when technical folks act like everyone and their grandma should run arch

As an Arch user, man I hate when people are like that. Arch certainly has a specific target audience. If you (the individual) are comfortable with a distro, and it works well for you, it’s a good option. If Arch isn’t that, then it’s not a good option for you. Some people don’t understand that even the “once a year single command” maintenance is too technical for most.

Having run Arch only the last few years, I don’t know how much it’s improved compared to say 10 years ago. I do know on most of my systems I don’t spend that much time updating or maintaining my Arch installations, usually just a yay, select which AUR packages not to update (the ones I have can have issues updating sometimes), wait for 15-ish minutes (depends how much I have to compile from AUR), and that’s it. From server to desktop, some weekly, others once every couple months. Although I would say it’s more than average, as I have a custom repository with some nightly compiled packages, which has its own issues.

The difference is rolling vs stable release.

Debian 13 is out, and it will stay exactly the same Debian 13 that it was when it released, even 5 years from now. The only changes are bugfixes, security patches, etc. No new features. This means you can basically do unattended sudo apt update && sudo apt upgrade with no problems. By the time Debian 14 comes out, there will have been a ton of changes to upstream software, Updating from 13 to 14 might be a one-click fix, or it might take effort fixing configs and ensuring the new software works.

Arch Linux is rolling release, it does not have version numbers, and does not hold back a major package update just “because it changes things”. This means basically every update might change things, and that can require intervention. If the Arch Linux team is aware of required intervention, it will be put on the Arch News. This is often just one or two commands. The possibility of intervention being required means unattended upgrades are a no-go on Arch, but that’s pretty much it.

If you don’t update your system for say, a year, everything that’s changed in that time will change all at once. This is often still a few commands to fix, but could be more depending on what updated exactly. Updating regularly is reccomended, because it’s easier to tell what exactly changed between updates, and thus easier to track down where a problem originates from.

Depends entirely on the device. On most desktops, you should be able to. On a lot of laptops, this may leave them in an unbootable state (due to GPU option ROMs).

Check for your specific hardware before removing factory default secure boot keys.

This is heavily sensationalized. UEFI “secure boot” has never been “secure” if you (the end user) trust vendor or Microsoft signatures. Alongside that, this ““backdoor”” (diagnostic/troubleshooting tool) requires physical access, at which point there are plenty of other things you can do with the same result.

Yes, the impact is theoretically high, but it’s the same for all the other vulnerable EFI applications MS and vendors sign willy-nilly. In order to get a properly locked-down secure boot, you need to trust only yourself.

When you trust Microsoft’s secure boot keys, all it takes is one signed EFI application with an exploit to make your machine vulnerable to this type of attack.

Another important part is persistence, especially for UEFI malware. The only reason it’s so easy is because Windows built-in “factory reset” is so terrible. Fresh installing from a USB drive can easily avoid that.

While Mint is an Ubuntu-based distro, it tries to un-fuck the worst of Canonical. Other Ubuntu spins with a different desktop environment don’t do this, like Xubuntu, Kubuntu, etc. They end up as just Ubuntu on a different DE, with all the decisions made by canonical.

Base Debian might work, but afaik, is “not as beginner friendly” compared to Mint.

Firefox is able to do this for basic PDF annotations. It’s not very extensive, but it’s very simple to use (and you probably already have it installed).

It is only a partial upgrade if you update your databases, without upgrading the rest of your system. If you try to pacman -S firefox, and it gives you a 404, you have to both update your pacman databases, and upgrade your packages. This will only give you a 404 if you cleaned your package cache, and your package is out of date. Usually, -S on an already installed package will reinstall it from cache. This does not cause a partial upgrade.

If you run pacman -Sy, everything you install is now considered a partial upgrade, and will break if you don’t know exactly what you’re doing. In order to avoid a partial upgrade, you should never update databases (-Sy) without upgrading packages (-Su). This is usually combined in pacman -Syu.

and had to delete, update, and then rebuild half my system just to update the OS because the libraries were out of sync.

This does not just happen with proper use of pacman. The most common situation where this does happen is called a “partial upgrade”, which is avoidable by simply not running pacman -Sy. (The one exception is for archlinux-keyring, though that requires you run pacman -Syu afterwards).

