jrgd

If you're running an email server for more than a handful of persistent users, I'd probably agree. However, there are self-host solutions that do a decent job of being 'all-in-one' (MailU, Mailcow, Docker-Mailserver) that can help perform a lot of input filtering.

If your small org just needs automation emails (summaries, password resets), it's definitely feasible to do actually, as long as you have port 25 available in addition to 465, 587 and you can assign PTR records on reverse DNS. Optionally you should use a common TLD for your domain as it will be less likely to be flagged via SpamAssassin. MXToolbox and Mail-Tester together offer free services to help test the reliability of your email functionality.

I'm currently going through a similar situation at the moment (OPNSense firewall, Traefik reverse proxy). For my solution, I'm going to be trial running the Crowdsec bouncer as a Traefik middleware, but that shouldn't discourage you from using Fail2Ban.

Fail2Ban: you set policies (or use presets) to tempban IPs that match certain heuristic or basic checks.

Crowdsec Bouncer: does fail2ban checks if allowed. Sends anonymous bad behavior reports to their servers and will also ban/captcha check IPs that are found in the aggregate list of current bad actors. Claims to be able to perform more advanced behavior checks and blacklists locally.

If you can help it, I don't necessarily recommend having OPNSense apply the firewall rules via API access from your server. It is technically a vulnerability vector unless you can only allow for creating a certain subset of deny rules. The solution you choose probably shouldn't be allowed to create allow rules on WAN for instance. In most cases, let the reverse proxy perform the traffic filtering if possible.

It doesn't.

The game was under exclusivity contract for Epic Games, but they were still allowed to sell copies of the game on their own website. Now that the contract is up, the game can be sold on Steam. Granting players who bought the game from the website free Steam keys is a nice touch.

In order to maintain software versions, package maintainers will often selectively pull git commits from the upstream projects that fix bugs / vulnerabilities in the code, while not pulling feature commits. Sometimes the pulled commits may need modifications to work properly on an old feature version of the software, which will also be done during the process. Alternatively, a software may be compiled with different feature flags to restrict functionality to mitigate bugs known in upstream.

For desktop/workstation users: the simple answer is just use the flatpak from Flathub or from some other source if you need a user package that doesn't align to the ethos of your chosen distro. In most cases desktop Linux users have gone beyond self-packaging for specific library versions and just use a separate set of common libraries to power application needs beyond the out of box experience of any given distro. It's part of why immutable distros are starting to take off and make more sense for desktop/workstation use-cases.

For servers, it's in the nature to become part of the technical debt you are expected to maintain, and isn't unique among RHEL, OpenSUSE Leap, Debian, Ubuntu, or any other flavor of distro being utilized.

If you're not on RHEL-likes manually installing piles of out-of-tree software or randomly dumping RPMs into your system blindly hoping that things will "just work", all is good on most rpm-based distros (RHEL, Fedora, AlmaLinux, OpenSUSE Leap, etc.). Updates don't have issues and system upgrades (where possible) have had minimal problems within the past few years on all of my systems.

Ocis/OpenCloud can integrate with Collabora, OnlyOffice but don't currently have things like CalDAV, CardDAV, E2EE, Forms, Kanban boards, or other extensible features installable as plugins in Nextcloud.

If you desire a snappy and responsive cloud storage experience and don't particularly need those things integrated into your cloud storage service, then Ocis or OpenCloud might be something to look into.

Given the Linux initramfs targets a block device as a file that then gets mounted as the persistent root filesystem, I don't think it would really be possible to unmount / and replace the location with a file. Root isn't represented as a file or directory in any filesystem structure and is a construct of many Unix and Unix-like kernels.

This is the same for Intel variant Framework boards.

Under what means? The target is public sector and the OS to replace (Windows 10, Windows 11) would be a relatively compatible release target. Fedora is a competent leading edge (Wayland, Pipewire, BTRFS) distro that runs as a 6 month point release. I wouldn't see many reasons to not go with Fedora Workstation as a base unless going for an immutable base or a different core distro (OpenSUSE or Debian mainly).

EDIT: Missed that this is going to be immutabe, so it is likely being based on Fedora Kinoite, meaning there really aren't many alternatives besides OpenSUSE's offerings.

As I understand it, most of the Pebble's OS is currently Open Source. Traditionally, you could download updates and applets, watch faces for your Pebble through it's app, as well has have many phone integrations. Most of the phone integrations can now be done through GadgetBridge and applets downloaded from Rebble.

Given the minimal need for always-online or really much of a internet connection at all beyond what is needed for third-party applets (weather watch faces, etc.), the older Pebble smart watches are able to be made about as private as one could reasonably expect from a Bluetooth wearable.

The two upcoming remakes appear to be basing the mobile app and applet repo upon the Rebble community's work, if not outright using it as the source. If the watches gain GadgetBridge support and/or the companion app is fully open source, I imagine these will be as worthy as the older watches.