I’m the Never Ending Pie Throwing Robot, aka NEPTR.
Linux enthusiast, programmer, and privacy advocate. I’m nearly done with an IT Security degree.
TL;DR I am a nerd.
I personally adhere to the idea of avoiding installing too many overlayed packages. Most i have installed in like five (with dependencies) at once. If you are comfortable with still using mostly Flatpaks and (only) a few overlayed packages, then Atomic may still be for you.
I really do recommend Secureblue.
I see this misconception all the time about Fedora Atomic distros. You can actually install any normal package available through the included repos, or add your own repo (rpm-ostree install $pkg). DNF can be used to add a repo from a URL and then you just use rpm-ostree install $pkg . It is really that simple.
The reason you aren’t supposed to is that it makes the system diverge from the default image by overlaying the package. Still though, Fedora Atomic is just Fedora but container images for updates.
Vivaldi is also proprietary. Not a good privacy browser.
Flatpak apps cant use namespaces. Flatpak (the software) uses namespaces but Flatpak apps can not.
Yes, I understand Flatpak does some seccomp syscall filtering. It still isn’t enough to consider a secure sandbox where the threat model is that the app is untrusted. Bubblewrap is generally considered a weak sandbox and isn’t “secure by default”, allowing for easy footguns.
LXC/Incus does support proper VMs but it isnt as common.
Neither are really designed to run untrusted apps.
I guess I just don’t understand your question. Explain in more detail.
Really think about the Ws (who, what, where, when, how).
If you want to protect against an “advanced” threat actor, you can not do that without multiple layers of isolation, including but not limited to virtualization, MAC (SELinux), namespaces, seccomp.
All protections are meaningless without a clear understanding of what assets you are protecting, the threat you face, and they want from you.
Distrobox is design to be the opposite of confined. Its goal is integration. The container is stripped away as much as possible to allow for sharing host resources.
As it says on the Distrobox website:
Security implications
Isolation and sandboxing are not the main aims of the project, on the contrary it aims to tightly integrate the container with the host. The container will have complete access to your home, pen drive, and so on, so do not expect it to be highly sandboxed like a plain docker/podman container or a Flatpak.
I would also argue calling “plain docker/podman container or a Flatpak” being “highly sandboxed” is also quite wrong and a misuse of those technology.
It uses Docker/Podman which is not a security sandbox. The purpose is app containers, not a security boundary. It shares the sane kernel as the host, which makes kernel vulnerabilities a source of container escapes. Docker (the default) runs as root and could be a source of privilege escalation. Best case is use gVisor or SELinux. Still not a secure sandbox.
Similar problems with Flatpak. Not a secure sandbox. Doesn’t Barely filters syscalls (and in a general way instead of per-app), barely reduces attack surface, granting frequently required permissions often significantly reduces the strength of the sandbox, shares a kernel with the host (and no application kernel like gVisor or sydbox), weak use MAC (like SELinux). Most of this can also be said of the previous 2 container software (and also LXC/LXD/Incus).
Also, don’t use browsers with Flatpak, they have a significantly weaker sandbox because it is missing a layer of sandboxing (namespaces). This makes attack exponential more likely by reducing the need chain another major vulnerability to execute a successful sandbox break.
What you want is a VM. It is designed to be a secure sandbox but needs some configuring.
I would probably go with Artix because it is arch based and therefore you will get updated packages instead of perpetually outdated Debian packages. Then maybe switch out the kernel for the CachyOS kernel and you should be good.
/e/OS doesn’t care take security seriously. They are usually 1-2 months behind on Android security patches, leaving users vulnerable to literally (literally) dozens of critical and many more high severity vulnerabilities. Every other Android ROM is better about this. LineageOS and GrapheneOS are the best about updating quickly.
Honestly, I saw it in a video recently that i cant remember. It showed some screenshots of the engineer’s Twitter taking about it.
Artix (Arch w/out systemd) supports many inits. I’d recommend dinit (which is very easy to use) or s6 (which seems more stable on Artix, but less user friendly helper tools). Both are very fast, faster than the other inits.
I very much doubt it. The only reason Asahi is even installable is because M series Mac were designed to allow installing other OSes. I know that sounds crazy, especially with all the reverse engineering needed to get Asahi to work. But without intentional design on the part an Apple engineer working on the initial M series chip, installing alternative OSes would be impossible.
I think it is worth noting that while what Russia is doing is evil, they are not the only evil players in the game. So many countries are complicit and actively support Israel (monetarily), and most countries do business with USA (mega)companies (like Google, Microsoft, Meta) even with the current regime.
And support for extensions like uBlock Origin.
On Debian I would choose Flatpak because it will be generally much more up-to-date than native packages (which becomes even further true the longer through the release cycle we are).
Licenses don’t matter when corpos don’t care anyways. Especially for training LLMs. They don’t care about copyright. I choose to use tools based on there merits over simply going “it has my favorite license.” Even though I say that, I still prefer AGPL even though I understand that of the corpos want to steal, they’ll steal it.
Having JS disabled is very rare for non-bot traffic, so you stand out far more. It isn’t about uniqueness, you are already unique if you aren’t using Tor/Mullvad browser(s). While disabling JS protects against certain kinds of fingerprinting, there is pure CSS and TCP fingerprinting. Firefox RFP (eg. Librewolf) and whatever Cromite or Brave have help to protect against much of JS fingerprinting. You are only ever going to fool naive scripts which these browsers already do a good job of that.
As for security, having JS disabled is a benefit. Just know since you will very likely have to enable to again quite often for random websites, you’ll become used to doing that to the point that it may as well be useless. If a random website doesn’t load just leave it, unless it is worthy of some actual trust. Even more useful would be setting up uBlock Origin with a blocking mode, such as medium or hard.
Anything really. Just use Docker/Podman or LXC and then the base OS won’t matter.
Next thing I am looking at is secureblue for Fedora CoreOS. Security matters and a rock solid base with hardened defaults is really nice. It also is Atomic and because it is effectively just CoreOS, you install it with a JSON file (I think). Using the provided example butane file it took like 30 seconds to install. Now I need to customize it further.
Yes, just get the Nvidia version of Secureblue/Bazzite and you are good.