the OS was not the comparison, but the hardware it runs on (just as @Freefall said) but also you seem to be wrong with your other assumption:

And both those devices are tied to a specific OS.

Which seems not to be the case as install instructions for another OS can be found here (i didn’t try it though) for the mentioned device:

https://wiki.lineageos.org/devices/pdx215/

lineage os still is an “android”, but another vendor with clearly different approach than the original firmware and what hinders you from writing bsd drivers and compiling a bsd kernel for it instead? So i count the Xperia 1 III as NOT bound to any OS or OS vendor.

But despite the way longer possible support/security, freedom of choice and endless other possibilities that often come along with free OS choice, this pure and great advantages weren’t even mentioned there, thus it wasnt an OS comparison as it also wasn’t a bound-to-an-OS vs. absentness of vendor-lock-in-limitation-jungle comparison.

ads with install buttons always are traps. and traps are always bad (except snmp traps, those are good but unreliable)

same way ads at download pages stating “proceed to download” are traps.

also ads at search result pages stating " 1 2 3 4 … next" are traps too.

for the “sponsored” note: there is no boundary here that makes it really clear for what that ‘sponsored’ is meant for. without any boundary it could be for something above it, below it, on the side or maybe even something that opens when you click on “sponsored” itself (seen it this way once). it could be for an ad that just failed to load (noticed the free space above that “sponsored” text? maybe the ad loads a bit later just to shift the real contents down so you “accidently” click on the ad that loads intentionally late for this very accident to be likely to happen?) if you use adblockers - which you should do for security reasons anyway - then you’ll see “sponsored” or “advertising” often even without the ad it was meant for after full load of the page. so a single “sponsored” without a clear boundary showing what would be that sponsored content, does not state anything to be an ad, it is purely meaningless and the lack of such boundary always is intentional to distract the user from what he wanted and trap him somehow.

a clear thumbs-down for ‘zoho assist’ from me here just for paying for (or trying out for free or such) such an advertising type.

And in most cases ads simply beeing ads are traps too. by the very concept of ads.

around 80 % of all things i actually still wanted after i bought them were recommendations by people i met in person. 15 % are things recommended by real persons i met on the internet. around 5% are things i bought without it beeing recommded by anyone (not even an ad) things i still wanted after i bought it due to an ad are nearly not existant. ok, i have stopped viewing television in 1997, have a sticker at my postbox that forbids to throw ads in (works where i live), use dns entries to remove most ads in my network, use browsers/extension that remove most crapjunkwastelitterrubbishads and skip webpages that still show too many ads or too offensive cookieterrorbanners. i use google search only sometimes for comparison of results, but near to zero for actual searching. i feel safe to say i am not that much distracted by ads. (however open source projects and authors do get money from me on a monthly basis, where i want to support them, either direct lly sent from my bank account or indirect).

for me personally an ad just saying “you might like this” drives me away from that product, if it needs or wants an ad, i don’t want it, even more so the more it states how difficult and horrible my life would be without the product or how easy it’ll be with it, go away ad-needing products, get recommended personally by those who actually use it, not by those who want to sell it. period. there is no better ad than true recommendation and its also free, no marketing monkey needs to get payed for bs, only an actually good product is needed… and there we go what types of products actually need ads…

once in my life i discovered a product that i first explicitly not bought for a decade because of the awful ad for it, but bought it another decade later by an absentminded accident and found it to be a good product despite its awful ad. then they increased packaging/reduced the product within to cover up a price increase in trade of more waste production, so i abandoned that product again and found something cheaper more eco friendly instead, yes, the cheaper one is really not as good, but i feel better with it and especially less betrayed by the vendor, so the eco one is the better one alltogether. and also i think its better to buy products where you don’t see ads for cause this behaviour could actually fix this advertising storm in the long run, so in this way its the better choice to buy products that don’t have ads for it.

again:

An ad with an install button is always a trap, even more so when the real install follows a single misclick on it. il’d say it would be quite fair to downvote/zerostars an app for how foulish-sneaky it was positioned in the search results if it is shown like an actual result with a f’ing install button. as its advertising type is always also part of the brand and the product itself. maybe make a sports out of that, klick the clickbait install buttons only to downvote the app for beeing intrusive and deinstall it again without even starting the app once, just to train advertisers to do it right instead of wrong next time. maybe. but for security reasons better don’t do that (at least not with a device with sensitive data on it)

please do not blame users to fall for ads. advertising industry now had centuries to learn to trap users and literally thousands or millions of marketing guys, designers, psycologists, neurologists or whatever only to learn and establish new abusive ways to distract and trap users. but a user only has his own lifespan to counteract that and learn to avoid those manipulations, and he also has to do other important stuff in his life too.

