You can get back Apollo for Reddit, a ReVanced equivalent for YouTube, Minecraft Java Edition, and much more. Even Fortnite.

Apple allows developers to sideload apps for development and testing purposes. If you pay for a developer account, you get to sideload as much as you want. If not, you’re limited to 3 sideloaded apps per Apple ID (it doesn’t stack up with multiple accounts on the same device). Developer accounts cost $100/year, but there is a much cheaper way around this.

The official Apple way of doing this is with Xcode. For Apple Watch and Vision Pro, this is also the only way. But for iPhones, iPads, and Apple TVs, there are tools and apps that make this process a whole lot easier.

I won’t be providing step-by-step instructions; that will make this post several times bigger. I’ll list out all your options and link to all the relevant documentation and instructions.

The Free Route

If you’re not going to sideload more than three apps, you can use this method. You have two options here: you can either trade one app slot for convenience, or you can sideload three different apps but deal with the additional complexity.

When sideloading with this method, you have to deal with a concept called “refreshing” your apps. Apps sideloaded with free developer accounts need to be resigned every 7 days. If you’re willing to sacrifice one app slot, you can refresh your sideloaded apps on-device.

The first option is SideStore, a fork of AltStore. It can be used on iOS and iPadOS. The difference between SideStore and AltStore is that SideStore only requires computer access for the initial setup. It handles installing, updating, and refreshing, all on-device. They have excellent, detailed documentation explaining every step.

The second option is Sideloadly. Sideloadly is more powerful, but you need a computer to install, update and refresh apps. It supports sideloading to iOS, iPadOS, tvOS and Apple Silicon Macs. You get to keep all three free slots with this option.

The Paid Route

If you don’t want to spend $100/year for a developer account, you can purchase signing certificates from third party services. These services buy developer accounts from Apple and set everything up. Each developer account has 100 slots. Each slot gets a developer certificate that can be used to sign apps. When you purchase from them, you’re basically purchasing one individual slot. I use AppTesters and I can vouch for them. You can also check out KravaSign (previously MapleSign) and Signulous.

While it’s pretty rare, Apple has revoked some of these services’ developer accounts in the past. All the above mentioned services have a track record of issuing new certificates for free in these rare instances. Just check if the service offers “revoke protection” before buying.

Once you have your certificate (either directly from Apple or from a third party service), you can then use Feather or ESign to sideload apps. Feather is a new and open source app. ESign is a closed source Chinese app, but it’s stable and feature-complete. I know the choice is obvious, but Feather is extremely new, so you might have to use ESign if Feather doesn’t play well with something.

To install Feather/ESign, you can use Sideloadly with your developer certificate. There are online IPA signers as well, like AppTesters’ Signer and KravaSigner. These let you sign and install IPAs from your device’s browser. Of course, you can install ESign using Feather and vice versa.

AppTesters has video instructions on installing and setting up ESign, which you can find here. You can follow the same process for installing Feather. Note that if you want notifications support on Feather, you have to disable “PPQCheck Protections” in Feather’s settings. It’s not as bad as the app says; no other signing app has this protection. Notifications work out of the box on ESign.

To install apps on iOS 18, you need to use the online install option on Feather and the WiFi option on ESign.

Apps and Tweaks

The equivalent of Android’s APKs on iOS are IPAs. To get a usable decrypted IPA, you’ll need a jailbroken device. Fortunately for us, there are places where we can get decrypted IPAs. AppTesters host a Telegram bot that you can access here. You can also use decrypt.day and armconverter. Once you have a decrypted IPA, you can sideload it as it is or inject tweaks into it. Tweaks are like ReVanced patches.

Here are some apps/tweaks to get you started:

• Apollo for Reddit
• YouTube Plus
• BHTwitter and FuckElon
• EeveeSpotify
• SCInsta (free) and Regram (paid)
• Bunny (Discord)
• PojavLauncher (check the “Sideloading (Jailed)” section)
• Aidoku
• Ferrite

Everything listed above is open source (except Regram).

Related Communities

I strongly recommend joining these communities to get updates and news. You can discover a lot of cool apps to sideload too.

• AppTesters Telegram group
• KravaSign Discord server
• r/sideloaded

Non-Root User

If you’re using a VPS, the default user will be root. The principle of least privilege is a security concept where each entity only has access to what it needs. To abide by this concept, we need to set up a non-root user.

To add a new non-root user, run the following command as root:

adduser <user>

You can leave all the information empty. I recommend using a randomly generated passphrase; it’s easier to remember and type.

To give the new user rights to use sudo, run the following command as root:

usermod --append --groups sudo <user>

You can now log out and log back in as the new user.

For added security, you can set root’s shell to nologin and lock the account. Run the following command:

sudo usermod root --shell /sbin/nologin
sudo passwd --lock root

If you need a root shell, you can use sudo -s. su or sudo -i won’t work anymore.

System User

System users are special user accounts created for running applications. This way, the application will only have access to what it needs. For instance, web servers run under www-data and Docker runs under docker.

To create a system user, run the following command:

sudo adduser --system --home <path> --shell /sbin/nologin --group <user>

If you don’t want the user to have a home directory, you can remove that argument. If you need shell access, you can run sudo -u <user> bash.

Let’s say I want to run an example application called app on my server. Here’s how I would do it:

sudo adduser --system --home /opt/app --shell /sbin/nologin --group app

Then I’ll get a shell as app using sudo -u app bash and run the following:

cd ~
git clone app
exit

I’ve downloaded the app. Now I’ll set up a systemd service for the app by creating /etc/systemd/system/app.service:

[Unit]
Description=App

[Service]
User=app
Group=app
Type=simple
Restart=always
ExecStart=/opt/app/run.sh --db=/opt/app/db.sqlite3

[Install]
WantedBy=multi-user.target

Note the User and Group entries under [Service]. This will run the service as our system user app. Now, I can run sudo systemctl enable --now app.service to enable and start the application. Neat! You can apply this example to any application you want to run.

