spectromas

Threesixes and spectromas, I'd be more than happy to assist with something like this as well. :)
 
Security Blueprints sounds good but what about Security Configuration Guides?
 
It could be good to lay it out in a Defense in Depth matter:
Physical Security
BIOS Configurations
Kernel Configurations
Network Configurations
Application Configurations
Etc, etc.
 
If you really want to kick off some brainstorming and what not please feel free to PM and I can provide some info on my background in relation to this sort of thing.

Would it be good (or relevant at all) to have some mention of whether it is being targeted towards server security or desktop user security?
 
desktop security and server security maybe?

Hi All,
 
If you have installed a new Funtoo Linux system in the last week, you may have noticed something interesting -- /etc/make.conf is EMPTY and eselect profile show shows something new -- a subarch profile:
 
test / # eselect profile show   Currently set profiles:     arch: gentoo:funtoo/1.0/linux-gnu/arch/x86-64bit    build: gentoo:funtoo/1.0/linux-gnu/build/current   flavor: gentoo:funtoo/1.0/linux-gnu/flavor/core  subarch: gentoo:funtoo/1.0/linux-gnu/arch/x86-64bit/subarch/corei7   What's going on? This is part, or maybe culmination of an ongoing effort to simplify /etc/make.conf. While it is still possible to set CFLAGS in /etc/make.conf, by default, these settings are now defined in a subarch profile. By default, new stage3's will have a subarch profile set, but existing Funtoo systems don't need to have one set. If you'd like to set a subarch profile, you can do so by ensuring you have the latest eselect installed and using the "eselect profile set-subarch" command.   What are the benefits of subarch profiles? Of course, the first big benefit is to keep /etc/make.conf clean. Subarch profiles, along with flavors and mix-ins, are designed to help keep /etc/make.conf tidy and only contain the tweaks you personally need for your system. It also assists with Metro, our stage building tool. Metro no longer has to store all the CFLAGS settings for each subarch -- these are now integrated into the Portage tree, in one place. And also, this allows us to fix and improve subarches over time, and you automatically benefit from any improvements with an emerge --sync.   Hope you enjoy the new system,
Daniel

Just wanted to say hello and make a short introduction here. Some people here probably recognize me from #funtoo and my usually semistupid questions and comments there. For those who don't know me, before moving to Funtoo I used SuSe (back when you had to buy it), Gentoo, Arch (jumped ship when systemd because the default init), back to Gentoo, and then to Funtoo.

I've been looking at this again and I think I've found the source of the problem. I came across a bug report which suggested disabling gstreamer in about:config, so I did that and sure enough I had no more problems. The only issue is that I want gstreamer support.
 
This is the report, the last post is exactly what happens to me as well:
https://bugzilla.mozilla.org/show_bug.cgi?id=935458
 
I've narrowed it down to gstreamer and the gst-plugins, in particular media-plugins/gst-plugins-ffmpeg. I was using this, along with a couple of others, as an alternative to flash for sites like soundcloud. As a course of trying to get the exact problem causing package I have added an removed practically all the gst plugins, both 0.x and 1.x. I found that while sites like soundcloud do work with media-plugins/gst-plugins-ffmpeg installed, gmail's chat has a problem with it and causes the whole browser to not terminate after being closed.
 
I found this http://gstreamer.freedesktop.org/src/gst-ffmpeg/gst-ffmpeg-1.x-README.txt
 
 
 
So would it be that firefox it probably build against a version that uses libav? Would this be considered a bug as far as funtoo's adoption of ffmpeg?
 
This is pretty annoying, it means I either have to compile firefox myself or use the bin version with flash, which I would prefer not to do.
 
 
 
 
edit: finally solved it. The bin version of firefox uses the 0.10.x versions of the gst-plugins. With good, bad and ugly 0.10.x versions installed gst-plugins-ffmpeg doesn't cause gmail to hang and gst-plugins-mad allows sites like soundcloud and bandcamp to work. I'm sure I did try this along the way but something must have been missing.

Hello good people!
 
I signed up here a while ago, but have only been lurking, as I hadn't yet ventured into installing Funtoo. I finally took the plunge yesterday at work, and started to install Funtoo on an old AMD Athlon 2000 XP desktop machine (768MB RAM, 80GB HDD!), to familiarize myself with the process, to eventually install on my own Core2 Duo desktop.
 
Linux kernel 3.16.2 was still building when I left for the weekend, so hopefully on Monday I will return and finish the process.
 
Oh, as background: I have been using Linux since about 1999. I think my first was RedHat (pre-Fedora). Ran Debian for a long time. Eventually moved to Slackware, and have been a happy slacker ever since, but I really wanted to delve into the source-based world of either Gentoo, Funtoo, or CRUX. So I decided on Funtoo, mostly because it seems like "Gentoo-improved," has a smaller community forum (Gentoo's is huge, CRUX is mailing-list only), and seems determined to avoid the "systemd takeover" of Linux.
 
I imagine I will have some questions along the way, but I will cross that bridge when I come to it.

In the case you  don't set  the use flags related to processor's instructions sets, the softwares you will compile will simply not take any advantage of built-in CPU hardware support for some of their operations.  However not all packages but multimedia stuff (typical case) make use of enhanced processor instructions. If you want to check what package use what flag equery h will tell:
# equery h mmx * Searching for USE flag mmx ... [IP-] [ ] media-libs/smpeg-0.4.4-r10:0 [IP-] [ ] media-sound/lame-3.99.5-r1:0 [IP-] [ ] media-video/mjpegtools-2.1.0-r2:1 To answer your question: you SHOULD enable support for CPU's enhanced instructions, unless you have a good reason to leave it disabled (i.e. known bug, strange crash....)
 
However to bring a bit of nuance: a use flag is simply a handle given to you by an ebuild developer to enable/disable some features at compilation time, not having a use flag in a ebuild is not a warranty that the software will not include some CPU special instructions in its binary code.

IMHO it would be wise to use portage's news feature for something like this.  I just happened to come here and find it, but it would have been useful to see a new news item was available after syncing and then view it with `eselect news read`.
 
Or has the news feature been deprecated?

Lots of news here -- enjoy!
 
http://www.funtoo.org/News:Newsletter,_Volume_1
 
-Daniel

My computer boots faster with openrc than it ever did with systemd. Somehow I get the feeling you want a 46 page flame debate though. 

Wow, sounds perfect!