please don’t blame users for beeing humans. blame the industry where they are intentionally abusive, inhumane and/or counterproductive.

we need an adblockers blockers blocker

no, what is needed is an app that helps track who benefits from thr apps that annly you most:

• ownership of companies pushing annoying ads
• management of companies pushing annoying ads
• find the connection between those and the products you maybe want to buy in shops or in internet before you buy, then instead of buying, let the app send the seller a message that you did not buy because of that connection.
• do this in numbers with lots of people and see what happens to the advertising jungle

the point is NOT buying because of advertising AND let them know it, so they can learn to improve themselves.

they wanted your data? let them have it the way you want them to.

same with any platform. ask the creator of your choice to also publish using patreon and you’ll become a member then, getting the content free of ads. better more directly pay who does the actual work, not all the big tech harvesting all the benefit inbetween.

so what maybe is needed here could be a free or even self-hostable platform that also allows payed subscriptions.

really, yt stopped to play sound on the website for me (beeing logged in), there is a banner to “activate sound” but it always disappears unclickable fast, so i searched and found webtube, an app that basically loads their website, but has one feature youtube has not: “sound” *lol

now i wonder how many of these apps really are “third” party apps and not really theirs only masked as third party for getting that gain of trust all the “others” get when it comes to big techs with their very own “public” crime records …

would be too easy for them to create some small apps, act as if those were 3rd party software but harvest that spyoil (of the 21 century) anyway.

you should definitely know what type of authentication you use (my opinion) !! the agent can hold the key forever, so if you are just not asked again when connecting once more, thats what the agent is for. however its only in ram, so stopping the process or rebooting ends that of course. if you didn’t reboot meanwhile maybe try unload all keys from it (ssh-add -D, ssh-add -L) and see what the next login is like.

btw: i use ControlMaster /ControlPath (with timeouts) to even reduce the number of passwordless logins and speed things up when running scripts or things like ansible, monitoring via ssh etc. then everything goes through the already open channel and no authentication is needed for the second thing any more, it gets really fast then.

The whole point of ssh-agent is to remember your passphrase.

replace passphrase with private key and you’re very correct.

passphrases used to login to servers using PasswordAuthentication are not stored in the agent. i might be wrong with technical details on how the private key is actually stored in RAM by the agent, but in the context of ssh passphrases that could be directly used for login to servers, saying the agent stores passphrases is at least a bit misleading.

what you want is:

• use Key authentication, not passwords
• disable passwordauthentication on the server when you have setup and secured (some sort of backup) ssh access with keys instead of passwords.
• if you always want to provide a short password for login, then don’t use an agent, i.e. unset that environment variable and check ssh_config
• give your private key a password that fits your needs (average time it shoulf take attackers to guess that password vs your time you need overall to exchange the pubkey on all your servers)
• change the privatekey every time immediately after someone might have had access to the password protected privkey file
• do not give others access to your account on your pc to not have to change your private key too often.

also an idea:

• use a token that stores the private key AND is PIN protected as in it would lock itself upon a few tries with a wrong pin. this way the “password” needed to enter for logins can be minimal while at the same time protecting the private key from beeing copied. but even then one should not let others have access to the same machine (of course not as root) or account (as user, but better not at all) as an unlocked token could also possibly be used to place a second attacker provided key on the server you wanted to protect.

all depends on the level of security you want to achieve. additional TOTP could improve security too (but beware that some authenticator providers might have “sharing” features which could compromise the TOTP token even before its first use.