SSH

Follow the SSH Hardening Guide. It ensures that only strong algorithms are used for encryption. I do this on all my machines, both clients and servers. You can skip the “connection rate throttling” section, we’ll be setting up Fail2Ban to handle that.

Generate an Ed25519 key (passphrase is optional but recommended):

ssh-keygen -t ed25519

Copy the key to your server:

ssh-copy-id -i <path-to-key> <user>@<ip>

Paste the following at the end of /etc/ssh/sshd_config on your server:

Protocol 2
MaxAuthTries 3
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AuthenticationMethods publickey
KbdInteractiveAuthentication no
X11Forwarding no

The above snippet does a few things. It disables the old protocol 1 and enforces protocol 2 for increased security. It prevents login attempts to root. Everything other than key-based authentication is disabled. X11 forwarding is also disabled; you’ll know it if you need it.

You can change the SSH port to a random number in the same file. Finally, run the following command to restart the SSH daemon:

sudo systemctl restart ssh

Firewall

Make sure the required packages are installed:

sudo apt install iptables ipset ufw cron curl wget rsyslog -y

Allow the SSH port and enable UFW:

sudo ufw allow <port>/tcp comment "OpenSSH"
sudo ufw enable

If you’re using Docker, we need to make some changes to the UFW config to ensure UFW works as intended. Explanation and instructions are given in this GitHub repo (thanks to u/s0ftcorn).

I also like to disable UFW logging. Do not do this unless you know what you’re doing:

sudo ufw logging off
echo "& stop" | sudo tee --append /etc/rsyslog.d/20-ufw.conf
sudo systemctl restart rsyslog

Next up, we’ll be blocking known bad IPs. CrowdSec is complicated to set up, wastes resources, requires an account, and in my opinion, overkill. Instead, we’ll just stick to a simple bash script and a cronjob.

IPsum is a regularly updated list of malicious IPs, this is what we’re going to use. The script we’ll be using is from arter97.

Download the script and run it once:

sudo wget https://gist.githubusercontent.com/arter97/2b71e193700ab002c75d1e5a0e7da6dc/raw/firewall.sh -O /opt/firewall.sh
sudo chmod 755 /opt/firewall.sh
sudo /opt/firewall.sh

Check the output of sudo dmesg to verify that everything is working. Add a cronjob by running sudo crontab -e and paste the following:

@reboot /opt/firewall.sh
0 5 * * * /opt/firewall.sh

Nginx

Nginx is my preferred reverse-proxy. There are a few things you can configure to improve security.

Add the following lines to your server blocks:

add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Frame-Options "SAMEORIGIN" always;

The above snippet sets some headers to prevent certain attacks. The first header prevents MIME sniffing attacks, the second header prevents cross-site scripting attacks, and the third header prevents your site from being embedded in another domain, preventing clickjacking attacks.

Nginx Proxy Manager (not to be confused with Nginx) has a feature called “block common exploits”, which blocks SQL injection attacks, file injection attacks, and more. To implement it in Nginx, download the config file:

sudo wget https://raw.githubusercontent.com/NginxProxyManager/nginx-proxy-manager/develop/docker/rootfs/etc/nginx/conf.d/include/block-exploits.conf -O /etc/nginx/block-exploits.conf

Then add the following line to your server blocks:

include block-exploits.conf

To avoid getting indexed by search engines, add the following lines to your server blocks:

add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive" always;
location /robots.txt { return 200 "User-agent: *\nDisallow: /\n"; }

To prevent referrer info being sent to external sites, add the following line to your server block:

add_header Referrer-Policy "same-origin" always;

I suggest configuring CSP (Content Security Policy) and HSTS (HTTP Strict Transport Security) as well. CSP declares which external resources are allowed to be loaded, you can find the documentation here. HSTS instructs the browser to only allow HTTPS connections; MDN has good documentation here.

Keep in mind that inheritance works differently in Nginx for array directives such as add_header and proxy_set_header. If you have any array directives in the block above, you need to re-add them in the current block.

Incorrect config:

# Incorrect
http {
  add_header X-Header-1 "";

  server {
    add_header X-Header-2 "";

    location / {
      proxy_pass http://localhost:8080/;
      add_header X-Header-3 "";
    }
  }
}

Correct config:

# Correct
http {
  add_header X-Header-1 "";

  server {
    add_header X-Header-1 "";
    add_header X-Header-2 "";

    location / {
      proxy_pass http://localhost:8080/;
      add_header X-Header-1 "";
      add_header X-Header-2 "";
      add_header X-Header-3 "";
    }
  }
}

Fail2Ban

Install Fail2Ban and dependencies:

sudo apt install fail2ban rsyslog -y

Do not copy /etc/fail2ban/jail.conf to /etc/fail2ban/jail.local. Most guides I’ve seen suggest doing this, but this isn’t the right way. Create /etc/fail2ban/jail.local with the following contents:

[DEFAULT]
bantime = 1d
findtime = 15m
maxretry = 3
backend = auto

[sshd]
port = <port>

SSH is the only jail enabled by default, so we just need to give it the correct port.

Fail2Ban ships with some pre-configured jails for Nginx, which you can enable by adding the following to /etc/fail2ban/jail.local:

[nginx-http-auth]
enabled = true
mode    = aggressive

[nginx-bad-request]
enabled = true

[nginx-botsearch]
enabled = true

The HTTP auth jail filters incorrect login attempts to Nginx’s basic auth. Bad request jail filters, well, bad requests (400 error). Botsearch jail filters requests for certain URLs if they don’t exist (such as /wp-login, /admin).

