Liassica's site

Software recommendations

2024-08-18T00:00:00+00:00

Software recommendations

Posted: 2024-08-10

Updated: 2024-08-18

Overview

This post lists software I recommend for various use cases. Idea blatantly stolen from geck.

Operating systems
OS family	OS	Explanation
Linux	NixOS	Currently my main operating system. Its main features are declarative system configuration and generational deployment. This not only makes it extremely robust, but it also makes it very easy to copy configurations between devices or restore them after a reinstallation. You can find my NixOS configuration on my Codeberg.
	Secureblue	Hardened Fedora Atomic images. One of the best choices for a (relatively) secure Linux desktop and built upon a robust Fedora Atomic base.
	Arch Linux	Flexible DIY distro. While I generally prefer NixOS, I’ve enough experience with Arch to recommend it to those who don’t want to learn NixOS’s ins and outs.
	GrapheneOS	Hardened Android derivative. The best option for mobile devices.
Windows	Windows 11 IoT LTSC	The only somewhat usable version of Windows. I avoid using Windows when I can because I don’t particularly like it. Good luck trying to get your hands on a copy, though; the education edition is probably good enough if you can’t.

Web browsers
OS	Browser	Explanation
Fedora	Hardened Chromium	The name is self-explanatory. Uses a set of custom patches as well as patches from GrapheneOS’s Vanadium to reduce the attack surface and increase the security of the standard Fedora Chromium package.
Other desktop Linux	Chromium Flatpak	Most other distros do not compile Chromium correctly by introducing lots of downstream patches that weaken security, compiling debug builds instead of production builds, or dynamically linking Chromium to unhardened system libraries and thereby severely weakening control flow integrity (CFI). The Chromium Flatpak mitigates some of this by replacing Chromium’s built-in sandboxing with Flatpak’s sandboxing.
GrapheneOS	Vanadium	Hardened Chromium-based browser for GrapheneOS.
Other Android	Cromite	Chromium-based Android browser with some privacy enhancements.
Windows	Microsoft Edge	Edge’s strict enhanced security mode disables just-in-time (JIT) compilation for all sites, massively reducing the attack vector of V8, Chromium’s JavaScript engine. However, the addition of the DrumBrake WebAssembly (WASM) interpreter allows you to still use WASM with enhanced security enabled. This mode also enables use of advanced Windows security features such as Control Flow Guard and Arbitrary Code Guard. Finally, by using Edge, you avoid trusting an extra party by installing a different browser, as you’re already trusting Microsoft by using Windows.
Windows	Mozilla Firefox	If you really don’t like the idea of using Edge, the most secure version of Firefox is the Windows one. Make sure to check out my Arkenfox guide to get the most out of Firefox!

Generally avoid Firefox Mobile and its derivatives as it is missing important security features such as site isolation.

With the exception of Edge on Windows, generally avoid proprietary Chromium-based desktop browsers such as Opera or Vivaldi as they generally provide nothing security-wise over Chromium/Edge while adding attack surface, extra parties you’re required to trust, and tracking.

Browser extensions
Extension	Explanation
uBlock Origin Lite	Efficient general-purpose content blocker. Stick to its default filter lists to avoid standing out and prevent the possibility of a malicious filter rule being added; prefer Lite on Chromium-based browsers so that you can completely avoid Manifest V2, improving security.
uBlock Origin

First rule of browser extensions: less is more. Install as few extensions as possible; the more you have installed, the greater your attack surface and the more you stand out. I personally only have a single extension, Bitwarden password manager, and if Bitwarden Desktop for Linux ever gains the ability to handle passkey requests from the browser I may consider ditching even that. I use AdGuard’s public DNS servers to provide ad blocking so that I don’t need to install uBlock Origin.

Desktop applications
Category	App	Explanation
Text editor/ IDE	Neovim	Modern Vim fork with native Lua support. Fast and simple. I personally use a LazyVim-based configuration.
	Emacs	Extensible GUI and TUI text editor. Emacs can do anything. personally use a Doom Emacs-based configuration.
	VSCodium	Builds of Code OSS with Microsoft telemetry removed. The most beginner-friendly of these options.
Notes	Org mode	Major mode and plain-text file format for Emacs. Similar to Markdown in many ways but a bit more flexible.
Notes	Obsidian	Markdown-based note-taking app with a bunch of fancy features. If Obsidian was open-source it would be top 3 software.
Music player	Strawberry	Cross-platform open-source Qt-based music player. The default icons are a bit ugly but this can mostly be mitigated on Linux by turning on “system icons”. Strawberry fulfills my two requirements for a music player–Last.fm integration using the newer OAuth API (as opposed to plain-text username and password) and album-order preserving shuffle (e.g. in a playlist of mixed singles and albums, it will shuffle the playlist order but play albums in the original list order)–and is the only Linux music player I’ve found that does so.
Music player	foobar2000	Customizable freeware music player for Windows and macOS. The only other music player I know of that fulfills the two above requirements. If foobar2000 was open-source it would be top 3 software.
RSS reader	RSS Guard	Cross-platform open-source Qt-based RSS reader. Extremely featureful and looks really nice with a good Qt theme.

