data1701d (He/Him)

1. Alpine is still a Linux distro, just a lighter one. Also, busybox is a set of standard utilities as an alternative to coreutils; I have no idea how it’s particularly relevant here.
2. The thing is, I’m not using only Docker. I also use native nginx as a reverse proxy, for which I like Debian’s defaults, as well as SyncThing, which are both well-maintained packages in Debian. Also I kind of prefer glibc distros. While glibc kind of sucks, so much stuff I like using prefers or requires it; for instance, last I saw, mDNS/Avahi resolution on BusyBox was kind of a pain in the rear.
3. Most of what I use Flatpak for isn’t network-facing or opening unverified files anyway; the most important applications I do run the native Debian version. Honestly, truth be told, you are correct that I do often prefer native versions and will run the native Debian package if possible (and considering the current age of stable, a lot of them really aren’t that old; Inkscape is basically still the latest version, for instance, while Firefox is always kept to the latest ESR); at some point, though, I do find a Debian package that is too behind to do what I do (though rare, TBH), and despite some issues with Flatpak, at the end of the day, I need to just get a piece of software installed and get on with my day. In that case, I just do a Benjamin Sisko:

I think I have a prototype of a browser extension somewhere on my computer whose only function is to hide the comments button on Phoronix.

Honestly, in the age of Flatpak and containerization (as well as Debian often being well-supported by upstream projects for script or package-based install), I feel like the age of Debian packages isn’t that annoying anymore; anything important gets security patches, and it’s easier than ever to use 3rd party software without breaking your system. I will add that Debian seems to be much better these days at making sure either a reasonably up-to-date version ships with a release (and can be kept secure during a stable cycle) or not shipping it at all as to allow the user to install it themselves.

I remember back in just 2021 when it took months after Firefox ESR 78 went EOL for them to update Bullseye to 91; recently, it only took them a few days after 140’s EOL to switch to 153 (and 91-115 and 115-140 happened without much note either), which isn’t perfect, but much better than it was.

If you need to install it on a new laptop, backports often has you covered. I ran a backports kernel for about a year on Debian Bookworm to get my laptop’s Wi-Fi modem working; I was able to quit using the backports kernel once Trixie came out.

No, not until 2027. I don’t really know why this meme was posted at this exact moment.

Eh. They’re actually pretty on top of security patches for pretty much any internet-exposed server software.

The OpenSSL incident was a long time ago at this point.

xkcd 1085:

That’s precisely why secure boot and TPMs exist - the TPM can store the keys to decrypt the drives and won’t give them unless the signed shim executable can be verified; the shim executable then checks the kernel images, options, and DKMS drivers’ signatures as well. If the boot partition has been tampered with, the drive won’t decrypt except by manual override.

The big problem is Microsoft controls the main secure boot certificate authority, rather than a standards body. This means that either a bad actor stealing the key or Microsoft itself could use a signed malicious binary used to exploit systems.

Still, it’s at least useful against petty theft.

TPM sniffing attacks seem possible, but it looks like the kernel uses parameter and session encryption by default to mitigate that: https://docs.kernel.org/security/tpm/tpm-security.html