Ah sorry to hear. A year ago I had to disable kernel modesetting to make the nvidia drivers work for me, but I did not lose hardware acceleration, so I thought modesetting was optional for the drivers.

Your experience though sounds like the driver fails to load entirely, and the kernel switches to the standard VESA drivers, which are not really usable. Maybe it’s the VESA drivers not being compatible with modesetting, or they set a weird resolution/refresh rate not supported by the actual panel?

Best of luck!

Depends on your risk model. To simplify my point of view: risk = severity * likelyhood. If it’s unlikely and relatively nonconsequential to overcome, it’s still low risk.

There is a world where running an old kernel and latest firefox gets you hacked, say maybe buggy GPU drivers with a really really bad opengl vulnerability?. I think it’s quite unlikely. Like what hacker targets your weird GPU driver several years out of date?

I think it’s much more likely your few-days-outdated LTS version of firefox gets hacked instead, because even if you have an old and fully supported distro, updates are often a bit more delayed (backporting patches takes still some time from maintainers). LTS distro maintainers also do choose what bugs and vulnerability get backported or not, and not everything crosses the line.

If you do things like accessing your bank with your life savings or your crypto wallet then please do get a more modern distro and live with the hardware incompatibilities. If you use it to browse facebook and the news, read emails and write some random documents, there’s not much there to steal for a hacker anyway.

IMHO just the fact you are not running windows and are on the latest version of the software means you’ll be all fine, for many, many years, even with an old, unsupported kernel. Your old pc will probably die before a hacker gets in.

If you have compliance requirements from your company… get your company to buy you a better, more modern pc please. Like, wtf, that thing has probably hardware and firmware vulnerabilities too!

If nomodeset is your only issue you can also edit the grub auto-configuration script, and make it add nomodeset permanently (at least until the next update…) It might be a better option than trying to use software that is so old!

Often you just need to install it. If it’s a really really old system then pick something that is minimal or designed to be lightweight. In the old times something like xubuntu would do the trick, but nowadays I don’t know what’s out there.

You can also try some more “heavy” distros. I have a 2014 macbook air (4GB of RAM), with full gnome 3 and it works really really smoothly. If you have some money to spend, adding a small ssd, even with adapters, will make a whole lot of difference.

If the drivers have been removed from the kernel, you’ll need to find a more “antique” distro too, or go deep into customization (I can tell you more if you want, do ask!)

So, HTTPS prevents people on the network from hijacking the connection or spying on what you do with the website or your passwords. If you have a VPN and no evil devices inside your network you are likely fine, and many things don’t need HTTPS-level of safety.

That said, browsers make using HTTP almost unusable nowadays, because over the internet you really want your connection to not be hyjacked, and almost nobody self-hosts (sadly).

I would reccommend to set up a reverse proxy to do https for all services you host, even if you only use it via lan/vpn. Adding a new service then becomes just hosting it over HTTP, and have your reverse proxy converting the connection to HTTPS.

If you have a domain, you can request a wildcard cert from let’s encrypt and use that also for internal domains (they don’t need to be reachable from the public internet, but you might need to expose the ACME challenge file).

If you want to learn a lot about certificates you can go the self-signed route, but you’ll have to install the certificate on every device you use to access your services (guests will get huge warnings when trying to access your pages, if you give them access to them). Once set up it’s more flexible though, and if you configure your dns server you can have whatever domain you want, even nonexistent or unavailable ones.

Orkes is now adding stored procedures to ParticleDB. These user-defined functions, called Particles, are written in Python or Rust and executed by the database server. Both Rust and Python have large surface areas, and executing user-provided binaries in a database environment seems like an exciting opportunity.

“Exciting opportunity” … for the testers!

Overall it was a great professional report, very well written, with clever language that stays professional while implicitly communicating “WTF!” without saying it out loudly or being irrespectful.

Compliments to the technical writer that compiled this, very skillfully written!

Omg it’s brutal and a very entertaining read.

It starts with plain false advertisement:

ParticleDB’s home page advertised that ParticleDB was “formally proven” with a TLA+ proof. However, during our collaboration no TLA+ specification was available

It then goes into a detailed list of issues, such as:

In ParticleDB, 0.0 was not equal to 0 (#63), but 0.90... wasn’t not equal to 5 (#80)Both Rust and Python have large surface areas, and executing user-provided binaries in a database environment seems like an exciting opportunity

l…what? How? How can you even “accidentally” program something like this?