Mobile applications
App	Explanation
Aegis Authenticator	Open-source multi-factor authenticator. Allows exports and setting a vault password.
Aves	Open-source photo gallery.
Signal	Private and secure open-source instant messenger. Often considered the gold-standard of encrypted real-time communication.
KDE Connect	Easily connect your desktop or laptop to your mobile devices. Very useful for sharing notifications and files between devices.

Compile Linux with Clang on NixOS

2025-03-08T00:00:00+00:00

Compile Linux with Clang on NixOS

Posted: 2024-07-20

Updated: 2025-03-08

Tags: guide, linux

Overview

This short guide will teach you how to compile the Linux kernel with Clang and LLVM on NixOS. This guide is best viewed on a tablet, laptop, or desktop.

NixOS configuration

The configuration needed is minimal:

# configuration.nix
{
  lib,
  pkgs,
  ...
}:
# ...
{
  # Select our kernel packages (kernel and modules).
  boot.kernelPackages =
    with pkgs; # Cut down on repeated `pkgs.` declarations
    let
      # Choose whichever LLVM version you please. `llvmPackages` is the
      # default version, `llvmPackages_latest` is the latest (at the time of
      # writing, LLVM 17.0.6 and 18.1.8 respectively).
      llvm = llvmPackages_latest;
      # Same deal as LLVM; choose whichever kernel version you like.
      # `linux` is the latest LTS, `linux_latest` is the latest stable.
      kernel = linux_latest;
    in
    # Generate kernel modules for our custom kernel.
    linuxPackagesFor (
      # Override our chosen kernel version with our custom settings.
      (kernel.override {
        # Set our chosen version of LLVM as our standard environment.
        stdenv = overrideCC llvm.stdenv (
          # Tell our C compiler (Clang) to use LLVM bintools--normally GNU
          # binutils are used even with Clang as the compiler.
          llvm.stdenv.cc.override {
            bintools = llvm.bintools;
          }
        );

        # Tell Linux that we're compiling with Clang and LLVM.
        extraMakeFlags = [ "LLVM=1" ];

        # If you'd like to edit your kernel configuration, use
        # `structuredExtraConfig`. For example, some options available to us
        # when compiling with Clang and linking with LLD:
        structuredExtraConfig = {
          CFI_CLANG = lib.kernel.yes;
          LTO_CLANG_THIN = lib.kernel.yes;
        };
      }
    ).overrideAttrs
      # Work around another NixOS specific issue where builds with WERROR=y
      # are stopped by a benign error. See reference 1 below for details.
      # Technically, this fix is only necessary with WERROR=y but the issue
      # still causes a warning on builds where WERROR is unset.
      { env.NIX_CFLAGS_COMPILE = "-Wno-unused-command-line-argument"; }
    );
# ...
}

Compiling

All that’s left to do is rebuild the system. Run sudo nixos-rebuild boot and let it finish. Once it’s done, reboot and, assuming all went well, you should be booted into NixOS with your shiny new Clang-built Linux!

References

Comment on “kernel built in NixOS failed to boot”, GitHub, 2024-01-22. Accessed 2024-07-20.

Compile GPlates on Fedora Linux

2024-07-25T00:00:00+00:00

Compile GPlates on Fedora Linux

Posted: 2023-06-24

Updated: 2024-07-25

Tags: guide, linux, out of date

Overview

Note: this guide is out of date. GPlates has a new stable version (2.4.0) and the download link for the old source code doesn’t work anymore. GPlates is a free software program for modeling the tectonic history of a planet. It was designed with a scientific audience in mind, but it has also gained popularity among the worldbuilding community. GPlates has an Ubuntu package and both source- and binary-based Arch User Repository packages, but no package for Fedora Linux. One of the options for running GPlates on Fedora is to compile GPlates from source; this guide will show you how to do so. It was last confirmed to be working 2023-08-26.

Download and dependencies

As of Fedora 38, compiling fails on the most recent stable version of GPlates,¹ however the 2.3.1 beta 5 will compile as expected.² Download the 2.3.1 beta 5 source code and extract the downloaded archive to wherever you like.

