“Scan all libraries” on the dashboard.

It’s a hardware thing, but it’a not something other manufacturers can’t have, it’s just that they currently don’t have it. GrapheneOS is working with Motorola to create phones that satisfy their hardware requirements and they’re coming out in 2027.

rm -fr /* works no issue.

I suppose that’s an issue in how your distro packages it and makes it a required dependency. It’s absolutely not a required dependency of KDE Plasma and it’s optional. On Arch for instance it’s not even marked as optional and I can just do pacman -Rns kdeconnect and remove it freely.

What? Where do you see it preinstalled that you can’t remove it? It’s an open source app, I don’t see why a vendor would install it and keep you from removing it.

Actually, I just checked with Wireshark, and no traffic left my PC when I searched for a name of a flatpak app, not until I actually opened Discover to look for the app. Discover has a local cache and KRunner uses that for app searches.

I use Revolut with no issue on GrapheneOS. Maybe things changed.

Yeah, but at least in KDE, when I search for something that it can’t find on the PC, it gives you the option to “search blah with duckduckgo in firefox” instead of starting a web search immediately, waiting for it to finish, and showing the results in your start menu in front of whatever you actually wanted to find on your PC. It’s the fallback and not the default.

comm -1 -2 <(pacman -Qqm | sort) <(curl -s https://md.archlinux.org/s/SxbqukK6IA | sort)

https://f-droid.org/packages/app.passwordstore.agrahn

It’s not. It depends on how open the phone is and if it relies on exploits to root or if there’s an official method. Pixels are open and you can just install whatever you want on them, with open source drivers (although Google is trying to stop that too). So to install Graphene, for instance, it’s literally a web app with one or two clicks to do it automatically.

Fair. Unfortunately, mine don’t.

You can’t use Google Wallet to pay with NFC, they don’t have Miracast, and Chromecast can supposedly work but I haven’t been able to get it to work. Those are the three major hurdles I’ve found, but getting away from Google was a priority so I’ll live without them.

NFC can have other providers other than Google Wallet, but I haven’t found any that I find trustworthy enough yet. Supposedly the EU is making an alternative.

Those are called Progressive Web Apps (PWA). You can use firefox to add the website to your desktop like this: https://developer.mozilla.org/en-US/docs/Web/Progressive_web_apps/Guides/Installing

Once you do, when you open the app it should have just the website without the tabs and everything else firefox does.

Significantly better than several hours od most of the internet being down.

Breezy Weather

Not affiliated, just discovered this amazing app relatively recently.

Breezy Weather

Breezy Weather

1. This is with systemd-boot, which I switched to because it’s easier to use a unified kernel image with, but it should work just fine with grub as well. The last step will sign everything that needs to be signed, including grub and the kernel images.
2. You only need to trigger a re-sign if you update grub using grub-install. If you just change the grub config, you don’t need to re-sign it because the config is loaded once the signed grub is already booted. This is another reason why I went with systemd-boot and unified kernel images, because I work with sensitive data and maybe I’m a bit too paranoid, and don’t want anyone to be able to tamper with my boot in any way. This is also possible with grub and using an encrypted boot partition, but systemd + UKI + full system encryption was just easier. If you’re not worried about evil maid attacks and just want secure boot, grub will work with no additional setup.
3. No issues with the pacman hook, it triggers every time there’s a kernel update or nvidia update, and since I’m using mkinitcpio and UKI, the signing is usually already done by mkinitcpio before the pacman hook is ran, so the pacman hook doesn’t really ever do anything. It’s all done in the mkinitcpio hook.

As for bricking your motherboard, this only happens if your motherboard or any other component uses the microsoft vendor keys as part of the boot sequence, and it’s only really a hard brick if it’s your motherboard that uses it. If it’s any other component, you can remove it and readd the microsoft keys and it’ll work again when you add the component back.

And the key part here is replacing the platform keys. If you just always use the -m flag on sbctl enroll-keys, you’ll enroll both your own keys and microsoft’s, meaning no replacing necessary. If you always use -m, there’s no real risk really, because you’ll always add the microsoft keys that your hardware might need. Plus, if you’re dual booting with windows, you need the -m to have windows secure boot work, anyway.

If you’re extra paranoid, you can also add the -f option which should also include all the keys that your motherboard comes with by default, if it contains more than just microsoft’s keys, but this shouldn’t really be necessary.

I’m saying this as someone who has a self-signed key + kernel + bootloader + dual boot with windows. I have Arch and I dual boot windows, and the setup was literally three commands.

Enable secure boot setup mode and then do the following:

sbctl create-keys to create the keys

sbctl enroll-keys -m to enroll the keys to BIOS, including microsoft keys

sbctl verify | sed -E 's|^.* (/.+) is not signed$|sbctl sign -s "\1"|e' to sign everything that needs to be signed.

And everything is signed automatically on an update with a pacman hook that comes by default when installing sbctl.

That wiki entry lists all the possible ways to do it, for all combinations of bootloaders and secure boot tools. You only need one of them, for example 3.1.4. which is what I just described.