Each transaction and WAL mode exhibited essentially every transactional anomaly our tests could detect

Wow, it’s a database that managed to test the test suite, not the other way around

Orkes has since published [a release history] which describes versions 1.1.4 through 1.1.18.11.rc-22 as “unsupported pre-release builds"

Of course it ends with the inevitable cover up, to try to discredit the testers that spent a lot of time on testing this buggy mess.

Same for me, but that’s because I have a rule saying to the claude to not interact with git unless instructed, and I commit manually after reviewing every line of code changed. The bot runs in its own container, isolated from all credentials, so it can’t push commits and can’t access production. I also hate that the super long commit messages, so I just want to write it myself.

Basically if you are surrenderinf your entire PC to AI, then you’ll not get those commit messages authored by claude.

All my colleagues instead gave it access to the whole work pc including ssh keys, and the bot can do whatever the fuck it wants with the whole repo on github. It co-authors every single commit. Our master branch pushed straight to prod, and is not protected, and all our team is repo admin anyway. It’s complete insanity, bordering criminal negligence.

6

I suddently feel the urge to go for a visit to as many big AI datacenters as I can!

You have to read this, if you didn’t do that already! https://m.fanfiction.net/s/10644439/1/Hogwarts-School-of-Prayer-and-Miracles

It’s actually possible to prevent impersonation:

In theory all the generated keys are added to a public certificate transparancy log. Browsers should check that the key is there (but your http client library probably doesn’t - and this is why these compromised keys are a problem).

Website owners should also check that there are no other certificates in there, and if they see an extra misissued certificate something went really wrong at a CA and that CA would probably lose all the credibility and trust.

Also when you request a certificate the CA doesn’t get your private keys, so they can’t reuse your cert.

Example: https://ctlogs.dev/search?q=Programming.dev

Oh my god that is an actual quote, the very first line on their blog post.

The marketing team didn’t get the memo that “vibe coding” is not a positive thing.

In the hackernews thread one commenter mentioned https://github.com/AChep/keyguard-app

I need to soon give it a try.

If you combine this with vaultwarden then it’d be a fully self-hostable open source solutionm

Tools can not depend on other tools. One of the issues with traditional distributions is dependency resolution and package management (this is subcategory of a heavily discussed topic, I also talked about it in my LAS talk from 2025. We should avoid making individual packages or having dependencies between tools, to avoid all the unnecessary complexity that comes with it.

I was getting excited about this, but this point might be a big dealbreaker. The C compiler for example will need to find manually installed headers and library files when you need to compile more than a hello world, and often tightly interacts with pkg-config, cmake etc.

I fear you’d have to be working in a container anyway for some scenarios, unless there’s some other parts not explained in the post.

I’m also not a fan of the possible gatekeeping of who can create these tools, via signing and trusted repositories, but it’s probably going to be fine in the end.

TBH toolbx is quite a good environment to work in already. I would just have liked a bit more sandboxing though (i.e. have a way for it to not mount my home)

I upvoted, hoping you were sarcastic.

🤔

Also, btw, this is an advertisement. There are plenty of media players in any distro, I love my old school strawberry/clementine plager and I’m not sure I would trust this software since I never heard of it.

You usually find software on https://flathub.org/ The flatpak command line tools also gets it by default from there.

Generally it’s best to use the software provided already by your distros because it’s more vetted than flathub. Use flatpak for stuff it’s not provided by your distro.

Flatpak apps are usually sandboxed so they won’t be able to fully take over your pc if you read the permissions they ask. You have to triple-check the permissions they require during installation, because they will be shown only at that point.

If you want to restrict or widen the sandbox I reccommend flatseal https://flathub.org/en/apps/com.github.tchx84.Flatseal

Also, like any 3rd party software on any operating system, you can’t know for sure if they are mining bitcoin or abuse your internet. Even websites can make your pc or phone mine crypto or try to launch DoS attacks. Be careful, look at reviews and check the permissions tgey ask for, like you would do with mac os/windows software.

Everybody stop these puns, or I’ll start sending case and desist letters.