Hey guys, first post here and on an alt, I hope I don’t get flamed. If there’s not enough info I’ll post another thread tomorrow.
Its been ~5-7 years since using Linux (Ubuntu/Kubuntu/Debian/Mint/Fedora/etc) as my daily driver. Windows since then for dev and games with kids, but now I have a laptop that can run my dev env in a VM.
I’m an advocate for privacy and security, but I’m also at the “config once, mostly work for a while” camp… I don’t like spending a ton of time fixing things. I don’t need Whonix or QubesOS-level compartmentalization (unless it runs Barbone’s now), but I tried OpenSuse Tumbleweed on a recommendation and the fine-tuning of flatpak controls seemed really nice. I’d love to be able to sandbox as much as possible without breaking things. Memory and exploit-hardened kernel/apps is a huge plus. Basically GrapheneOS as a Linux distro would be fantastic, even though it comes with its own issues.
Am I overthinking here? Should I commit to Debian, Fedora, or OpenSuse and learn to sandbox and harden properly (if so which has best docs and community)?
I forgot the copy-paste specs my laptop hardware info to my phone earlier, but its an HP Victus 15-fa0032dx
HP Victus 15.6" 144Hz FHD IPS Gaming Laptop (Intel i7-12650H 10-Core, 16GB DDR4, 512GB SSD, RTX 3050 Ti 4GB GDDR6), Backlit KYB, WiFi 6, BT 5.2, HD Webcam
I don’t use the Bluetooth or webcam, so those drivers aren’t necessary. Does Wayland work for this, and is that really necessary?
Sorry for the noob questions. Mid-30s guy with kids wanting to get this done this week if possible. Please excuse spelling and grammar mistakes.
SIDE NOTE: NOT AT ALL opposed to learning new systems, especially for security, as long as it doesn’t require hunting down obscure undocumented commands.
Privacy wise, if you use free software you should generally be fine, though look into either hardening Firefox’s settings (you can use something like arkenfox user.js) or use a fork which does this for you (Librewolf or Mullvad browser).
Sandboxing solutions available to regular users (as in usable after a sane amount of effort) have some major drawbacks (which means random programs, especially proprietary ones, aren’t as safe to run as on your phone):
They all sandbox applications which were developed and designed assuming they will run unconfined (in contrast to something like Android, where apps assume they are in a sandbox). This leads to many problems, some of which are solved by portals.
Flatpaks are often poorly sandboxed by default, and it can be hard/impossible to properly sandbox them (for example, if your Flatpak needs access to game controllers it will likely need access to all devices to work properly).
Firejail has a large attack surface and is an SUID binary.
Bubblewrap has a smaller attack surface and can also use unpriviliged user namespaces instead of being an SUID binary if supported by the kernel (though this has its own security implications), but it is very hard to use (it is used by Flatpak internally).
I don’t know much about Snaps, but I doubt they’re better than Flatpaks in this regard.
An important part of Linux security is Mandatory Access Control (implemented by SELinux and AppArmor, for example). MAC is an additional permission mechanism that is checked after the usual Unix permissions (user, group based) grant access, and is used to confine processes, so if an attacker exploits them they will only be able to access a minimal amount of information.
Most distros don’t configure a MAC, and it is extremely hard and time consuming to do so (though it’s relatively easy to confine specific “high risk” processes with AppArmor if your distro has basic support for it).
Fedora has SELinux configured OOTB, and allows for simple further hardening by having predefined confined SELinux users you can assign to Linux users to limit what they can do.
OpenSUSE has AppArmor configured and enabled by default though it is not a full system policy AFAIK (the init process runs unconfined), in contrast to SELinux (though Fedora runs many processes and users by default unconfined too).
Both have good docs (though for Fedora look at RedHat’s docs for SELinux, it goes much more in depth).
From my experience, it is much easier to configure AppArmor, but it would still require an extreme amount of work to do properly, so I’d recommend sticking with a distro that does that for you.
Thanks for the reply. Unfortunately it seems things haven’t changed much in the last decade as far as hardening is concerned, seems like you have to come from an infosec background and constantly read log files or set up new yara rules (or have some software do it which comes with its own set of concerns). I was recently under the impression that docker images were virtualized until I learned they’re free to break out at any time with kernel vulnerabilities which are much more numerous than hypervisor escapes, so it doesn’t surprise me there are issues with flatpaks/bubblewrap/firejail. Sandboxing solutions seem much more mature on Windows unfortunately, with both Sandboxie/Windows Sandbox and Kaspersky (I know) having their own versions of scope-specific apps and limits. But I think I have a lot more reading to do before assuming.
The situation is improving, just very slowly. Solutions are slowly being figured out to various usability issues created by sandboxing (for example, there has been discussion for a while regarding how to solve the game controller issue I mentioned), which will allow the more user-friendly solutions to be more hardened by default.
Also, even though I have many issues with Flatpak, with a bit of configuration (even graphically with Flatseal) it can effectively sandbox many programs already, as long as you use Wayland.
On the MAC front, there is a 3rd party project (apparmor.d) that’s trying to build a portable set of AppArmor profiles for all common programs/environments on desktop Linux. As you might imagine this is a huge project and far from done, but it’s actually surprisingly complete already.
Although I get the idea, going all in on the privacy would mean you can never log in with a single account you have since they bind it to your ip and you’ve lost. Also using vpns all the time or tor if possible/necessary. Imo, its far too much work to go full paranoia mode.