Opening the file DEPS.Linux will show you what dependencies are required to compile GPlates on Ubuntu. Translating the packages to equivalent Fedora packages, we get the command:

sudo dnf install cmake g++ mesa-libGL-devel mesa-libGLU-devel glew-devel python3-devel python3-numpy boost-devel qt5-qtbase-devel qt5-qtxmlpatterns-devel gdal-devel CGAL-devel proj-devel qwt-qt5-devel zlib-devel libXrender-devel libICE-devel libSM-devel freetype-devel fontconfig-devel

Many of these are included by default in Fedora.

Compiling and installing

Open the folder with the GPlates source code and open a terminal there. Fedora puts Qwt in an odd spot, so you have to tell cmake where it is.³ Enter the command cmake . -DQWT_INCLUDE_DIR=/usr/include/qt5/qwt. Once that has finished, run make. Compiling GPlates takes about 2 hours.

Once GPlates is done compiling, install it by running sudo make install.

Running GPlates

GPlates does not yet support Wayland, so you must run it with the environment variable QT_QPA_PLATFORM=xcb. This can be added to an alias or desktop entry.

References

“Compilation error with boost 1.77”, GPlates Community Forum, 2021-12-20. Accessed 2023-06-24.↩︎
Comment on “Compilation error with boost 1.77”, GPlates Community Forum, 2022-11-15. Accessed 2023-06-24.↩︎
“QWT_INCLUDE_DIR is not automatically found on Fedora 27”, Orfeo Toolbox GitLab, 2021-12-20. Accessed 2023-06-24.↩︎

Deploy to Neocities through GitHub

2024-07-28T00:00:00+00:00

Deploy to Neocities through GitHub

Posted: 2023-05-06

Updated: 2024-07-28

Tags: git, guide

Overview

Neocities is a free, adless webhosting service modeled after the defunct GeoCities. However, Neocities’ web editor is quite basic and there is no version control. One way to alleviate these problems is to deploy your Neocities site through a GitHub repository.

This guide will assume you know how to use Git and GitHub. If you don’t, I recommend looking through GitHub’s “Get started with GitHub” documentation.

Setting up a GitHub repository

First, make a new GitHub repository. Name it whatever you like, such as site, or <GitHub username>.github.io for easy mirroring on GitHub pages. If you’d like to mirror to GitHub pages, read the section “Mirroring on GitHub Pages” below along with the rest of this article. Once it’s created, clone it to a local repository.

Next, download your Neocities site. You can do this from the Neocities dashboard by clicking ‘Download entire site’.

Extract the site archive into a subfolder of your repository. Name the folder public. The reason we do this is Neocities has a limited selection of allowed filetypes, and deploying straight from the root folder of your repository can break things.

After that, create a subfolder in the root of your repository called .github. In the .github folder, create another folder called workflows. Finally, download this “Deploy to Neocities” workflow file and put it in the workflows folder.

By this point, your repository should look something like this:

Next, you need to add your Neocities API key as a repository secret. Go to Neocities settings > Manage Site Settings > API. This will show your API key. On your GitHub repository, go to Settings > Secrets and variables > Actions > New repository secret. Name the secret NEOCITIES_API_KEY and paste the key you got from Neocities as the value. Be very careful with this API key, as it allows anyone or anything with access to it to change anything on your site.

Now all you need to do is push to your GitHub repository. Any time you push to the main branch, it will deploy the site to Neocities.

Mirroring on GitHub Pages

There are a few extra steps needed to be able to mirror your Neocities site on GitHub Pages. First, make sure your repository is named <GitHub username>.github.io. Then, make sure the folder containing your site is called docs and change the dist_dir: public line in the workflow file to dist_dir: docs. This is because GitHub Pages (at least with a free account) can only be deployed from either the root folder or a /docs folder.

You may also want to tell GitHub to not ignore code statistics on the /docs folder like it does by default. To do so, create a file called .gitattributes in your root directory and add the line docs/* linguist-documentation=false to it.

Finally, set up deploying to GitHub Pages from your GitHub repository by going to Settings > Pages. Set the deploying branch to main and the deploying folder to /docs. Now every time you push to your repository’s main branch, it’ll automatically build and deploy your GitHub Pages mirror.

Introduction to yt-dlp

2024-01-03T00:00:00+00:00

Introduction to yt-dlp

Posted: 2023-04-22

Updated: 2024-01-03

Tags: command-line, guide, utility

Overview

yt-dlp is a command-line tool for downloading audio and video from YouTube and other sites. This post will serve as a basic introduction to the program.

yt-dlp is a maintained fork of youtube-dl with many new features and improvements. It allows extensive control over the output of the command, from format to quality to file name.

Installing yt-dlp

yt-dlp is available from these package managers with the following package names (non-exhaustive):

APT: yt-dlp
DNF: yt-dlp
Homebrew: yt-dlp
Pacman: yt-dlp
Pip: yt-dlp
Winget: yt-dlp

If your preferred package is not listed or you wish to install yt-dlp manually, consult the installation page of the yt-dlp wiki.

