Ubuntu to add TPM-backed full-disk encryption

What I'm advocating for is a system where the team that officially maintains your computers, no matter how big or small that team is, doesn't feel like they have to choose between blocking short-term productivity or creating long-term risk. There usually will be a few people who know enough to install software and cobble things together even if that isn't their job on paper (and they therefore don't have root). Give them the ability to cobble things together, but also ensure their cobbling is recorded somewhere, and isn't just some hackery in their home directory. And if that team is one person, or even zero, there's still a way forward.

And I'm also posting this not to boast about our in-house system but to lament that we had to build one (and did not open source it). I think it might be relatively close to possible to get there with Nix these days, though it's both a fairly steep learning curve as well as an involved conversion from basically any existing system. I think there could be really good FOSS tools for this. I think these tools could be good enough that the average home user - who by definition has a corporate sysadmin staff of zero - can get their setup for installing the right graphics drivers and workarounds recorded in exactly the same way.

I think we (the FOSS community) actually sort of lost our lead: up until maybe the early '00s, Windows and Mac users basically did not have privilege separation at all, and were running everything as effectively root. Installing stuff was just copying files, uninstalling was hoping for the best, and "DLL hell" was a Windows problem. The Linux distros and the BSDs were the ones who said, even if this is your personal computer, run as a non-admin user and use well-defined packaging systems. Now, as another commenter alluded to, Windows and Mac OS have moved towards a model where the OS is read-only, applications are in their own private directories (and often sandboxed), and it is absolutely possible to restore the state of a Windows or Mac machine just by restoring user-level files and config. We haven't kept up, and I would bet there is much more "DLL hell" in practice on Linux machines than Windows ones today.

A few projects like NixOS and Spack are going in the right direction for specific use cases, but they're not commonplace. The Ubuntus and Fedoras of the world should do this too - and in a way that empowers users to try stuff out as opposed to just locking them out of the system and indeed makes them more confident about trying things that might not work.