I have bwrap configured to override: npm, pip, cargo, mvn, gradle, everything you can think of and I only give it the access it needs, strip anything that is useless to it anyway, deny dbus, sockets, everything. SSH is forwarded via socket (ssh-add).

This limits the blast radius to your CWD and package manager caches and often won't even work since the malware usually expects some things to be available which are not in a permissionless sandbox.

You can think of it as running a docker container, but without the requirement of having to have an image. It is the same thing flatpak is based on.

As for server deployments, container hardening is your friend. Most supply chain attacks target build scripts so as long as you treat your CI/CD as an untrusted environment you should be good - there's quite a few resources on this so won't go into detail.

Bonus points: use the same sandbox for AI.

Stay safe out there.

As a higher-level alternative to bwrap, I sometimes use `flatpak run --filesystem=$PWD --command=bash org.freedesktop.Platform`. This is kind of an abuse of flatpaks but works just fine to make a sandbox. And unlike bwrap, it has sane defaults (no extra permissions, not even network, though it does allow xdg-desktop-portal).

To be honest - and I can't really believe I'm saying it - what I really want is something more like Android permissions. (Except more granular file permissions, which Android doesn't do at all well.) Like: start with nothing, app is requesting x access, allow it this time; oh alright fine always allow it. Central place to manage it later. Etc.

https://github.com/ashishb/amazing-sandbox

Maybe I misunderstood this point. But the ssh socket also gives access to your private keys, so I see no security gain in that point. Better to have a password protected key.

AI has made it so so easy to get into neovim and make anything work no matter how obscure it is.

The biggest benefit for me which I haven't realized how good it is with tmux and the low low memory usage. I mean I can keep EVERY project I work on open, quickly switch and maintain.

No more 10gb memory usage on a SINGLE project, no more laggy remote access, no more dreading reboots, no more wasting time.

Kernel panic? everything is right there how you left it, honestly it makes me feel so sad because the poor design of IDE's have been such a show-stopper for a LOT of good project designs that I have completely avoided due to introduced complexities that come not to mention how slow things can become.

Now I can just ssh into my pc from a laptop and work, no synchronization, no need to have a beefy laptop and incredible battery life.

However, I do still run visual studio in parallel for debugging. It's basically essential when dealing with console game development.

I can do simple search/replace, page up/down, jump to character or delete x words, but I feel like I'm missing a lot to really take advantage of it.

Is there a tutorial or guide people recommend to become more of a power user? The only plugin I have is the Markdown editor for instance.

Not sensible. completely insane.

nvim has a lot of "fun" plugins that you wouldn't actually use so I think you might have ran into that.

Also just use the mouse! Lazyvim has great support for it.

<leader>SK is your friend as well.

I'd also suggest kickstart.nvim over Lazyvim as its leaner with a primary file for configuration it is not lacking power.

Whats your source?

I feel like the habit I’ve benefited the most from on my neovim journey has been reaching for :h before doing any web search. Good completion in the command-line helps a lot there.

My mileage was quite different: last time I tried, scrolling too fast with the mouse wheel consistently caused a segfault.

It just feels like it's hard to nail down your preferred workflow / setup ... but it's likely worth it if you're using it daily!

Are there any good visual or video demos of using this type of setup? I'm having trouble picturing what makes people really love this type of TUI-only workflow.

This kind of setup is at its most powerful when you live on the command line though. For instance, you need to modify .py files across multiple projects that mention a certain variable, have a certain word in their name, and were modified within the last month.

That search is a bit easier in bash/zsh than it is in most IDEs and the strength of vim/neovim is the shell integration.

I typically have a terminal-heavy workflow so it's very rare that I'm browsing to files from within my desktop, but if I am using Dolphin to look for a file I have a "Open terminal here" shortcut and then I'll usually just run "nvim doc.md".

Why not give it a try? You'll likely find that there's an adjustment period and you can always switch back to your old editor if you don't like it. The beauty of it is that you can build it into whatever IDE you want instead of having useless features shoved into your IDE whether you use them or not.

The nice thing is that I rely only on the keyboard, no need to point with the mouse. It may not be faster, but typing is sequential and there’s no context switching. So muscle memory helps a lot. Just like you don’t think about each character when you write, I don’t really think about the shortcuts and commands I use.

Another thing I picked up from my time with emacs was making keybinds to interact with the "other" window. One macro I use often will delete the second line of the file in my current window, save, change to the other window, delete second line, save, change back to original window. When activated from keybind it all happens approximately instantly. I also have some binds to jump to the top of the other window's file (without leaving my cursor stuck over there) and so on, letting me keep my cursor in the main area most of the time.

Also the buffer’s local variable in vim comes from different sources. In emacs, a lot of stuff are tied to a major or minor mode. You only have to toggle them to switch between keybinds, syntax,…

There's a hackish way to do it by watching for Neovim command line commands that start with "/Users/" (change it if you are on other OS).

Your coding agent can probably hack something up based on:

`//Hackish supports drag and drop files into Neovim by examining when command line starts with "/Users/".`

Just use a fuzzy file finder within the terminal or within vim itself.

My setup looks something like this:

  |ai |nvim           |git view |
  |___|               |________ |
  |ai |               |terminal |
  |   |(proj selector)|         |

for AI I found oh-my-pi from can1357 it's magical how good it is. It was a top rated post on HN awhile back.