My theory is that you already have something providing ssh agent service

in the past some xserver environments started an ssh-agent for you just in case of, and for some reason i don’t remember that was annoying and i disabled it to start my agent in my shell environment as i wanted it.

also a possibility is tharlt there are other agents like the gpg-agent that afaik also handles ssh keys.

but i would also look into $HOME/.ssh/config if there was something configured that matches the hostname, ip, or with wildcards* parts of it, that could interfere with key selection as the .ssh/id_rsa key should IMHO always be tried if key auth is possible and no (matching) key is known to the ssh process, that is unless there already is something configured…

not sure if a system-wide /etc/ssh/ssh_config would interfere there too, maybe have a look there too. as this behaviour seems a bit unexpected if not configured specially to do so.

usually at first you can do such, and later on, when a ceo wants more money, you then can buy that together with the new “pro” features actually nobody needs nor wants.

maybe better look for more stable solutions before they start acting like a broadcom ;-)

i am happy to have a raspberry pi setup connected to a VLAN switch, internet is behind a modem (like bridged mode) connected with ethernet to one switchport while the raspi routes everything through one tagged physical GB switchport. the setup works fine with two raspi’s and failover without tcp disconnections during an actual failover, only few seconds delay when that happens, so basically voip calls recover after seconds, streaming is not affected, while in a game a second off might be too much already, however as such hardware failures happen rarely, i am running only one of them anyway.

for firewall i am using shorewall, while for some special routing i also use unbound dns resolver (one can easily configure static results for any record) and haproxy with sni inspection for specific https routing for the rather specialized setup i have.

my wifi is done by an openwrt but i only use it for having separate wifis bridged to their own vlans.

thus this setup allows for multi-zone networks at home like a wifi for visitors with daily changing passwords and another fror chromecast or home automation, each with their own rules, hardware redundancy, special tweaking, everything that runs on gnu/linux is possible including pihole, wireguard, ddns solutions, traffic statistics, traffic shaping/QOS, traffic dumps or even SSL interception if you really want to import your own CA into your phone and see what data your phones apps (those that don’t use certificate pinning) are transfering when calling home, and much more.

however regarding ddns it sometimes feels more safe and reliable to have a somehow reserved IP that would not change. some providers offer rather cheap tunnels for this purpose. i once had a free (ipv6) tunnel at hurricane electronic (besides another one for IPv4) but now i use VMs in data centers.

i do not see any ready product to be that flexible. however to me the best ready router system seems to be openwrt, you are not bound to a hardware vendor, get security updates longer than with any commercial product, can 1:1 copy your config to a new device even if the hardware changes and has the possibility to add packages with special features to it.

“openwrt” is IMHO the most flexible ready solution for longtime use. same as “pfsense” is also very worth looking at and has some similarities to openwrt while beeing different.

calm down and see it as a joke. *ggg

would make a nice tshirt =)

woman would take care for a literal horse instead of going to therapy. i don’t see anything wrong there either.

just a horse is way more expensive, cannot be put aside for a week on vacations (could a notebook be put aside?) and one cannot make backups of horses or carry them with you when visiting friends. Horses are way more cute, though.

ich you have adhd and asperger or better, you might end up beeing trained by yourself for ignoring google’s, microsoft’s or other f’uped up so called “autocorrection” and ‘automatically’ overlook single mismatching words but recognize the sentence as a whole without actually reading it word by word. some can read entire pages with a single look on it without focusing on a a specific region or i.e. the center while still beeing able to later rephrase the content of the entire page.

1up for all with special (dis-)Abilities!!

sorry if i might repeat someones answer, i did not read everything.

it seems you want it for “work” that assumes that stability and maybe something like LTS is dort of the way to go. This also assumes older but stable packages. maybe better choose a distro that separates new features from bugfixes, this removes most of the hassle that comes with rolling release (like every single bugfix comes with two more new bugs, one removal/incompatible change of a feature that you relied on and at least one feature that cripples stability or performance whilst you cannot deactivate it… yet…)

likely there is at least some software you most likely want to update out of regular package repos, like i did for years with chromium, firefox and thunderbird using some shellscript that compared current version with latest remote to download and unpack it if needed.

however maybe some things NEED a newer system than you currently have, thus if you need such software, maybe consider to run something in VMs maybe using ssh and X11 forwarding (oh my, i still don’t use/need wayland *haha)

as for me, i like to have some things shared anyway like my emails on an IMAP store accessible from my mobile devices and some files synced across devices using nextcloud. maybe think outside the box from the beginning. no arch-like OS gives you the stability that the already years-long-hung things like debian redhat/centos offer, but be aware that some OSes might suddenly change to rolling release (like centos i believe) or include rolling-release software made by third parties without respecting their own rules about unstable/testing/stable branches and thus might cripple their stability by such decisions. better stay up to date if what you update to really is what you want.

but for stability (like at work) there is nothing more practical than ancient packages that still get security fixes.

roundabout the last 15 years or more i only reinstalled my workstation or laptop for:

• hardware problems, mostly aged disk like ssd wearlevel down (while recovery from backup or direct syncing is not reinstalling right?)
• OS becomes EOL. thats it.

if you choose to run servers and services like imap and/or nextcloud, there is some gain in quickly switching the workstation without having to clone/copy everything but only place some configs there and you’re done.