To make sure that the IPs are the real IPs of the end user, add the following line to your Nginx location blocks:

include proxy_params;

LinuxServer’s SWAG has some additional Fail2Ban configs for Nginx. If you’d like to add those, run the following commands:

sudo wget https://raw.githubusercontent.com/linuxserver/docker-swag/master/root/defaults/fail2ban/filter.d/nginx-badbots.conf -O /etc/fail2ban/filter.d/nginx-badbots.local
sudo wget https://raw.githubusercontent.com/linuxserver/docker-swag/master/root/defaults/fail2ban/filter.d/nginx-deny.conf -O /etc/fail2ban/filter.d/nginx-deny.local
sudo wget https://raw.githubusercontent.com/linuxserver/docker-swag/master/root/defaults/fail2ban/filter.d/nginx-unauthorized.conf -O /etc/fail2ban/filter.d/nginx-unauthorized.local

Then add the following lines to /etc/fail2ban/jail.local:

[nginx-badbots]
enabled  = true
port     = http,https
filter   = nginx-badbots
logpath  = %(nginx_access_log)s

[nginx-deny]
enabled  = true
port     = http,https
filter   = nginx-deny
logpath  = %(nginx_error_log)s

[nginx-unauthorized]
enabled  = true
port     = http,https
filter   = nginx-unauthorized
logpath  = %(nginx_access_log)s

Badbots jail filters known bad bots by their user-agents. Deny jail filters requests that you’ve blocked in your Nginx config. Unauthorized jail filters, well, unauthorized requests (401 error).

Cloudflare

If you’re using Cloudflare proxy, we need to do a bit more so that Fail2Ban bans the end user’s IP and not Cloudflare IPs. Follow my blog post on setting up Fail2Ban With Nginx and Cloudflare Free. For all Nginx jails, you should be using the same action as the ones in that post.

CIS Benchmarks

CIS benchmarks are configuration recommendations and best practices to harden and protect your servers. They provide benchmarks for operating systems, cloud providers, and several applications like Docker and Nginx. You can download their benchmarks here. Applying their level 1 profiles is good enough for most.

Ubuntu Pro users can use the Ubuntu Security Guide tool to audit and apply CIS and DISA-STIG (security guidelines from the U.S. Department of Defense) profiles automatically. For Debian, OVHCloud maintains scripts that you can use. You can find the scripts and instructions in this GitHub repo.

Ensure you don’t blindly apply everything. Go through each and every configuration.

That pretty much covers it. Just make sure you’re using strong and random passwords/passphrases for everything.

If you have any comments or suggestions, feel free to mail me!

Changelog

• 10 Sep 24: Added system account section, additional Nginx headers, and rsyslog dependency to firewall and Fail2Ban sections
• 09 Sep 24: Added CIS benchmarks section
• 06 Sep 24: Added passwd --lock and expanded snippet to disable UFW syslog spam
• 30 Aug 24: Added basic explanations
• 29 Aug 24: Added info about UFW and Docker
• 29 Aug 24: Added nologin setup for root

Unmask Visitor IP in Nginx

Nginx needs to know the visitor’s real IP for the ban to work. Without this step, Nginx will simply see Cloudflare IPs and let it through. Even if you’re not going to use Fail2Ban, you should set this up.

Make sure jq and crontab are installed in your system. We’ll be using a cronjob to fetch Cloudflare IPs and Nginx’s ngx_http_realip_module to unmask the IPs. The script we’re using is from this GitHub repo.

Place the script somewhere on your system. I have it in /opt/scripts/cloudflare.sh.

#!/bin/bash

cf_ips="$(curl -fsLm2 --retry 1 https://api.cloudflare.com/client/v4/ips)"
CLOUDFLARE_FILE_PATH=${1:-/etc/nginx/cloudflare}

echo "# Cloudflare IP Ranges" > $CLOUDFLARE_FILE_PATH
echo "" >> $CLOUDFLARE_FILE_PATH
echo "# - IPv4" >> $CLOUDFLARE_FILE_PATH
for ipv4 in $(echo "$cf_ips" | jq -r '.result.ipv4_cidrs[]//""' | sort); do
    echo "set_real_ip_from $ipv4;" >> $CLOUDFLARE_FILE_PATH
done
echo "" >> $CLOUDFLARE_FILE_PATH

echo "# - IPv6" >> $CLOUDFLARE_FILE_PATH
for ipv6 in $(echo "$cf_ips" | jq -r '.result.ipv6_cidrs[]//""' | sort); do
    echo "set_real_ip_from $ipv6;" >> $CLOUDFLARE_FILE_PATH
done
echo "" >> $CLOUDFLARE_FILE_PATH

echo "real_ip_header CF-Connecting-IP;" >> $CLOUDFLARE_FILE_PATH

nginx -t && systemctl reload nginx

Make sure the file permissions are set to 755 (sudo chmod 755 /opt/scripts/cloudflare.sh).

Add the following cronjob using sudo crontab -e:

# Sync Cloudflare IPs and reload Nginx
0 4 * * * /opt/scripts/cloudflare.sh >/dev/null 2>&1

Add this line to the http block in your Nginx config /etc/nginx/nginx.conf:

include /etc/nginx/cloudflare;

Now for every service you’re reverse-proxying, add this line inside location in the server block:

include proxy_params;

Run sudo nginx -t to verify the config, and reload the config using sudo systemctl reload nginx. Nginx will now unmask the visitors’ real IP coming through Cloudflare proxy.

Setup Cloudflare

Free Cloudflare accounts are limited to 5 WAF rules per zone. But Cloudflare offers one free custom list that can store 10,000 IPs. This is more than enough.

Start by creating a custom list. Follow these instructions. You can name it whatever you want. Make sure “Type” is set to “IP”. Select “Create” and check the URL. It will be in the following format: https://dash.cloudflare.com/<account-id>/configurations/lists/<list-id>/add. Note down the values in account-id and list-id, we’ll be using this later.

