Re: [gentoo-user] Choosing between system profiles: hardened and desktop for desktop installation.

[Walter Dnes]

On Tue, Jul 04, 2017 at 01:37:38PM -0400, james wrote

> W. Dnes is the king of minimalist here, so when he gives advise
> realize it has decades of experimentation to get to where he is on
> minimization.

  Not exactly "decades".  I first started linux in late 1999 or early
2000.  The minimalist approach was a side-effect of me being cheap.
Even though I have a newer machine as my "hot backup" waiting in the
wings, I want to run my older machine into the ground first.  10 years
ago I was running a 450 mhz pentium3 with 256 megabytes of ram.  Today
I'm running a 2008 Dell with Core2 Duo and 3 gigs of ram today.  I have
a newer i6 with 8 gigs of ram as the hot backup.  Running an older
limited machine forces you to optimize.  The Gentoo USE flags give me
the control to do the utmost minimization.

  I run the plain default/linux profile, and ICEWM as my WM and no
"desktop environment" (as per my sig).  The less attack surface, the
better.  Do not run the Flash plugin or the Java plugin.  If you
absolutely have to do so, use it inside a VM (e.g. QEMU).  I have an
aggressive handcrafted iptables firewall.  In addition, my little LAN
sits behind a NAT-ing router, and I disable UPNP.  That covers my
approach to security.

  I run mostly stable, except where an app I want/need is only unstable.
Gentoo currently defaults to gcc-5.4.0.  I've enabled 6.3.0.  I have to
enable ICEWM 1.3.12-r1.  The regular stable version built under gcc
6.3.0 segfaults 1 or 2 seconds after starting.

  I used to run with USE="-* blah blah blah".  I no longer do that, but
I aggressively disable USE flags, until something breaks, then I back
off.  My current USE line (it's actually one long line)...

USE="X apng bindist ffmpeg jpeg opengl png szip truetype x264 x265 xorg
threads webp -acl -berkdb -caps -cracklib -crypt -filecaps -gallium
-gdbm -graphite -gstreamer -iconv -introspection -ipc -iptables -ipv6
-libav -llvm -manpager -nls -openmp -pam -pch -sendmail -tcpd -udev
-udisks -unicode -xinerama"

  Some of the above is over-ridden in package.use.

-- 
Walter Dnes <waltdnes@××××××××.org>
I don't run "desktop environments"; I run useful applications