A multi-OS setup is more likely to cover “all” needs while tools like x2vnc exist and can be very handy then, i nearly forgot that i was working on two very different systems, when i had such a setup.

I would suggest to make recovery easy, maybe put everything on a raid1 and make sure you have on offsite and an offline backup with snapshots, so in case of something breaks you just need to replace hardware. thats the stability i want for the tools i work with at least.

if you want to use a rolling release OS for something work related i would suggest to make sure no one externally (their repo, package manager etc) could ever prevent you from reinstalling that exact version you had at that exact point in time (snapshots from repos install media etc). then put everything in something like ansible and try out that reapplying old snapshots is straight forward for you, then (and not earlier) i would suggest that those OSes are ok for something you consider to be as important as “work”. i tried arch linux at a time when they already stopped supporting the old installer while the “new” installer wasn’t yet ready at all for use, thus i never really got into longterm use of archlinux for something i rely on, bcause i could’nt even install the second machine with the then broken install procedure *haha

i believe one should consider to NOT tinker too much on the workstation. having to fix something you personally broke “before” beeing able to work on sth important is the opposite of awesome. better have a second machine instead, swappable harddrive or use VMs.

The exact OS is IMHO not important, i personally use devuan as it is not affected by some instability annoyances that are present in ubuntu and probably some more distros that use that same software. at work we monitor some of those bugs of that software. within ubuntu cause it creates extra hassle and we workaround those so its mostly just a buggy annoying thing visible in monitoring.

As i see it, the term “firewall” was originally the neat name for an overall security concept for your systems privacy/integrity/security. Thus physical security is (or can be) as well part of a firewall concept as maybe training of users. The keys of your server rooms door could be part of that concept too.

In general you only “need” to secure something that actually is there, you won’t build a safe into the wall and hide it with an old painting without something to put in it or - could be part of the concept - an alarmsensor that triggers when that old painting is moved, thus creating sort of a honeypot.

if and what types of security you want is up to you (so don’t blame others if you made bad decisions).

but as a general rule out of practice i would say it is wise to always have two layers of defence. and always try to prepare for one “error” at a time and try to solve it quickly then.

example: if you want an rsync server on an internet facing machine to only be accessible for some subnets, i would suggest you add iptables rules as tight as possible and also configure the service to reject access from all other than the wanted addresses. also consider monitoring both, maybe using two different approaches: monitor the config to be as defined as well as setup an access-check from one of the unwanted, excluded addresses that fires an alarm when access becomes possible.

this would not only prevent those unwanted access from happening but also prevent accidental opening or breaking of config from happen unnoticed.

here the same, if you want monitoring is also up to you and your concept of security, as is with redundancy.

In general i would suggest to setup an ip filtering “firewall” if you have ip forwarding activated for some reason. a rather tight filtering would maybe only allow what you really need, while DROPping all other requests, but sometimes icmp comes in handy, so maybe you want ping or MTU discovery to actually work. always depends on what you have and how strong you want to protect it from what with what effort. a generic ip filter to only allow outgoing connections on a single workstation may be a good idea as second layer of “defence” in case your router has hidden vendor backdoors that either the vendor sold or someone else simply discovered. Disallowing all that might-be-usable-for-some-users-default-on-protocols like avahi & co in some distros would probably help a bit then.

so there is no generic fault-proof rule of thumb…

to number 5.: what sort of “not trusting” the software? might, has or “will” have: a. security flaws in code b. insecurity by design c. backdoors by gov, vendor or distributor d. spy functionality e. annoying ads as soon as it has internet connection f. all of the above (now guess the likely vendors for this one)

for c d and e one might also want to filter some outgoing connection…

one could also use an ip filtering firewall to keep logs small by disallowing those who obviously have intentions you dislike (fail2ban i.e.)

so maybe create a concept first and ask how to achieve the desired precautions then. or just start with your idea of the firewall and dig into some of the appearing rabbit holes afterwards ;-)

regards