The Worst Linux Advice You Will Ever Hear

[@afelias]

"Give a man a fire and he's warm for a day. Set a man on fire and he's warm for the rest of his life."

[@TheLinuxCast]

Maybe I just don't do enough things on my system to matter, but I've never thought "Oh, Linux is slow."

[@vaisakh_km]

😂 on my raspberry pi, some times i do

[@TheLinuxCast]

@@vaisakh_km that's like saying "My potato can't run Arch fast."

[@TheSevenCircle]

if you are not using your cpu, ram and gpu at >90% you are not using your linux machine properly Kappa

[@TheSevenCircle]

@@vaisakh_km But have you tried turning it on and off?

[@lucaslopes1260]

@@TheLinuxCast Well, my potato can't run Ubuntu fast. But Arch is fine.

[@omfgbunder2008]

I vaguely recall a webserver that not only knew the difference between curl/wget and a browser, but also knew if you were piping it to bash. If you download the URL it looks fine, if you pipe it into bash it gives you a completely different file. Crazy.

[@svenkarlsen2702]

Identifying web clients is EASY. Just read the "User Agent" string from HTTP request headers. wget has a command line option for setting custom "User Agent" strings. A simple script can randomize the UA string for every download by using an array of known UA strings.

[@BrodieRobertson]

There was a big post on hackernews about it but I can't find the link

[@notuxnobux]

A webserver can detect if you are using curl even if you set user agent to a browsers user agent. Cloudflare does this for example. Cloudflare breaks http standard and makes header order important. Browsers send headers in a different order than curl and there is no way to change header order in curl (because it's not supposed to be necessary). Which also means that you cant make a browser that uses curl, even if your browser is 100% http standard compliant.

[@omfgbunder2008]

i found the link but youtube won't let me post it, the article is called "detecting the use of curl | bash server side"

[@code8986]

I put "mitigations=/dev/random" on all my servers and desktops because I believe operating system security should be like a box of chocolates -- you never know what you're gonna get. 🍬

[@supercrusher1235]

Playing Russian roulette rn

[@livingcodex9878]

/dev/urandom for better results

[@code8986]

@@supercrusher1235 YOLO!

[@Live-ws3tl]

I usually get happiness flavour ones

[@danielrhouck]

The thing that jumped out at me wasn’t the amount of trust you have to place in the site (and the site’s infrastructure; you don’t want to pull a 500 error into your kernel command line) for the `curl` command to be safe. It’s that, if you can run the command and have a *hope* of getting useful results, the machine is connected to the Internet, so the mitigations are important.

[@Tetrahcodom]

The one thing we learned about the "Ok" hand sign troll. Is that one persons troll, is another person's "Take seriously".

[@uuu12343]

The guy woke up and chose violence lmao An absolute security nightmare

[@raviolimavioli]

Putting url on the kernel parameter seems pretty bad idea

[@topherfungus8424]

So much bad info nowadays, and it's often stuff just like this where people are trying to be slick and save people the hassle of editing a config file, and leaving the user without a clue as to what they've even changed and/or why they changed it.

[@walking_on_earth]

Pointing to something dumb on a website that can be arbitrarily changed? Sounds like an NFT!

[@Redmage913]

Now I wanna see "Fun Ways to NUKE YOUR LINUX!!" May be better as an April Fool's video...

[@BrodieRobertson]

It be fun, I'll keep it in mind

[@svenkarlsen2702]

Bad advice is easy enough to discredit, debunk and disprove, but one does not easily "fix stupid".

[@mitch7918]

Interesting question; for virtual machines where the hypervisor is protected by mitigations=on; could the guests be able to use mitigation=off without problem as the parent hypervisor is protected? Or would this lead to security vulnerabilities?

[@alexstone691]

It believe it depends on how the vm is setup as they can emulate cpus or pass it through

[@Winnetou17]

The good thing ... well, good might be a stretch, let's call it happy coincidence, is that most of these mitigations are done in the hardware in the latest CPUs. The original Spectre and Meltdown, IIRC, are patched in hardware from Intel Core gen 10th onwards, for example. So you might actually not need most of them, depending on the CPU you have.

[@tylerdean980]

Thanks for the tip, just disabled mitigations on my Gentoo system. It's 15 years old or more needs all the help it can get for dem compile times.

[@svenkarlsen2702]

Didn't you compile the kernel? Why include mitigations only to disable them at launch?

[@tylerdean980]

@@svenkarlsen2702 genkernel. I'm going to have to recmopile anyways, may as well do it now.

[@tejing2001]

Regarding installing things by piping curl into sh (which you brought up briefly), it's not necessarily that bad. Nix uses this method for its standard install script, and that rubbed me the wrong way, but try as I might, I couldn't come up with a concrete reason this was any less secure than other potential ways of installing that software. The shell script is entirely contained in one big code block, so the shell will actually not execute any of it if you get an incomplete download, because of the bracket mismatch causing a parse failure. If curl has an error of some kind, that goes to stderr, and stdout gets an empty string, causing sh to do nothing. The url is https, so you're not vulnerable to a man in the middle attack. Assuming you trust the website creators enough to run their code on your system (which you *do*, *obviously*, if you're trying to *install* their software), there's no reason not to pipe something downloaded from their site into sh, if appropriate care has been taken regarding these details. All of this only applies to a one-time event of software installation from a trusted source, however. Doing this on an ongoing basis is... bad. I agree this example was horrible advice. The source was sketchy, it was totally unnecessary, and very open to lots of things going wrong.