We also need an API token to edit this list. Follow these instructions. We’ll be using a custom token. Set the permissions to “Account”, “Account Filter Lists”, and “Edit”. Note down the API token.

Next up, create a WAF rule. Follow these instructions. Set “Field” to “IP Source Address” and “Operator” to “is in list”. Your list should automatically be selected. Set “Action” to “Block” and “Order” to “First”. That’s your Cloudflare setup done!

Setup Fail2Ban

Make sure jp is installed in your system.

The action we’re going to be using is from @sebres. This supports both IPv4 and IPv6 addresses. Create /etc/fail2ban/action.d/cloudflare-list.conf with the following contents:

[Definition]
actionban = curl -s -o /dev/null -X POST <_cf_api_prms> \
                 -d '[{"ip":"'"<cfip>"'","comment":"Created by fail2ban <name>"}]' \
                 <_cf_api_url>
actionunban = id=$(curl -s -X GET <_cf_api_prms> \
                   "<_cf_api_url>?search=<cfip>&per_page=1" \
                   | { jp --unquoted 'result[0].id | not_null(@, `""`)' 2>/dev/null; })
              if [ -z "$id" ]; then echo "<name>: id for <ip> cannot be found"; exit 0; fi;
              curl -s -o /dev/null -X DELETE <_cf_api_prms> \
                   -d '{"items":[{"id":"'"$id"'"}]}' \
                   <_cf_api_url>
_cf_api_url = https://api.cloudflare.com/client/v4/accounts/<cfaccountid>/rules/lists/<cfbanlistid>/items
_cf_api_prms = -H 'Authorization: bearer <cfapitoken>' -H 'Content-Type: application/json'

[Init]
cfip = <ip>

[Init?family=inet6]
cfip = $(fail2ban-python -c 'import sys; from fail2ban.server.ipdns import IPAddr; a = IPAddr(sys.argv[1]+"/"+sys.argv[2]); print(str(a))' "<ip>" 64)

Now create /etc/fail2ban/action.d/cloudflare-list.local with the following contents:

[Init]
cfapitoken = <api-token>
cfaccountid = <account-id>
cfbanlistid = <list-id>

Fill in the details, and make sure you set the file’s permissions to 640 (sudo chmod 640 /etc/fail2ban/action.d/cloudflare-list.local) to ensure only root can read this file.

Let’s configure Fail2Ban for Vaultwarden. Enable logging in Vaultwarden. Create /etc/fail2ban/filter.d/vaultwarden.local with the following contents:

[INCLUDES]
before = common.conf

[Definition]
failregex = ^.*?Username or password is incorrect\. Try again\. IP: <ADDR>\. Username:.*$
ignoreregex =

Now create /etc/fail2ban/jail.d/vaultwarden.local with the following contents:

[vaultwarden]
enabled = true
filter = vaultwarden
backend = auto
logpath = <path/to/vaultwarden.log>
action = cloudflare-list
         nginx-block-map
maxretry = 3
bantime = 1d
findtime = 15m

Depending on your config, you might want to set chain = FORWARD. Note that we’re not banning the IP using firewall rules, because we’ll be receiving requests from Cloudflare’s IPs.

Setup Nginx

Add the following line to the http block in your main Nginx config (/etc/nginx/nginx.conf):

map $remote_addr $ip_blacklisted { include blacklisted-sessions.map; }

Add the following line to the server block of services you’re reverse-proxying:

if ($ip_blacklisted) { return 444; }

The non-standard return code 444 closes a connection without sending a response header. You can also return 403 if you like.

Test Your Config

To verify if everything is working, go to your Vaultwarden instance and try logging in with incorrect credentials 3 times. Check /var/log/fail2ban.log (sudo tail -f /var/log/fail2ban.log), it should say that your IP has been banned. Without reloading your Vaultwarden web vault page, try logging in with the correct credentials. It won’t work, as Nginx will only return 403. If you reload the page, Cloudflare will say you’ve been banned. To unban yourself, run sudo fail2ban-client set vaultwarden unbanip <banned-ip>. Congrats! You have secured your Vaultwarden instance with two layers of protection using Fail2Ban.

After years of using Arch Linux, I’ve settled on Ubuntu. And I think you should too. “But snap bad! Canonical bad! Ubuntu is for noobs!” I don’t like snaps either, and guess what? It takes all of 60 seconds to remove it entirely. That’s a hell of a lot quicker than setting up Arch. Most people hating on Ubuntu have not used it in a long time. Everyone I’ve talked to has no solid arguments against Ubuntu other than the above. Let’s see if Ubuntu really is as horrible as it’s made out to be.

How I Ended Up on Ubuntu

I’m tired of going to the Arch Wiki every time I need something. It was fun to tinker with my OS all day long when I was younger, but now I need something that works out of the box. I want my OS to get out of the way, and Arch got in my way one too many times. I moved to Windows 11 for 6 months and gave up after it started slowing down and heating up (as always). I decided to go back to Linux, but I needed something that just works.

Arch and derivatives (the only good one is EndeavourOS) were out of the question immediately. I also decided not to use niche distros like openSUSE for the same reason. My first choice was Fedora. DNF is terrible but I still considered it, right up until I learnt that hardware acceleration is not a thing anymore OOTB. Instant pass. Pop!_OS has been focused on COSMIC for a while, so that’s a no-go for now. Linux Mint is great, but I wanted newer packages and a modern DE that supports Wayland (GNOME). I have a multi-monitor setup with different refresh rates, and Wayland handles it well.

Then I remembered Ubuntu existed. The last time I used Ubuntu was when Canonical sent free CDs. I read about snaps being bad all the time, but apart from that, I didn’t remember any other criticism. Might as well give it a try, right? Surely it can’t be that bad. And boy oh boy, it was much better than I was expecting.

