I am SO CLOSE to getting the shitware scoured from my system!
One of the approaches I tried is the use of what I call the Toilet Tablet (hostname: Crapper). Not because I browse it on the toilet, but because it’s where all the shit I can’t get rid of is supposed to live. It’s low power, low quality, but sits neatly beneath my main monitor providing an interface to webmail (which needs constant authentication on my desktop), Teams (for the handful of times I need to use it), and any Google integrations I still need to use for whatever reason.
That’s been okay, for a while, but doing a lot of stuff on the tablet is sub-optimal because it’s not an ideal environment for lengthy emails or any complex configuration work that needs to go through Chalmers’ criminally unintuitive and clunky web tools. So it’s mostly been an authenticator and Teams airgap. It’s on my IoT network so it has stripped down access, but even if it didn’t it can’t leak any information I care about to to anywhere I’d worry about. It doesn’t have my personal email, it can access none of my network drives, doesn’t connect to Tailscale (I’ll talk more about Tailscale later), etc. Seriously this thing could be riddled from bootloader to butthole with malware and it wouldn’t make a difference. Indeed, it is how I access Teams – it already is riddled with malware [1].
So it’s an okay solution but not an ideal one.
And then I remembered… you know, once upon a time I used a thing called Synergy to share my mouse and keyboard between different systems. Maybe it would let me get rid of the last inconvenience, which is having to type on a screen. Maybe I don’t need webmail, or eduVPN, or anything at all on my real computer. Maybe I could have it all!
Reader, I could not have it all.
Synergy does not work on Android. It will probably never work on Android.
But it sent me down a rabbit hole. What I want is for my tablet to behave like a fourth monitor that is completely disconnected from the rest of what’s going on. I just want it to be there when I need to access a work email. I want to look down at the tablet and handle everything safely away from the real computer. It’s not a big ask. And the infrastructure is *almost there*. There’s a tool in Fedora called Scrcpy that does a lot of what I want – it lets you work your tablet remotely within a window on your main desktop. It’s slow, clunky, and slow and clunky, but it sort of works. Unfortunately Android is so locked down these days that you can’t really do much more than puppet the device like it was connected by fifty-foot long marionette strings.
So again, I got to thinking. The whole thing would be easier if I was working with Linux on the tablet. That’s a non-starter because while there is a touch version of Linux it is is comical and not supported on most devices. What **isn’t** a non-starter though is a Pi connected to my portable monitor (bigger screen but still fits under the main one) – and *that* does work with Synergy with a little bit of coaxing. So I set that up.
Reader, it worked. It worked like a god-damn dream. It’s only a 4GB Pi 4 that was going spare so it was *slow*, but it was actually largely seamless. And I rejoiced that I had finally solved my problem. Shitware but sanitised. The dream of every man since the dawn of time.
Alas…
The reason I was using the tablet in the first place was Microsoft Authenticator, and… you guessed it, it does not work on Linux. You can’t run it through WINE. You can’t do anything, because platform lockin is lockin. I am only permitted to use use Microsoft Authenticator for work, they don’t support any of the other authenticators that I could easily use [2]. I guess they see it as a gluetrap for Teams and Outlook. If you want to access the ecosystem of Office, you need to bend over and take your MFA in whatever port they want to stuff it.
It is so frustrating – Synergy doesn’t work on Android, Authenticator doesn’t work on Linux. The two critical jigsaw pieces do not fit together but if they did it would make such a beautiful picture.
For a long time now I’ve been debating the validity of a Yubikey – a hardware authenticator that turns tiresome login theatre into the press of a physical button. And it turns out that is supported by my employer. I picked one up when I was last in the UK and I will give it a try. If that works, then I might actually have this thing all sewn up. A Pi for Bullshit (A CowPi of sorts), using software to give me essentially a seamless KVM switch, with a physical authenticator offering the bridge to work’s ecosystem. Teams isn’t supported on Linux, neither is Outlook, but both work okay in the browser.
If that works, I might finalise this setup with a fresh Pi 5. Or maybe even another mini-PC if I can get one cheap or scavenge one from somewhere else. The Beelink I bought as a homelab has been purring away like a dream and it wasn’t that much more (in cost, as opposed to size) than a Pi 5 with a decent spec [3]. Given its modest expected role – organizational shitware insulated from my real system – it wouldn’t need to be much. Maybe, MAYBE, I if I got a new Minipc I could even leave it as Windows and let all its crud fester. It could be a constant touchstone of why I began doing all this in the first place. A regular inoculation against the invasive thought, ‘You know, maybe Windows wasn’t so bad. Let’s try it again’. I do have that thought occasionally when Fedora, for some reason, loses all my taskbar apps for the fifth time. I think, ‘maybe I was overreacting when I switched so hard to Linux’.
Reader, I was not over-reacting. I’ll talk about that in the next post.
On the other hand, another Linux mini-PC would give me another platform for throwing on other low impact stuff. I donated (not necessarily permanently) one of my old Pi400s and older monitors to my games program at work. I put PiMiga on it and it’s a fully featured Amiga emulator for people to play about with. I could do that with the CowPi, or the MiniPC variant. I could have Pinball Fantasies on tap, right there on the screen below me. Maybe a C64 emulator. Maybe emulators for days. Its main role would be insulation against the tide of corporate shitware, but that’s not to say there can’t be a playground by the sewage outlet as the old misogynist joke used to go.
I can feel myself circling the solution to my employer’s invasive security theatre. I just need to go limp and ride the wave to where it’s taking me.
[1] Ironically, this is the one place I’d be willing to install Teams and it’s the one place it won’t install – I have to use it through a browser. Lol.
[2] Bitwarden for example. You know, a tool I control. This to be fair is a Chalmers thing rather than Microsoft thing. Their policy is ‘no choice’.
[3] The Pi used to be such a great ‘don’t even think about it’ purchase. Now it’s probably the worse ‘power to price point’ purchase you can make.