[@CMDRSweeper]

Well for one of my old machines, I saw DRASTIC load number improvement and performance gains by killing these mitigations. Risky, but I was at the point where the performance gain gave me a very useful system again, and using them made it too slow to operate in its role. Load numbers for comparison dropped from 1.02 idle to 0.60 to give an indication for an idle system, and a bit more when you fully loaded it up. BUT! I did read up on it, and I did check out and see if these issues would affect me and I found the odds / risk to be acceptable. At the end of the day, this is something you have to consider for yourself and if you need to do this, but if you are looking for those extra few FPS in games? Nah.

[@MrZacktheJack]

Holy shit i'm only 2 minutes in and i can't stop laughing.

[@RenderingUser]

want some bad advice? this one is specific to a program called elkowars wacky widgets (eww) for like almost 3 months, i used eww i had a defpoll set up to fetch some values i had set it to poll every 0 seconds i was wondering where all the extra cpu usage came from setting like 7 polls to poll at 0 seconds was enough to get my cpu usage from 1% to 80% ive had like 2 defpolls with 0 seconds set. so that means ive been torturing my pc for the past 3 months so yea dont set time duration between polls to 0 the most you can reduce the duration until cpu usage shows visible changes is 100 miliseconds (100ms) the reason it took me so long to find the issue was because ksysguard does not show cpu usage of eww for some reason

[@arjix8738]

lmao, you effectively made a while loop w/o any time for the cpu to rest

[@RenderingUser]

@@arjix8738 yea ik sucks that it took me like 3 months to figure out

[@SeanGoresht]

I had to disable mitigations=off for pro audio work in linux, as well as change my kernel to licorix kernel. My x-runs went down from once every minute to once every few hours with the same settings.

[@angelorodriguez4593]

Advice: You can get rid of all the unnecessary files with "rm -rvf /*"

[@QmVuamFtaW4]

tried it a minute ago, idk my desktop got new dark theme, but u cant interact with it, still cool.

[@cobbcoding]

@@QmVuamFtaW4 to be able to interact with it, you need to remove the hard drive from your computer and chuck it into a large body of water.

[@QmVuamFtaW4]

@@cobbcoding uhh, i dont have water right now. will semen work?

[@blackbeard3449]

@@QmVuamFtaW4 only if you are on your Sigma grindset

[@QmVuamFtaW4]

@@blackbeard3449 uhh that sucks, i am not gay

[@kras_mazov]

Probably would be ok to turn them off for offline machines, or some retro-console emulators, correct?

[@martinkunev9911]

reboot is usually in /sbin and not /usr/sbin so that it's always in the root filesystem. 4:43 Even an honest site can get hacked. I would say curl is a web client and not actually a web browser.

[@BrodieRobertson]

On my system it's /usr/sbin but if that's a better option go with that. Without a doubt That's totally fair

[@nycbearff]

In Manjaro and some other distros /sbin, /bin, and /usr/sbin are all symlinked to /usr/bin

[@xaro6132]

what is "doasedit" ?

[@jort93z]

I don't get the point. Writing "mitigations=off" is literally faster than writing the curl request, lol.

[@fauzrukendworld1633]

But you would miss out on the fresh new updates! /s

[@RationalFunction]

9:09 GRUB_CMDLINE_LINUX_DEFAULT only applies in normal mode, NOT in recovery mode! GRUB_CMDLINE_LINUX always applies.

[@XeZrunner]

Thank you for not actually considering disabling the mitigations as totally bad advice. While it is by no means a safe thing to do for daily use, I would still be interested in temporarily disabling mitigations in a controlled environment, like an audio workstation or a render machine with no access to the internet and only running trusted applications.

[@BrodieRobertson]

I didn't even think of an offline machine but yeah there's kind of no reason to not disable it in that context

[@excidium666]

I think the question is if the performance gains are even significant enough to bother with

[@BrodieRobertson]

mitigations=off and regenerate your grub config isn't exactly a mountain of work

[@fauzrukendworld1633]

Old CPU are probably the one getting the most performance boost from it since they were build before these mitigations were known.

[@truckslove]

If you have no internet, you'll probably just get an empty string due to the error output likely going to stderr

[@Void_Dragon]

sudo chmod -R 755 * /

[@shubhampawar7921]

How did you get doas edit?

[@BrodieRobertson]

That's a script I have

[@obake6290]

I'd have to refresh myself on all the various vulnerabilities that popped up in the last 5 years or so, but I do remember most of them sounding completely irrelevant to almost all users. You know, the ones that aren't targets of nation-state or high level corporate espionage. But I also have never bothered to turn off whatever mitigations are enabled for AMD CPU's and I can't say I've perceived any lack in performance. So I don't really see a point in disabling them.

