Since you seem to know a lot about it let me ask you a couple of things:

😅. I'll try my best 😜.

Bazzite is immutable, right? I’m sure I saw that somewhere and Fedora Atomic is also immutable IIRC

It is correct that the contents of / is immutable at runtime aside from /var and /etc. However, note that a lot of folders like /home and /opt are actually found in /var in response. This is later 'fixed' with symlinks and whatnot. In effect, only the contents of /usr (aside from /usr/share) is off-limits (or 'actual'^[1]^ immutable).

How does the config changes not get overwritten?

I believe my previous paragraph already answers this. But, to be even more elaborate, Fedora Atomic makes use of libostree (read: git for your OS). With this, only the pristine images are 'swapped' in-between updates (or rebases^[2]^). Your changes to the system are found in /var, /etc and in so-called 'layers' only and are not swapped out. Some of these changes are kept track of^[3]^, but most of them reside in /var and will not be touched by libostree.

The whole point of an immutable distro is to prevent changes to files to ensure things keep working

Kinda. The important part is that changes are prevented for the sake of a functioning system. But the entire system doesn't have to be locked down in order to achieve this. This does mean that it's actually not that hard to break your system. Just rm -rf /etc and your system will probably fail to boot into the very next deployment. But, as Fedora Atomic keeps at least two deployments, you will still be able to access the previous deployment in which you tried to delete /etc. So you're protected from accidental mishaps as long as you've got at least one working deployment. Thankfully, you can even pin working deployments with the ostree admin pin command. And..., just like that, the distro has basically become dummy-proof. I'm sure it's still possible to break the system, but you'd actually have to try 😉.

So, in short, Fedora Atomic definitely intends to be a more robust system and succeeds. But, it does so while giving the user agency (and some responsibility).

How are packages installed?

I think everything of importance is mentioned in the docs. What is it exactly you want to know?

The docs you sent recommend flatpak, which while very good in theory still has a small fleet of apps available.

But that's just the first of seven "package formats" listed in the docs 😜. The other six will assure that your remaining needs are fulfilled.

Also they suggest using distrobox among other things, that’s definitely not beginner friendly, although an interesting concept for an advanced user to have your main machine be an immutable host to any system you want.

This is obviously anecdotal, but Fedora Silverblue was the first distro that I used. I was a complete Linux newb. My coding background was also just a Python-course on Uni. But, somehow, in the very newbie-hostile environment back then (read: April 2022), I managed with Toolbx. So..., yeah..., I can't relate. Sorry*. You might be absolutely correct. But, as I said, I don't recognize this from my own experience. I wish I had a video-tutorial back then, though. Honestly, with the amount of hand-holding Bazzite and its docs provide, I believe a newbie should be absolutely fine.

1. It is even possible to overwrite this. Both in containerfile (requires creating own image) and on device (very hacky, not recommended).

2. Rebasing is the process by which a different image is selected to boot and run your system from. For example, with this, one can switch from Silverblue (GNOME) to Kinoite (KDE) without reinstallation. This can even be used to switch from a Fedora image to a Aurora/Bazzite/Bluefin/secureblue image.

3. These include the software you've installed through rpm-ostree (or soon dnf). We call these layered packages, based on the analogy that the packages aren't part of the image but are magically tacked on without you noticing anything finicky. It's quite magical. Besides that, any and all changes made to /etc are also kept track of. The former you can see by invoking rpm-ostree status, the latter by invoking ostree admin config-diff.

Ah, I get what you mean now by inflammatory statements

Actually, it wasn't me that said that 😅. I do find it in jrgd's reply, though.

Though interestingly, I didn’t feel my comment was very inflammatory and it got downvoted too. 😅

For the record, I also didn't downvote your comment 😜. Though, looking at how well-received my previous reply has been, I can't ignore the possibility that peeps that agreed with what I said also chose to downvote your comment.

I was looking at it more from just a standpoint of systemd itself

Sorry, I don't think I completely understood you here.

just looking at it from the standpoint that fedora and rhel can tend to be industry leaders for change.

I absolutely agree with you that Fedora and Red Hat are very effective agents of change. So yes, if they would get behind an alternative for systemd, then that would definitely get traction.

if RHEL and Ubuntu together made

Has something like this ever happened in the past? I can't recollect a collaboration of sorts between these two entities. If anything, they seem to be at odds with eachother: Mir vs Wayland, Snap vs Flatpak and even Upstart vs systemd. Though, at least so far, Red Hat holds an impressive winning track record.

I think we would see that move downstream.

Absolutely. But, and this is my inner-systemd-skeptic talking, systemd is ridiculously intertwined with the current Linux landscape and often times new updates even show a glimpse of how much more intermingling we'll get in the future. I hope we'll eventually get something to systemd like what PipeWire has been to PulseAudio. That's why development into alternatives like dinit and s6 is of utmost importance.

As far as my use of the term bloated, I’m looking at it strictly from a standpoint for the amount of code that goes into the system.

Suckless it is 😜. It's a fine definition. Thank you for that. But, I got to ask, where is the line drawn? Like, the Linux kernel, by virtue of being monolithic, has to be bloated as well. Right? So, if that's the case, is somehow the kernel's bloat okay while bloat is unaccepted for the system and service manager? If so, why? I'm genuinely curious.