You're right. I don't use SSH that often due to kubernetes, infact I only use ssh for connecting to my desktop to access my tmux sessions and it's great. I know where you're trying to go with this and it's simply not true.

Who said anything about tmux? We're talking about neovim which is extremely light weight and the LSP's don't sit around being active all the time. They have a set duration where they terminate when unused which is simply not possible in most IDE's (LSP based ones are OK, but have problems reconnecting).

This isn't right. It was certainly true in the nineties, but I haven't seen one in years on Windows and I spend many hours a day in it both for work and play.

and kernel panics are exceedingly rare on windows. i havent BSOD'd in eons

I haven't had a kernel panic once on reliable hardware. Linux is way more stable than windows device drivers and progressively less reliable graphics drivers.

Must be a bug in the linux kernel, let me git clone and build an out-of-tree module...

Had to move my browser up to see what I am typing.

it was a bit worrying as there was somewhat of a stagnation in battery chemistry, but having non toxic/dangerous battery storage is going to make off-griding so much more attractive.

technically speaking, if every household had solar panels and batteries it would not only be cheaper than the grid it would also have complete independence from oil fluctuations, weather disasters and centralization.

now if you combine that with electric cars that charge off your off-grid system and transition to eletric appliances instead of something like gas the benefits keep stacking all while being pretty much net neutral post manufacturing.

Grid level batteries are going to be a more efficient way of using the same materials to achieve a particular level of supply. It's just at the moment there's a "competency arbitrage" where infrastructure is way slower than building it yourself.

To be fair, many of the costs are because of high demand (artificial, because the gov. mandates it to be installed) and lots of work to be integrated in the national grid. But as things are right now, it not economically convenient (at least where I live) and for what I have heard, in other places is not much different.

Everyone has panels on their roofs and they own a shared grid-scale battery that they feed into.

While I don't regret getting them, they are absolutely not good enough to be the only solution.

It doesn't have to be perfect a generator with ~7 days of fuel can go a really long way for any kind of low solar activity event. 7 days of fuel is roughly half the size of the generator.

At the end of the day it's math, figure exactly what is needed, if it works out then great, if not, continue waiting.

however in the southern hemisphere - solar is a win .

Solar is a win everywhere with a sunny weather.

Which is fine if your fantasy includes offshoring all of that and shipping the finished products in to the local market.

Which, no matter how you slice it, has to be more energy intensive than manufacturing locally.

Bulk container ships are crazy efficient. It makes more energy sense for a nation like France to trade with the eastern US than it does with Hungary.

Hetzner does this!

High density housing is unlikely to be compatible with that.

Also rental dwelling owners and people with limited economic resources tend to be less likely to make those kinds of capital investment.

To the level of total energy independence? Indeed. But even an apartment can get some PV.

There's even PV specifically designed for renters in apartments.

> Also rental dwelling owners and people with limited economic resources tend to be less likely to make those kinds of capital investment.

Not so: https://www.lidl.de/p/tronic-balkonkraftwerk-860-wp-800-w-to...

As per my first line, 800 W is not going to be total energy independence.

But it's €249, cheaper than all but the cheapest phones.

In the best case, it can pay for itself in the first year; though obviously a north-facing apartment gets almost nothing from it.

However, it's the onus of the gov't (regional or federal) to create the investment needed for large, industrial scale solar and battery storage. That's what taxpayer money should be spent on.

They will, assuming the people that went off grid stop paying for it. As fewer people pay for it the costs per capita grow

But they're not worse off, because the upgrades are better. For them to be worse off, the upgrades they pay for has to be worse than what they got today.

You should really talk to some California utilities and their wildfire exposure.

And anywhere else, anything you put up you need to maintain. And aren't most grids built with loans anyway? That interest would be born by fewer people.

Not sure if you own a house, if you do, here's a thought experiment.

It's all paid for, right? Doesn't cost a thing to own a home?

Apartments have walls too, but we're getting into a territory where it might start becoming ugly.

Honestly, I think it's fine to just keep the electric grid as it is, and not attempt to power every building only from the amount of solar electricity that it can generate from its roof area. The electric grid lets us take advantage of economies of scale, build gigantic solar arrays or nuclear power plants on cheap land outside of town, and crucially leave the management of that grid up to one well-known organization rather than a consortium of several households in an apartment.

The problem starts when you need the grid for some amount of the year or in periods over several years. As consumer we would like to pay 10% of an annual electrical bill if we can produce the remaining 90% ourself. The grid however want to have be paid for investments in power plants and transmission, and to them, costs associated with consumption is only one part of the bill. If the customer consume less energy, and the costs in infrastructure is the same or greater, then they will continue charge the consumer for the full year. In that scenario, you may only consume 10% but your bill will remain at close to 100%. As a consumer one could decide to go without those 10%, but that in itself can be dangerous or expensive, in which case paying 100% may still be rational.

Absolutely not, economies of scale. To say nothing of the cost incurred when an issue appears with your installation (lightning strike, water damage, etc) would be much higher.

Just the grid is often up to 50% of people’s electricity bills, cutting that out is a massive saving.

I think we might see a future where the grid becomes smaller. Still utility scale but skip the continental transmissions and instead run a local city scale grid with renewables, storage and a chemical based carbon neutral backup.

(Pardon me if you live in another country. I'm starting to wish I did.)

But if you have a BBQ with propane and the sun didn't shine for many many days that should be sufficient.