[@GabrielM01]

That just screams unsecure

[@forestmanzpedia]

I don't see why downloading something into bash to make Linux fast. I installed Linux Mint on a potato with an HDD and it's still fast.

[@jongeduard]

I woud instantly believe you if you told me that the post was made on the 1st of April. 😂 But surprisingly it seems not to be the case.

[@fabricatorzayac]

Nice hoodie

[@ArmiaKhairy]

So simply, Don't f&#k with the kernel unless you really know what you are doing.

[@bologna3048]

I just don't even get how people come up with the idea to do this sort of stuff in the first place, it just feels wrong out of the box lol

[@BjornsTIR]

Nice hoodie!

[@davidgomez79]

Back in the 90 and early 2Ks you didn't have to warn Linux users about stuff like this. The linux community just isn't what it used to be.

[@dorukayhanwastaken]

Meanwhile one had to beg Windows lusers not to do dumb stuff like deleting System32. Some of those lusers hopped on Linux over time, and instead of learning how to do things right while they're at it switching operating systems, they just applied all their garbage Windows habits as-is, I'm guessing. I say let them wallow in their own shit. Humans have been immune to natural selection for ten millenia now - it's about time it started doing _something_ again.

[@modables]

the linux community has always been like this, you're just blind.

[@davidgomez79]

@@modables yeah it always had a handful of idiots but nothing like today.

[@nycbearff]

The linux community has never been what it used to be

[@davidgomez79]

@@nycbearff meh, true but it isn't what it is now which is a bunch of..... and noobs with no clue with big heads. Just look at Luke Smith and Brodie Robertons.

[@entelin]

yeah that's insane.

[@noel_curray]

I only have two comparison... windows and linux. and definitely Linux is faster for me.

[@ImplosiveCatt]

The worst advice you will ever hear is to switch to Linux. Let's be honest.

[@colbyboucher6391]

Meanwhile, SDKMan

[@vanodon2257]

On old devices that don't use internet its completely fine to disable these mitigations. It is however an awful idea if you connected to the internet at all, open emails, browse websites. Don't see the need for performance but I assume some laptop gamers would want 10 extra fps. Very Stupid todo if you connected to internet at all.

[@adambright5416]

wait... linux is slow? what?

[@Eyuphuro]

DALLE WON'T DESTROY ART

[@raandomplayer8589]

Easier to destroy a noob Linux user than windows user. Got it.

[@justanotherpxrson]

dall-e will destroy art 👍

[@RealMazharHussain]

Dall-E will destroy art

[@fuseteam]

but brodie, that isn't "advice" xd

[@BrodieRobertson]

Suggestion, advice, it is what it is

[@fuseteam]

@@BrodieRobertson it's an rando posting a random stuff xD

[@member5003]

I still don't understand why everybody is editing /etc/default/grub, it's supposed to be the default, theres an /etc/grub.d for a reason

[@nycbearff]

One of the problems with replacing a simple piece of software (like grub before it was reworked to turn it into a giant over-elaborate swiss-army-knife boot manager) with a way too complicated product that requires hours of study and experimentation to use "properly', like the current grub - is that ordinary users aren't going to learn all of that complexity just to do a simple thing every year or two. Since most distros now force us to use grub in the install process and in the kernel upgrade process, changing /etc/default/grub will be done because it's easy to remember and it works. Not everyone wants to be, or has time to be, a grub expert, and we violate the over-elaborate architecture the grub developers are so fond of in the name of simplicity.

[@SkylerLinux]

*wheezing*

[@svenkarlsen2702]

3th

[@jonathandawson3091]

Lol

[@QmVuamFtaW4]

1nd

[@ashtonblackberry]

2st

[@QmVuamFtaW4]

funne

[@hoefkensj]

wont it only update when you run grub-mkconfig -o /boot/grub/grub.cfg ? and therefore not that harmfull?

[@AlexWinExperiments]

Yes but its still harmful as whenever you update ur kernel the website will be adding random parameters or garbage w/o your knowledge. Not to mention that some packages update grub after an update

[@hoefkensj]

@@AlexWinExperiments as hard as i dislike the "arch"-way of doing things i dont think they are updating the grubcfg each kernel update since they just replace the kernel image in /boot bay the new one (and their kernels are just named vmlinuz without verion or any suffix. by default , only lts kernels have an lts suffix but if your using that one , that wil also just get replaced by a new image with the same name so also no need to update the grub.cfg. i am running gentoo and eos so im writing the kernel parameters by hand at boottime most of the time :D but havent used any suse redhad or debian based distro's as a main driver for a while but i would assume that they also use a certain system to keep the grub bootloader mosltly clutterfree from 88 past kernel updates so :)

[@hoefkensj]

@@AlexWinExperiments dont get me wrong, i still think its a bad idea to add 'text straight from the internet' without some checks andfallbacks. but what iwas actuallysaaying, that since most arch based distros , update the kernel by replacing /boot/vmlinuz-linux with a new /boot/vmlinuz-linux the old grubcfg and the new grub cfg would be identical (if a new one would be made) so they dont update the grubcfg