Pop_OS is currently not that well maintained afaik, their GNOME desktop is quite outdated.

Just using their OS for the hybrid graphics support is a valid point, but should not be the only one.

Having a well managed OS is crucial, but I disagree that Ubuntu base is the best here.

For stability, a centrally managed Fedora Atomic would be better I think. Way more stable, image-based, all peolple would have exactly what they need.

You could build images locally and take care of the exact updates like that. Or you just share specific configs for each role, like preinstalling different software.

But having things like specific policies, any files, hardening etc. is totally possible during image creation.

Pantherina ,

What do you mean?

To my knowledge they dont ship GNOME 46 but some old "LTS" variant (GNOME doesnt do LTS variants)

Pantherina , (edited )

Software that doesnt store private metadata

  • grapheneOS cam
  • opencamera (not by default!)
  • KDE spectacle
  • android GrapheneOS screenshots
Pantherina ,

For sure, edited it. GrapheneOS screenshots have no metadata afaik

Pantherina ,

VPNs are not meant for privacy. The concept is clunky, as is the concept of our internet.

Tor or I2P are made for privacy, but the interactions with the clearnet have the same problems, you need a legal entity hosting the server, IPs are known and can be blocked etc.

Hosting your own VPN does not anonymize you anymore but is very unlikely to get blocked.

Pantherina ,

They only support Ubuntu as downstream Distro, while they preinstall it on their number 1 supported platform, SteamOS. They control the complete software stack and even hardware.

They dont support Arch on whatever hardware, they support SteamOS on the Steamdeck.

Pantherina ,

Like.... the Intel ME?? And no BIOS seems to allow the switch to disable it, even though that was literally required after the NSA sued Intel?

Pantherina ,

Very nice tool for usage and development!

Pantherina ,

For some reason it is not yet on Flathub

Pantherina ,

I am not using Mint and it is also in the Fedora repos, but there is no reason for it to not be on Flathub. Maybe when I find the time I try to package it.

Pantherina ,

Any system app on Android, the captive portal login and more CAN all bypass a VPN in "block all other connections" mode.

Android is really problematic and having as little system apps as possible is the only fix.

Are there any CPUs that work well with Linux that aren't made by Intel or another company on the BDS list/that supports Israel?

I have a Ryzen 3 1300X at the moment and it's always had this soft lock freezing bug on Linux. I used to dual-boot Windows on this machine and Windows never had the same problem, so I think it is an issue with the Linux kernel (I've also replaced nearly every bit of hardware that I originally built the PC with, except for the...

Pantherina ,

I think if you start with political positions of bigtech companies...

Just buy used

Pantherina ,

Yeah, so no Pixel 8a? What the hell will I buy when the last half-tolerable Pixel (6a) gets no updates anymore?

Pantherina ,

No youre not. Calyx is a joke, sorry. DivestOS may be okay but its still very different from GrapheneOS.

And no tiny custom Android can fix the issue that hardware manifacturers will not supply a single byte of firmware updates after their contract is done.

Pantherina ,

(Feddit just started working again)

CalyxOS implements many random 3rd party stuff as if that was their own.

Apart from 2 (QKSMS and Bromite) being unmaintained, installing random apps as system apps (if this is what they do) means a system update may cause data loss for users, when removing those apps. And it has the problem of a way too high goal that can not be reached. They simply dont maintain those apps, so dont ship them.

Pantherina ,

They had this on their homepage, advertizing QKSMS and Bromite as if they were project apps. Which they are not.

So either A: they preinstall apps as system apps or B: they have some form of installer that installs them as normal user apps.

You should have as many apps as user apps as possible.

Maybe they changes this idk. But QKSMS is not a simple SMS app like the one that GrapheneOS implements (the old and hardly maintained AOSP one) and Bromite is an unmaintained Browser which is a huge problem. Cromite and Quik are maintained forks.

Some Archive when they still had Bromite on their page

Could not find QKSMS but that was somewhere

Pantherina ,

Interesting. What are the App IDs of those both apps?

If they base on Chromite that is probably fine.

Pantherina ,

I am pretty happy with GrapheneOS. Things like separate toggles for internet, or long powerbutton press foe torch are missing.

But you cannot imagine how much effort it is to maintain such a project, and their base is stable, the updates are damn fast.

First stability and security, then features.

Their core OS is minimal on purpose. I use the phone, vanadium (hardened chromium, with JIT toggle, now with adblock, completely degoogled), their attestation app, etc.

Most of the other stuff are random FOSS projects, I dont even use sandboxed play, but if I wanted to I could create a separate user profile and install it just in there.

DivestOS is doing sandboxed microG which is way more secure than unsandboxed, but still tons of effort and will break a lot.

Pantherina ,

Btw get Mull from the DivestOS repo, the F-Droid version has veeery slow updates and less.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • kbinchat
  • All magazines