Basic usage

To use yt-dlp, simply open a terminal in whichever folder you want to download to and type yt-dlp <URL>.

FFmpeg

To access most of the more advanced features of yt-dlp, you will likely need to install FFmpeg. FFmpeg is a tool for processing audio and video and adds functionality to yt-dlp. Like yt-dlp, FFmpeg is available from a variety of package managers (non-exhaustive):

APT: ffmpeg
DNF: ffmpeg-free
Homebrew: ffmpeg
Pacman: ffmpeg
Winget: Gyan.FFmpeg

For other package managers, see the Repology page for FFmpeg. Alternatively, download FFmpeg manually from their site.

Options

yt-dlp has a vast selection of command options that allow fine-grained control over the output. They can be found in the man page (man yt-dlp), help command (yt-dlp -h or yt-dlp --help), or on the yt-dlp README.

Some common yt-dlp options are:

-f or --format: specify video format. For example, yt-dlp -f mkv <URL> will output the specified video in Matroska format. Also takes arguments like bestvideo and bestaudio.
-x or --extract-audio: extract only the audio from the given video.
--audio-format: specify the audio format. Useful in conjuction with -x. For example, yt-dlp -x --audio-format opus <URL> will output the given URL as Opus audio.
-o or --output: specify the output template (file name). Supports a variety of field names (e.g. ‘title’, ‘artist’, ‘uploader’, etc.) and Python string formatting. Read the output template section of the yt-dlp README to get the most out of it.

Arkenfox installation guide

2024-08-18T00:00:00+00:00

Arkenfox installation guide

Posted: 2023-04-10

Updated: 2024-08-18

Tags: browsers, firefox, guide

Overview

Arkenfox user.js is a configuration file for desktop Firefox designed to increase the privacy and security of the browser while avoiding making the browser unusable. This guide will walk you through how to install it and later explain some use cases and alternatives. I recommend reading the Arkenfox wiki in order to decide whether to use Arkenfox first.

Installing Firefox

If you already have Firefox installed, skip to installing Arkenfox.

Otherwise, Firefox is available on these package managers with the following package names (non-exhaustive):

APT: firefox
DNF: firefox
Flatpak: org.mozilla.firefox
Homebrew: firefox (cask)
Pacman: firefox
Winget: Mozilla.Firefox

Alternatively, download Firefox from Mozilla’s site or with your favorite graphical software center application.

Installing Arkenfox

Type ‘about:profiles’ in the address bar to get to the profile management page. Find the ‘Root Directory’ row of the table under your current profile and hit ‘Open Directory’. Alternatively, hit ‘Create a New Profile’, follow the profile creation wizard, hit ‘Launch profile in new browser’ under the new profile, and then do the same as above but with the new profile.

Then, open the latest Arkenfox user.js release page and download ‘Source code (zip)’. Extract the archive somewhere and open the resulting folder. Copy the contents of that folder into the root folder you opened earlier.

In order to customize Arkenfox, we will use a file called ‘user-overrides.js’. You can write your own by following the Arkenfox wiki page on user overrides, or you can use one of the user overrides presets I’ve made.

If you chose to use one of my user overrides, simply extract whichever archive you downloaded and place the ‘user-overrides.js’ file in the same folder as the other Arkenfox files.

Finally, exit Firefox (Ctrl+Shift+Q on Windows, Ctrl+Q on Linux) and run either updater.bat on Windows or updater.sh on Linux or MacOS. Follow the on-screen prompts, updating the updater and running prefsCleaner when asked. When you relaunch Firefox with your chosen profile, the Arkenfox user.js will be applied along with your overrides.

Use cases and alternatives

Firefox with Arkenfox is best used when using Tor Browser is impossible or impractical. Firefox with Arkenfox will not give you as much protection as Tor Browser, but it’s still far ahead of mainstream proprietary browsers like Chrome or Edge. It can also be used alongside Tor Browser if one or the other doesn’t meet all your needs.

Some alternatives to Firefox with Arkenfox include:

Librewolf, Firefox fork with more private defaults
Mullvad Browser, essentially Tor Browser but with Mullvad VPN instead of Tor
Brave, Chromium-based

Extensions

As explained on the Arkenfox wiki page on extensions, extensions have elevated privileges in your browser and can make you more vulnerable to fingerprinting and security flaws. Therefore I recommend you stick mostly to the extensions listed on that Arkenfox page and to use as few as possible.

In addition to uBlock Origin as recommended by Arkenfox, I have also used an extension for my password manager, Bitwarden.

Special treat for Nix users

Check out the wonderful arkenfox-nixos project for managing Arkenfox declaratively on NixOS or with Home Manager!