Our great sponsors
-
-
WorkOS
The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.
-
-
ohmyzsh
🙃 A delightful community-driven (with 2,300+ contributors) framework for managing your zsh configuration. Includes 300+ optional plugins (rails, git, macOS, hub, docker, homebrew, node, php, python, etc), 140+ themes to spice up your morning, and an auto-update tool so that makes it easy to keep up with the latest updates from the community.
-
-
InfluxDB
Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.
Nice ideas! I've been using many of those things for some months now. You can see my whole setup which includes zsh, Wayland, network-manager, paru, and pipewire here: https://github.com/mastertinner/dotfiles/
zsh-syntax-highlighting
zsh-autosuggestions
I'm sure there are more good plugins out there, but I haven't found a need for them yet. I'm using a custom prompt I made but if you're interested in trying a bunch of prompt themes with some default packages and such, you might be interested in Oh My Zsh.
I set up my own config instead of using the grml one, so I use antibody for managing zsh plugins, and I use the following plugins:
Also, I am pretty sure that you can only have encrypted /boot if you use GRUB. The point of doing so is not really to make sure nobody reads it (there isn't anything interesting on /boot by default), but to make sure that nobody can tamper with it (ignoring the encryption vs authenticated encryption discussion). However, you still have to make sure nobody can tamper with GRUB itself. You might want to check out https://github.com/xmikos/cryptboot if this sounds interesting. Also, there are similar solutions that don't use encrypted /boot, for example booting from signed EFISTUBs, see https://wiki.archlinux.org/index.php/Unified_Extensible_Firmware_Interface/Secure_Boot#Implementing_Secure_Boot. Also, I don't actually use this kind of setup personally (albeit I'd like to one day), and I am certainly not a security expert, so take this whole paragraph with a big grain of salt, and double check with somebody who actually knows what they are talking about.
For the last part, check out https://github.com/andreyv/sbupdate . Linked also from arch wiki, so not some completely random solution. Its for creating unified kernel images, including the initramfs, microcode and so on. This package is then signed for secureboot, and can be loaded using EFISTUB for example. This prevents attacks against initramfs or some other things on /boot, if unencrypted. I haven't come around to test it myself, but I think its a neat solution, and with proper secure boot (and password protected firmware), a reasonable protection against evil maid attacks.