Arch is definitely intended for a certain audience. If you don’t intend on configuring your system on the level Arch allows you to, then a different distro might be a better option. That does not mean it’s a requirement, you can install KDE, update once a month, and almost never have to worry about system maintenance (besides stuff that is posted on Archlinux news, once or twice a year, usually a single command).

If you want to learn, go for it! Although if you’re running anything important, be sure you’ve got backups, and can restore your system if needed. I wouldn’t personally worry about the future of NixOS. If the project “goes the wrong way”, it’s FOSS, someone will fork it.

I’ve considered Proxmox, but immediately dismissed it (after light testing) due to the lack of control over the host OS. It’s just Debian with a bunch of convenience scripts and config for an easy libvirt experience. That’s amazing for a “click install and have it work” solution, but can be annoying when doing something not supported by the project, as you have to work around Proxmox tooling.

After that, I checked my options again, keeping in mind the only thing the host OS needs is KVM/libvirt, and a relatively modern kernel. Since it’s not intended to run any actual software besides libvirt, stability over quick releases is way more important. I ended up going with Alpine Linux for this, as it’s extremely light-weight (no systemd, intended for IoT), and has both stable and rolling release channels.

It is significantly more setup to use libvirt directly. After installation, Proxmox immediately allows you to get going. Setting up libvirt yourself requires effort. I personally use “Virtual Machine Manager” as a GUI to manage my VMs, though frequently use the included “virsh” too.

Is there anything stopping viruses from doing virus things?

Usually that’s called sandboxing. AUR packages do not have any, if you install random AUR packages without reading them, you run the risk of installing malware. Using Flatpaks from Flathub while keeping their permissions in check with a tool like Flatseal can help guard against this.

The main difference is that even with the AUR being completely user submitted content, they’re centralized repositories, unlike random websites. Malware on the AUR is significantly less common, though not impossible. Using packages that have a better reputation will avoid some malware, simply because other people have looked at the same package.

There is no good FOSS Linux antivirus (that also targets Linux). Clamav “is the closest”, though it won’t help much.

After GRUB unlocks /boot and boots into Linux proper, is there any way to access /boot without unlocking again?

No. The “unlocking” of an encrypted partition is nothing more than setting up decryption. GRUB performs this for itself, loads the files it needs, and then runs the kernel. Since GRUB is not Linux, the decryption process is implemented differently, and there is no way to “hand over” the “unlocked” partition.

Are the keys discarded when initramfs hands off to the main Linux system?

As the fs in initramfs suggests, it is a separate filesystem, loaded in ram when initializing the system. This might contain key files, which can be used by the kernel to decrypt partitions during boot. After booting (pivoting root), the keyfiles are unloaded, like the rest of initramfs (afaik, though I can’t directly find a source on this rn). (Simplified explanation) The actual keys are actively used by the kernel for decryption, and are not unloaded or “discarded”, these are kept in memory.

If GRUB supports encrypted /boot, was there a ‘correct’ way to set it up?

Besides where you source your rootfs key from (in your case a file in /boot), the process you described is effectively how encrypted /boot setups work with GRUB.

Encryption is only as strong as the weakest link in the chain. If you want to encrypt your drive solely so a stolen laptop doesn’t leak any data, the setup you have is perfectly acceptable (though for that, encrypted /boot is not necessary). For other threat models, having your rootfs key (presumably LUKS2) inside your encrypted /boot could significantly decrease security, as GRUB (afaik) only supports LUKS1.

Or am I left with mounting /boot manually for kernel updates if I want to avoid steps 3 and 4?

Yes, although you could create a hook for your package manager to mount /boot on kernel or initramfs regeneration. Generally, this is less reliable than automounting on startup, as that ensures any change to /boot is always made to the boot partition, not accidentally to a directory om your rootfs, even outside the package manager.

If you require it, there are “more secure” ways of booting than GRUB with encrypted /boot, like UKIs with secure boot (custom keys). If you only want to ensure a stolen laptop doesn’t leak data, encrypted /boot is a hassle not worth setting up (besides the learning process itself).

The main oversimplification is where browsers “just visit websites”, SSH can be really powerful. You can send/receive files with scp, or even port forward with the right flags on ssh. If you stick to ssh user@host without extra flags, the only thing you’re telling SSH to do is set up a text connection where your keyboard input gets sent, and some text is received (usually command output, like from a shell).

