Hi, Im searching for a secure distro for normal daily use for my laptop. Currently Im running arch linux with full disk encryption, secure boot, linux hardened, firewalld and most apps as flatpaks (with some disabled permissions using flatseal). I think its pretty secure laptop but it could be more secure.

Tails and Whonix are the most secure but they are not ment for normal daily use…

There is a lot of new immutable distros. Getting (system) malware is harder to get on them. Im most interested in blendOS, because its based. Does anyone know if it has full disk encryption, secure boot, etc. or can it be done by the user? What about other distros like Fedora Silverblue?

Any other recommendations?

Thank you :)

  • throwawayish@lemmy.ml
    link
    fedilink
    arrow-up
    34
    ·
    1 year ago

    While technically not a Linux distro, Qubes OS is the gold standard. With the primary cons being that it’s kinda hard on system requirements and it doesn’t play nice with dedicated GPUs and thus software that would require it.

    Honorable mentions would be Fedora Silverblue/Kinoite/Sericea, Kicksecure, openSUSE Aeon/Kalpa and Vanilla OS. Of course, regular Fedora and openSUSE Tumbleweed are still good even without being immutable. The aforementioned distros all have varying levels of hardening out of the box. While the offerings of Fedora and openSUSE have better defaults than most other distros, Kicksecure -which is made by the same team behind Whonix- is almost completely hardened from the get-go. Vanilla OS is in a major overhaul, so I refrain from making any strong judgements on it yet.

    For whatever it’s worth, a couple of years ago the (infamous) Madaidan (AKA security researcher on Kicksecure and Whonix) did recommend running minimalist distros like Alpine, Artix, Gentoo and Void for the sake of security. However, he did that recommendation on the basis of minimalism and zero-trust. However, that would require the system administrator (read: you) to actually know their removed. Which, unfortunately, is often times not the case as not everyone that’s sensitive of their digital security proceeds to study cybersecurity. That’s where the “honorable mentions” in the previous paragraph come into play; all of the distros that were mentioned within actually have shown to take security very seriously and acknowledge with the amount of heavy-lifting they do that they hold a sense of responsibility in that regard.

    Im most interested in blendOS, because its based.

    I once had an interaction with its primary developer and the dude was oblivious on which MAC was configured on his distro; spoiler-alert: none. It does a bunch of cool stuff, but I wouldn’t call it secure (by default) by any stretch of the imagination.

    • chevy9294@monero.townOP
      link
      fedilink
      arrow-up
      6
      ·
      1 year ago

      Thank you for your detailed answer! Im already using a minimalist distro (arch) with (almost) no problems. Before that I used Fedora. Becase of that and your recommendation I will probably switch to silverblue. Im a little scared of selinux (I was thinkering too much with fedora) but better with it than without. For AUR apps I will use distrobox. I would also like to try toolbx for my projects!

      • throwawayish@lemmy.ml
        link
        fedilink
        arrow-up
        5
        ·
        1 year ago

        Becase of that and your recommendation I will probably switch to silverblue.

        Silverblue is incidentally also my daily-driver; custom image through uBlue’s template to be more precise*.

        Im a little scared of selinux (I was thinkering too much with fedora) but better with it than without.

        Yup, SELinux is definitely a double-edged sword in that it’s very powerful but can therefore be a bit more restrictive. Though, currently it’s our only bet when it comes to confining containers as it’s (vastly) superior over AppArmor in that aspect. Which explains openSUSE’s recent conversion from AppArmor to SELinux for their distros that rely heavily on container workflows; like MicroOS, Aeon, Kalpa etc. Unfortunately it’s not the easiest to understand, but I’m sure you’ll manage 😉!

        For AUR apps I will use distrobox.

        Hehe, you know what’s good 😛.