The Ubuntu Experience

Right off the bat, the installation process was a breeze. I only had to tick a box for NVIDIA drivers to be set up. The same goes for codecs and hardware acceleration. I restarted after the setup and everything just worked! I was genuinely surprised. Literally everything just worked, I didn’t have to do anything.

I removed snapd because I prefer native packages. I found out that a lot of popular software like Firefox, Chrome, VSCode, Spotify, Discord, etc. provide official native packages/repos for Ubuntu. This is a huge win in my book. Proprietary software like this is usually only available through containerised package formats like Snaps/Flatpak or some random source (like the AUR).

If you don’t like Ubuntu’s customised GNOME, you can simply install gnome-session and switch to vanilla GNOME from the display manager. If you don’t like GNOME itself, you have several Ubuntu spins such as Kubuntu for KDE, Xubuntu for XFCE, etc. If you want to optimise Ubuntu further, check out my blog post.

What can I say? It’s fast, it just works, and it’s widely supported. It’s a boring distro. Boring is good.

Why the Hate?

First off, I strongly believe Ubuntu gets hated on so much because of how popular it is. The other arguments are just excuses. I’ll get to the other issues but I’ll address this first. This is a trend I’ve seen with GnOo/LinUx users, they feel the need to use increasingly niche tools just to feel better about themselves. Using Gentoo with an obscure window manager and Neovim won’t improve the quality of your work whatsoever. The tools you use don’t make you stand out, the work you do with them does.

The next big reason is muh bloat. Ubuntu offers several spins, and all of them have a minimal install option that comes with only the necessary programs. A minimal install of Ubuntu 24.04 takes up less than 800MB of RAM; Xubuntu 24.04, less than 500MB. Ubuntu is on par with, if not lighter than Linux Mint. It’s 2024, 8GB RAM has become the norm. Stop obsessing over saving a couple hundred megabytes of RAM. Unused RAM is wasted RAM. And honestly, CPU usage at idle is a much more important metric if you want to measure “bloat”.

“But snaps are slow and horrible!” If you don’t want snaps on your system, you can just remove it in a minute. It’s that easy. I removed it as well, not because I hate snaps in particular, but because I don’t like containerised package formats in general. Installing Flatpak is also trivial if you need it, but if your main complaint about snaps is its speed, stick to native packages.

If you genuinely have a reason to not use Ubuntu other than these, such as something not working or you or you needing a slower/faster release cycle, then this post wasn’t meant for you. This is for GnOo/LiNuX users who hate popular things because they think it’s cool.

Why You Should Use Ubuntu

Because it just works!

No other distro configures drivers and hardware acceleration properly out of the box. Doing this manually can be a pain even for long-time Linux users. Ubuntu (and by extension, Linux Mint) does this very well. The only thing holding me back from using Linux Mint is GNOME. I love GNOME. I think its the most polished desktop experience you can get on Linux (I can feel KrashDE users getting angry :P). Ubuntu offers spins for pretty much all DEs.

Support is amazing. I can simply Google a problem and find step-by-step instructions specifically for Ubuntu.

A lot of big software offer official native packages for Ubuntu. Since I dislike containerised package formats, previously my only choice was to use the AUR and trust the -bin package maintainers. Now I can just use official packages! Fun fact, a lot of the -bin packages in AUR just convert Ubuntu debs to Arch Linux pkgs.

Ubuntu offers full secure boot support, even when using NVIDIA. You can dual-boot with Windows and play your favourite game with kernel-level rootkit anti-cheat!

I’d much rather go with Ubuntu and remove one or two components I don’t like, than go with some other distro and spend hours fixing missing/misconfigured basic functionality.

The End

There is value in the default experience. And I believe that Ubuntu does it the best among all Linux distros. If you’re suggesting Linux for casual users, suggest Linux Mint or Ubuntu. Don’t overwhelm people with the paradox of choice.

Requirements

• ONU
• Router
• VLAN ID
• PPPoE username (password is always password)

The ONU must be TEC-certified. A list of TEC-certified products can be found at the MTCTE Portal. If you really don’t want to go that route, you can spoof your MAC address to match a TEC-certified ONU. I had a BSNL-provided combo device, so I spoofed my MAC to that. You can also use a TEC-certified combo device with another router by using bridge mode. You can find instructions in this Reddit post.

If you have a GPON connection, you’ll also need the serial number of your BSNL combo device.

I have a TP-Link XZ000-G7 XPON ONU and a TP-Link Archer C6 AC1200 Router. I’ve provided step-by-step instructions for these devices, but the configuration is the same for any ONU and router. You just have to find where each setting is located.

ONU Configuration

Connect to your ONU using an ethernet cable. The TP-Link ONU doesn’t have a DHCP server by default, so you’ll have to configure IP assignment manually. Follow these instructions for Windows. On Linux, you can do this from NetworkManager settings.

Now go to 192.168.1.1, set a password for your ONU, and log in. Go to Advanced, Network, and select VLAN Settings. Set “VLAN mode” to “VLAN TAG mode”, enter your VLAN ID, and set “Priority” to 1. You can also turn on the DHCP server if you want easier access to your ONU in the future. You can now disconnect the ethernet and connect your ONU to the router.

If you have a GPON connection, go to XPON Settings and set serial number type to ASCII+HEX, then enter your BSNL router’s serial number. Set the password to 1234567890.

Router Configuration

Connect to the router using ethernet or Wi-Fi. TP-Link also has an app to configure routers, you can use it if you like. Go to 192.168.0.1 and go through the setup process. Set your connection type to PPPoE and enter your PPPoE username and password (password is password). If you’re migrating from another router, you’ll need to change your new router’s MAC address to the old one. Go to Advanced, Network, Internet, set “Router MAC Address” to “Use Custom MAC Address”, then enter your old MAC address. Finally, you need to configure MTU. Go to Advanced, Network, Internet, Advanced Settings, and change your MTU value to 1492. BSNL caps MTU to 1492 across India.