As long as you understand what you’re asking SSH to do, there’s little risk in connecting to a random server. If you scp a private document from your computer to another server, you’ve willingly sent it. If you ssh -R to port forward, you’ve initiated that. The server cannot simply tell your client to do anything it wants, you have to do this yourself.

1. I do not personally have experience with this website
2. Connecting to an SSH server with an SSH client is much like connecting to a webserver with a webbrowser. It is theoretically possible for bad things to happen, but automatic (“zero click”) attacks of any kind are difficult to pull off when the software is up to date. Most bad things that happen come from the user doing it themselves, like downloading and running untrusted programs, entering your password on a phishing site, etc.
3. This is not necessary, given your host system is up to date.

Note that my answer to 2 is heavily oversimplified, but applies in this scenario of SSH to “OverTheWire”.

Saving on some overhead, because the hypervisor is skipped. Things like disk IO to physical disks can be more efficient using multikernel (with direct access to HW) than VMs (which have to virtualize at least some components of HW access).

With the proposed “Kernel Hand Over”, it might be possible to send processes to another kernel entirely. This would allow booting a completely new kernel, moving your existing processes and resources over, then shutting down the old kernel, effectively updating with zero downtime.

It will definitely take some time for any enterprises to transition over (if they have a use for this), and consumers will likely not see much use in this technology.

SSH in from another machine, and sudo dmesg -w. If the graphics die, it can’t display new logs on the screen. If the rest of the system is fine, an open SSH session should give you more info (and allow you to troubleshoot further).

You can also check if the kernel is still functional by using a keyboard with a caps-lock LED. If the LED starts flashing after the “freeze”, it’s actually a kernel panic. You’ll have to figure out a way to obtain the kernel panic information (like using tty1).

After the “freeze”, try pressing the caps-lock key. If the LED turns on when pressing caps-lock, the Linux kernel is still functional. If the caps-lock key/LED does not work, the entire computer is frozen, and you are most likely looking at a hardware fault.

From there, you basically need to make educated guesses of what to attempt in order to narrow down the issue and obtain more information. For example, try something like glxgears or vkgears to see if it happens with only one of those, or both (or neither).

Security is an insanely broad topic. As an average desktop user, keep your system up to date, and don’t run random programs from untrusted sources (most of the internet). This will cover almost everyones needs. For laptops, I’d recommend enabling drive encryption during installation, though note that data recovery is harder with it enabled.

GNOME devs simply can’t “tolerate” SSD, and force CSD in every scenario for GTK4. My machines running Wayland only have CSD for fully custom apps (like Steam) and every GTK4 app.

To answer the question in the title: No, because these systems inherently have different architecture. Something like OpenBSD (the OS) is relatively self-contained. Linux distributions have system components that are externally developed, but a user might rely upon.

What exactly is the “problem” you have with Linux package managers? It’s specifically extra complexity to separate “system” and “packages”. This works well for *BSDs that often develop the entire OS themselves, but would pose extra challenges for Linux distributions, where the line between “OS” and “user installed package” is much more blurred.

Looking at this, I’d personally delete both EFI and boot partitions, then remake them with the EFI partition significantly smaller (it should not exceed >100MB used). I have no idea what issues this would cause on Debian, and what specific configuration needs to be changed/updated. I’d guess you need to change the fstab entries, remake the initrds, and reinstall/reconfigure the bootloader.

Any manual messing with partitions, especially rootfs/boot/efi, can easily lead to a broken system. The fix will not be a simple procedure.

As you’re considering messing with your rootfs, I’m going to assume you have a backup. It’ll be significantly easier for you to wipe everything, install fresh new Debian, and copy your personal files over to the new installation.

sudo systemctl status shows you what services are running, sudo systemctl list-units lists everything, including the services that failed. sudo systemctl status gdm.service shows you the status of one service in particular, and sudo journalctl -u gdm.service shows the output/logs of that service.

There’s a decent chance something is not starting due to misconfiguration. I’m guessing GDM based on previous comments. You can also check /var/log/pacman.log (make sure to save a copy, just in case), to see what packages changed/updated.

If you think it’s a pacman issue somehow, you can reinstall your entire system (excluding AUR or self-made PKGBUILDs). Note that this is almost never required to fix an issue. In a properly working system this “shouldn’t harm anything”, but nothing can be guaranteed on a broken system. The command for that is sudo pacman -S $(pacman -Qqn)