The more code you have, the more entries for security risks.

Sure~ish. Deep discussion. I'm fine with giving this to ya.

I’m not saying that there’s anything that’s particularly better out there right now

I suppose some peeps will enjoy themselves with what's out there. Do you happen to use an alternative on a daily-basis?

but I think we should always be looking for alternatives regardless of what your views are for the people that created the code. KISS philosophy, basically. That and being open to change to avoid stagnation.

Wholeheartedly agree 😊.

Isn’t Bazzite an immutable OS with very limited package availability outside of gaming?

Nope. It's basically Fedora Atomic with a lot of special sauce to make onboarding as pleasant as possible. Especially if you want to use it for gaming; be it as a HTPC/console or on desktop. Thus, like Fedora Atomic, you've got access to many different package managers to get your needs covered. Heck, Bazzite and its uBlue siblings actually improve upon Fedora Atomic in this regard (at least by default). Refer to this entry in its documentation for the finer details.

but I’m not sure it would be a good experience for someone just getting into Linux, since most of the help he will get online

We've all been faulty of this (read: searching on the internet), but we should instead consolidate Bazzite's documentation first. Only after it isn't found there, should one consider going to their discussion platforms; be it their own forums or their Discord server. Searching on the internet is IMO a no-go, especially if one isn't well-versed yet.

will direct him to edit config files which would get overwritten on update.

This doesn't apply to Fedora Atomic. Perhaps you're conflating this with SteamOS.

Aight, got it.

For now, I'm exclusively on Wayland. Though, hopefully Openbox (or something inspired by it) will make the jump so that I can see for myself what all this goodness is about.

Anyhow, it was a lovely conversation. I enjoyed it to bits. I wish ya tha best. Cya, out there. Bye!

Do you have a link for these instructions?

In addition to the template linked by dustyData, there's also BlueBuild if you prefer YAML over containerfiles.

Very enlightening! Thank you so much!

mouse-centric

This is actually unfortunate for me. I seem to be prone to RSI related aches. Keyboard is fine~ish. But mouse can be pretty troublesome. Do you happen to know if it plays nice with trackballs and/or trackpads?

enabling a lot of the privacy features like resist fingerprinting often breaks login flows

True. Though, in this case, it's only enabled on hardened. So, the default config doesn't enable it.

and breaks dark mode detection on site

Yeah, that's really unfortunate. I suppose there's Dark Reader. But, I believe Arkenfox' maintainers held the opinion that a bandaid solution as such did more harm then worth it. At least for those that enable RFP for the sake of fingerprint protection.

Thanks for sharing.

Thanks for the appreciation!

Our goal is to continue the legacy of Mull by providing a free and open source, privacy and security-oriented web browser for daily use.

Do you work on IronFox?

Do you think I could run secure blue from a USB drive?

I'm not sure if it's exactly the same, but Jorge Castro (one of uBlue's maintainers) showed how some uBlue projects (perhaps this also applies to secureblue) can be installed on an external drive. Perhaps it's worth a look: https://www.youtube.com/watch?v=5DRaYQ6hKU0

I didn't downvote myself, but did consider it.

For one, it felt a bit out of place; Fedora isn't defined by systemd, nor Red Hat or IBM. One clear example would be how Fedora has chosen to stick with Btrfs; contrary to Red Hat's demands. Don't get me wrong, I don't deny any partnership or whatsoever. But it's not like Fedora's community has no agency.

Secondly, corsicanguppy's comment seems to imply that Fedora only sticks to systemd out of some obligation towards IBM/RedHat or something. As if the overwhelming majority of distros don't default to systemd.

Thirdly, Poettering works for M$ now. Sure. But systemd remains a Linux project. And quite a good one at that. Even if the likes of dinit and s6 are starting to offer some healthy competition, it's undeniable that systemd continues to have the advantage in terms of received man-hours (in development) and adoption. I hope that Fedora eventually gives others the chance to shine. But outright ditching systemd without a perfect replacement is just foolish.

Systemd is bloated

The bloat argument has absolutely no weight as long it's not properly defined. One's bloat is the other's sane default and vice versa. Please, if you're engaging in good faith, come up with a definition by which the likes of dinit and/or s6 are not bloated while systemd is. Please be complete and rigorous in your assessment.

and known to present security risks.

If you're referring to what's addressed in Madaidan's article, you should not forget that Whonix -the very distro Madaidan used to be a security researcher at- employed systemd to enhance security. And while one might say a lot about Poettering, one simply can't deny that they've got a sound understanding of good security standards and how to implement them. It's therefore unsurprising that both Kicksecure and secureblue (i.e. Linux' finest when it comes to hardened distros) heavily rely on systemd for their bidding.

Don’t see why looking at alternatives wouldn’t be seen as positive growth.

At least we can agree on this 😉.

Yeah, it seems that they even acknowledge that Tor and Mullvad are better for extreme threat models.

"The only browsers that can provide sophisticated fingerprinting protection against advanced scripts are Tor Browser & Mullvad Browser.

If you have an extreme threat model (Ex. Political dissident, journalist, or if you are in some other kind of high risk situation), please use one of those browsers."

I suppose we'd have to commend them for being fair.

Unfortunately, I've yet to experience Qubes OS myself. So I can't help you with that. Wish ya the best of luck though!