Depending on your area, you might get IPv6 support. You can use the same PPPoE credentials for IPv6 as well.

Support

If you have any problems or questions, check out the India Broadband Forum or the BSNL Telegram group.

Most Firefox guides out there recommend using hardened configs or forks. The only thing they harden is your life. I want to get shit done, not fumble around with my settings trying to unbreak a site every 30 seconds. My configuration is the middle ground, where your browser protects your privacy and your sanity.

Settings

General

• Use autoscrolling: On
• Recommend extensions as you browse: Off
• Recommend features as you browse: Off
• Ask whether to open or save files: On¹

Home

• Sponsored shortcuts: Off
• Recommended Stories: Off

Privacy and Security

• Enhanced Tracking Protection: Strict
• Allow Firefox to make personalized extension recommendations: Off
• Enable HTTPS-Only Mode in all windows: On
• DNS over HTTPS: Max Protection²

Extensions

uBlock Origin is the best ad blocker. I enable additional filter lists: everything under “Cookie notices” and everything under “Annoyances”. I also add the I don’t care about cookies filter list (no need to install the extension).

Dark Reader adds a dark mode to every website. After installing it, open the extension menu, go to “Dev Tools”, “Advanced”, and click “Preview new design”.

Bypass Paywalls Clean lets you bypass most of the popular paywalled sites and sites that need you to login after viewing a page or two (like Quora). After installing it, go to the extension options and enable “Check for update rules at startup”. Then go to “Opt-in” and enable everything.

Violentmonkey is a userscript manager, which I use to install the following userscripts. Bypass All Shortlinks Debloated automatically skips a lot of link shorteners that make you wait or require CAPTCHAs.

No Google Search Translation disables the annoying Google feature that translates all search results.

Most Recent Tab adds a shortcut to switch to the, well, most recent tab. After installing, you can go to Manage Extensions, click the settings icon, go to Manage Extension Shortcuts, and set the shortcut to what you want. I have mine set to Ctrl + Q.

Enforce Browser Fonts lets you disable web fonts and use the browser configured fonts (related blog post). You can change the default mode to whitelist or blacklist in the Manage Extension page.

Imagus Mod is a continuation of the Imagus mod. It enlarges media on hover. After installing it, go to the extension’s settings, sieve tab, click the remove all button, click the update sieve button, then save. I also set it so that it only triggers if Ctrl is pressed.

Dictionary Anywhere shows you the definition when you double-click a word.

about:config

Setting accessibility.force_disabled to 1 in helps with memory usage and performance.

To disable fullscreen fade animations, set full-screen-api.transition-duration.enter and full-screen-api.transition-duration.leave to 0 0.

To disable fullscreen warnings, set full-screen-api.warning.timeout to 0.

If you don’t use Pocket, you can disable it by setting extensions.pocket.enabled to false.

If you want to switch tabs by scrolling on the tab bar, set toolkit.tabbox.switchByScrolling to true.

If you want to reduce spacing in the UI, enable compact mode.

Sync about:config Tweaks

Firefox lets you sync custom preferences. Let’s take accessibility.force_disabled as an example. Prepend the preference with services.sync.prefs.sync. so that it becomes services.sync.prefs.sync.accessibility.force_disabled. Paste it in the search box, add it as a boolean, and set it to true.

Thoughts on Telemetry

I’ve left telemetry on, and you should consider the same for FOSS applications. This helps the developers improve their applications. Remember: telemetry is not inherently evil, privacy-invasive telemetry is. You can visit about:telemetry in Firefox to view all the telemetry being sent.

Changelog

Note: Changes made before 25 Sep 24 are not covered.

• Added Imagus Mod and Dictionary Anywhere extensions, added tweak to disable fullscreen warning

Footnotes

Page 154

Paul had always said that stasis was the most dangerous of those things which were not natural. The only permanence was fluid. Change was all that mattered.

Page 158

“A large populace held in check by a small but powerful force is quite a common situation in our universe. And we know the major conditions wherein this large populace may turn upon its keepers— “One: When they find a leader. This is the most volatile threat to the powerful; they must retain control of leaders. “Two: When the populace recognizes its chains. Keep the populace blind and unquestioning. “Three: When the populace perceives a hope of escape from bondage. They must never even believe that escape is possible!”

Page 171

“The past may show the right way to behave if you live in the past, Stil, but circumstances change.”

Page 198

“To suspect your own mortality is to know the beginning of terror; to learn irrefutably that you are mortal is to know the end of terror.”

Page 247

When I am weaker than you, I ask you for freedom because that is according to your principles; when I am stronger than you, I take away your freedom because that is according to my principles.

Page 267

The universe is just there; that’s the only way a Fedaykin can view it and remain the master of his senses. The universe neither threatens nor promises. It holds things beyond our sway: the fall of a meteor, the eruption of a spiceblow, growing old and dying. These are the realities of this universe and they must be faced regardless of how you feel about them. You cannot fend off such realities with words. They will come at you in their own wordless way and then, then you will understand what is meant by “life and death.” Understanding this, you will be filled with joy.

Page 284

Governments, if they endure, always tend increasingly toward aristocratic forms. No government in history has been known to evade this pattern. And as the aristocracy develops, government tends more and more to act exclusively in the interests of the ruling class—whether that class be hereditary royalty, oligarchs of financial empires, or entrenched bureaucracy.

Page 295

He was a mind-slaver and his enslaving process could be understood with extreme simplicity: he transferred technical knowledge without a transfer of values.

Page 365

If you believe certain words, you believe their hidden arguments. When you believe something is right or wrong, true or false, you believe the assumptions in the words which express the arguments. Such assumptions are often full of holes, but remain most precious to the convinced.

Page 402

There’s no mystery about a human life. It’s not a problem to be solved, but a reality to be experienced.

Page 457

The patterns could guide and they could trap. One had to remember that patterns change.

Page 568

The child who refuses to travel in the father’s harness, this is the symbol of man’s most unique capability. “I do not have to be what my father was. I do not have to obey my father’s rules or even believe everything he believed. It is my strength as a human that I can make my own choices of what to believe and what not to believe, of what to be and what not to be.”

Page 596

I command you to carry it always next to your heart as a reminder that all humans are prone to error and all leaders are human.

Page 599

“There’s always a prevailing mystique in any civilization,” Leto said. “It builds itself as a barrier against change, and that always leaves future generations unprepared for the universe’s treachery. All mystiques are the same in building these barriers—the religious mystique, the hero-leader mystique, the messiah mystique, the mystique of science/technology, and the mystique of nature itself. We live in an Imperium which such a mystique has shaped, and now that Imperium is falling apart because most people don’t distinguish between mystique and their universe. You see, the mystique is like demon possession; it tends to take over the consciousness, becoming all things to the observer.”

• Has all movies, shows, anime, documentaries, etc. ever made
• Has all releases/cuts
• Has all quality options including HDR
• Doesn’t lock content regionally
• Lets you actually download media to your device
• Lets you use external media players and subtitles
• Is available on all platforms including TVs

All for the low price of $3 a month? Oh, and you can convert any torrent to a direct link and get premium links for hosters like 4Shared and RapidGator. Sounds too good to be true? Well, it’s your lucky day.

The Catch

You can simultaneously stream from 4 devices, but the catch is that they have to be on the same network. You can only access it from one IP at a time. If you’re using this at home, with all devices on the same WiFi network, this is not a problem. But you can’t stream from two different devices with two different networks (different IPs) at the same time.

The Components

This setup involves three components: Stremio, Torrentio and Real-Debrid. Don’t be alarmed, I promise it’s real simple. Stremio is a streaming app that can be extended with add-ons. It has a polished interface that lets you browse all movies and shows listed on IMDb. Torrentio is a content aggregator add-on for Stremio, which lets you stream all those movies and shows directly in Stremio. Real-Debrid provides high-quality sources to Torrentio.

What’s Real-Debrid?

Real-Debrid is a debrid service. A debrid service lets you convert torrents to direct links and gives you access to dozens of premium hosting services (like RapidGator, 4Shared, etc). What makes a debrid service great is that they cache torrent files. They have a massive database of torrents stored in their servers. Pretty much anything you want to watch is available in torrent sites, and pretty much everything in torrent sites are cached in Real-Debrid’s servers. It’s as low as $3 a month (their 6 month plan is €16).

Setting It Up

Sign up for a Real-Debrid account and buy a plan. Install Stremio and create an account. Now go to Torrentio. Here you can configure several things such as providers, quality exclusions, sorting, language priority and maximum results per quality setting. The only option I change here is sorting, I have it set to “by quality then size”. Choose Real-Debrid as your debrid provider. Get your Real-Debrid API key and paste it in. Now click install, it will take you to Stremio where you can install the addon. That’s all there is to it! Now you can install Stremio on any device you want, you just have to sign in to your Stremio account. You don’t have to mess with Real-Debrid if you don’t want to. You can pretty much stop reading here.

Stremio Web for iOS

Stremio doesn’t have a native app for iOS (available on macOS though), but you can use the PWA (progressive web app) with an external media player. I recommend Outplayer. There is only one problem with this setup. While Outplayer will remember where you left off, it won’t be synced with Stremio. To install the PWA, go to Stremio Web, click on the share button, and add to home screen. Open the newly added Stremio app and login using the profile icon on the top right. It’ll say streaming server is not available, just select “don’t show again”. Go to Settings, scroll down to Advanced, and choose Outplayer as the external player.

Useful Addons

Stremio has quite the collection of addons. Browse through the addons section and add what you like. You can find more addons here. There are addons to connect Stremio with Letterboxd, Simkl and more. Cyberflix is a useful addon that shows trending movies on popular streaming services.

Streaming With MPV

I use MPV to consume media. I’ve written a guide to set up MPV if you’re interested. Stremio is actually built with MPV, but you can’t change the configuration. Stremio doesn’t have an option to choose MPV as an external player. You can either copy the stream link and open it with MPV, or use the web version.

I prefer the web version, as I don’t have to install the Stremio app on my computer. It also saves quite a bit of time. In the web version, you can set m3u playlist as the external player in Settings. You can then configure MPV to automatically open m3u files.

Thoughts on Piracy

Piracy is almost always a service problem and not a pricing problem.

— Gabe Newell

I pay for music streaming because it’s convenient. It has everything I want to listen to in one place and has recommendations, curated playlists, statistics; everything I need. There is simply no movie streaming service that’s convenient. Every service has a limited and different catalogue, they don’t have all the editions of a movie, and quite a lot of content is simply not available on any service. I made a fully automated media server years ago, but that isn’t as convenient as this setup is either. Like Gabe said, it’s not a problem of pricing. I am willing to pay for convenience. It’s just that there’s nothing convenient about the streaming services available today.

Oh and of course, all this information is purely for educational purposes, I am not responsible, blah blah. Have a good day.

Installation

If you’re on Linux, you know what to do. Install it through your package manager and skip to the configuration section. If you’re on Windows, read on. Make a folder where you want to install MPV, for example D:\Programs\MPV. Download the MPV bootstrapper and extract the contents to the folder. Run updater.bat as administrator. It will ask you some questions. You can choose the default options for most questions. When it asks you to choose a variant (x86_64 or x86_64-v3), choose x86_64-v3 (press 2), unless your CPU was released over 10 years ago. I also install yt-dlp and FFmpeg.

Once the script is finished, go to the newly created installer folder and run mpv-install.bat as administrator. This will register the application in Windows. Congrats, you have now installed MPV. If you ever want to uninstall MPV, run the uninstall script first and then simply delete the MPV folder. But before you start using it, there’s some essential configuration to be done.

Configuration

Almost all configurations you will find on the internet overcomplicate everything. My config is small, simple, fast and makes MPV very user-friendly.

If you’re on Linux, your config folder will be ~/.config/mpv. For Windows, create a folder called portable_config inside your MPV folder, this will be your config folder. Inside your config folder, create a new file named mpv.conf with the following contents:

# Essentials
vo=gpu-next
gpu-api=auto
hwdec=auto-safe

# Smoothmotion
interpolation=yes
tscale=oversample
video-sync=display-resample

# QoL
keep-open=yes
save-position-on-quit=yes
autofit-larger=80%x80%

# UOSC
osd-bar=no
border=no

Next up, we’re gonna install UOSC. UOSC is a custom GUI for MPV; the default GUI is extremely bare-bones. On Windows, go to your MPV installation folder (the folder should have mpv.exe in it), right click and open a terminal. Now run the following commands:

Set-ExecutionPolicy RemoteSigned -Scope CurrentUser
irm https://raw.githubusercontent.com/tomasklaen/uosc/HEAD/installers/windows.ps1 | iex

Linux users, run the following command:

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/tomasklaen/uosc/HEAD/installers/unix.sh)"

And that’s it! You can now start using MPV like any other media player. Really, that’s all you need.

Beyond the Basics

The above configuration is enough for most people, but MPV offers way more. It is scriptable, meaning the program can be extended in many ways. I will list some of them here.

Audio Compressor

An audio compressor turns down the loudest parts and turns up the quietest parts. To install an audio compressor, download the script from here and add it to the scripts folder inside your config directory. You can press “n” to toggle the compressor. If you want to enable it by default, open the script with a text editor and change default_enable = false to true.

Troubleshooting

If MPV lags when you play media that doesn’t match your display resolution (such as 720p or 2160p on a 1080p screen), add profile=fast to your mpv.conf file. This disables MPV’s upscaling and downscaling algorithms. If that doesn’t fix it, remove the smoothmotion section.

If MPV lags when you play media that matches your display resolution, try removing the smoothmotion section from the config.

If you face crashes or weird glitches, set vo=gpu in your config file.

Windows vs Mac

Font rendering on Windows is handled by DirectWrite and ClearType. You might be familiar with the latter. Microsoft’s approach to rendering fonts is having “pixel-perfect” typography, literally. It aligns all glyphs to the pixel grid. The original font shapes are thrown out the window. Pun intended.

Mac takes a different approach. Steve Jobs was obsessed with good design and typography. Hence, Mac’s font rendering engine has a “WYSIWYG” (what you see is what you get) philosophy. It preserves the font’s original shape. Fonts look how the designers intended them to.

“So what are you saying, Windows bad Mac good?” Not at all. Apple has full control over their hardware, and all their displays are high DPI (dots/pixels per inch). In classic Apple fashion, they have a buzzword for it — Retina display. Most of us peasants are stuck with 96 DPI, which is pretty bad for legibility. Windows’s approach tends to do better here. Besides, all of this comes down to personal preference. Some prefer Windows’s approach, some prefer Mac’s. I won’t be going into Linux here, as it varies among distros.

Improving Typography on Windows

Have you ever noticed that fonts look sharp in some applications but blurry in others? This is because of Windows’s horrible default display scaling. By default, scaling is set higher than 100% (mine was 125% for 1080p). If you revert back to 100%, the blurriness goes away but everything is too small.

The fix is pretty simple. Go to Settings, Display. Look at the scale percentage. Now click on Scale (not the drop-down menu, the actual Scale menu option), and it will take you to the custom scaling settings. Enter the same value here; it will ask you to sign out and sign back in. You will no longer see blurry fonts on your system.

Next up, let’s adjust ClearType settings. The inbuilt ClearType tuner is pretty bad. We’re going to use Better ClearType Tuner, making the whole process much easier. Grab the zip from the releases section, extract it and run the program as administrator. I use RGB with maximum contrast (2200), you can play around with the values.

There is a program called MacType, which replaces Windows’s font rendering system with a custom rendering system. It works great where it does, but is very problematic where it doesn’t. I have dabbled with it but uninstalled it at the end.

Improving Typography on Linux

To get macOS-like bold fonts, add the following line to your /etc/environment:

FREETYPE_PROPERTIES="cff:no-stem-darkening=0 autofitter:no-stem-darkening=0"

This enables stem darkening (credits: aktsbot’s blog). Stem darkening emboldens glyphs at smaller sizes to make them more readable on common low-DPI screens. I also suggest switching to grayscale antialiasing.

Improving Browser Fonts

I don’t like the default fonts used on most sites. How did I fix it? I wrote a userscript that overrides web fonts with the fonts that are set as default in the browser. To set this up, first configure your browser’s default fonts to your liking. I use Charter for default/proportional and serif, SF Pro Display for sans-serif, and SF Mono for monospace.

Download a userscript manager extension. I recommend ViolentMonkey. Go to my script’s GreaseFork page and install the script. You can exclude the script from running on certain sites if you want to, using your userscript manager.

On Firefox, you can use Enforce Browser Fonts, which uses built-in features to achieve the same.

Android

Some Android manufacturers include settings to change fonts. If your OEM does not provide such options, your only choice left is to root your device. When I was using Android, I used a Magisk mod called Oh My Font along with Kill GMS Font. In my opinion, this is the best typography experience you can get on Android. It uses Apple’s San Francisco fonts by default.

The End

If you made it all the way here, you might want to look into getting a shiny new high DPI monitor. If you have any suggestions, feel free to mail me.