So I‘m running debian stable with kde (dont do it on nvidia!) and pop os on a laptop. Firefox, adblock plus and pihole do most of the heavy lifting. Gaming, working and other activities on the same machine works well without vms. I do use vms in specific dev Environments though.
For kids, an immutable distro sounds like a great idea. Good luck and have a nice day.
Thanks for the reply. Why no Debian stable with KDE… which part doesn’t play nicely with nvidia (Debian or KDE?)
I already use VPNs/for for 99% of my daily browsing/activities on my personal PCs, is there a higher chance of account lockout with VPNs on linux besides a few services like Netflix?
Debian stable is pretty much a meme since it prioritizes stability over everything else. So you get the oldest kernel and will get the latest features months after every other distro. Since kde has only recently gotten wayland+nvidia support, it is pretty janky on debian stable still. It just makes no sense imo for a desktop pc. Pop is way better.
As pointed out by @themoonisacheese, immutable distros are getting some traction recently and they are good for making a system reproductible, allowing easy rollbacks, but this should not make a big difference, privacy-wise. It also add some work for configuration / learning.
Here are two levels I’m thinking of from what you presented:
You go with any stable (big fan of Debian here too) so to avoid data breaches from brand new packages (xz…), then you can compartimentize your application with Flathub and manage the rights with Flatseal. If you go with software with less telemetry (Firefox), this should be a reasonable and easy to use setup. The rest of the privacy will depend on what is going on inside of your web browser, probably.
The next step would be something like Qudes-OS + Tor. If your workflow / usecase allows it, this should be a good step up for privacy. Your laptop seems beefy enough to handle the many VMs, and the install is easy enough imo.
Thanks, I found this but there doesn’t appear to be much activity. Is there anything you would recommend? It seems like OpenSUSE updates so much that a hardened kernel would break a lot.
Imo immutable distros are what’s paving the future. Personally I’m a debian fangirl, but if you want to learn something new then I’d take a look towards these, otherwise you’re essentially just configuring all the things the same ways as before, which is fine but I think we’re moving away from this.
Your laptop will be fine, although it has a Nvidia graphics card so that’s always a dice roll. You probably will have problems with brightness control and sleep mode.
For your privacy goal, honestly just using a properly configured firefox on any Linux is fine. You’re already using linux, and for the rest your browser really shouldn’t leak that much info, so it’s up to the normal avenues of blocking trackers etc.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !privacyguides@lemmy.one
In the digital age, protecting your personal information might seem like an impossible task. We’re here to help.
This is a community for sharing news about privacy, posting information about cool privacy tools and services, and getting advice about your privacy journey.
You can subscribe to this community from any Kbin or Lemmy instance:
Check out our website at privacyguides.org before asking your questions here. We’ve tried answering the common questions and recommendations there!
Want to get involved? The website is open-source on GitHub, and your help would be appreciated!
This community is the “official” Privacy Guides community on Lemmy, which can be verified here. Other “Privacy Guides” communities on other Lemmy servers are not moderated by this team or associated with the website.
Moderation Rules:
We prefer posting about open-source software whenever possible.
No soliciting engagement: Don’t ask for upvotes, follows, etc.
Surveys, Fundraising, and Petitions must be pre-approved by the mod team.
Be civil, no violence, hate speech. Assume people here are posting in good faith.
Don’t repost topics which have already been covered here.
News posts must be related to privacy and security, and your post title must match the article headline exactly. Do not editorialize titles, you can post your opinions in the post body or a comment.
Memes/images/video posts that could be summarized as text explanations should not be posted. Infographics and conference talks from reputable sources are acceptable.
No help vampires: This is not a tech support subreddit, don’t abuse our community’s willingness to help. Questions related to privacy, security or privacy/security related software and their configurations are acceptable.
No misinformation: Extraordinary claims must be matched with evidence.
Do not post about VPNs or cryptocurrencies which are not listed on privacyguides.org. See Rule 2 for info on adding new recommendations to the website.
General guides or software lists are not permitted. Original sources and research about specific topics are allowed as long as they are high quality and factual. We are not providing a platform for poorly-vetted, out-of-date or conflicting recommendations.
Hardening Linux is very hard IMO.
Privacy wise, if you use free software you should generally be fine, though look into either hardening Firefox’s settings (you can use something like arkenfox user.js) or use a fork which does this for you (Librewolf or Mullvad browser).
Sandboxing solutions available to regular users (as in usable after a sane amount of effort) have some major drawbacks (which means random programs, especially proprietary ones, aren’t as safe to run as on your phone):
An important part of Linux security is Mandatory Access Control (implemented by SELinux and AppArmor, for example). MAC is an additional permission mechanism that is checked after the usual Unix permissions (user, group based) grant access, and is used to confine processes, so if an attacker exploits them they will only be able to access a minimal amount of information. Most distros don’t configure a MAC, and it is extremely hard and time consuming to do so (though it’s relatively easy to confine specific “high risk” processes with AppArmor if your distro has basic support for it). Fedora has SELinux configured OOTB, and allows for simple further hardening by having predefined confined SELinux users you can assign to Linux users to limit what they can do. OpenSUSE has AppArmor configured and enabled by default though it is not a full system policy AFAIK (the init process runs unconfined), in contrast to SELinux (though Fedora runs many processes and users by default unconfined too). Both have good docs (though for Fedora look at RedHat’s docs for SELinux, it goes much more in depth). From my experience, it is much easier to configure AppArmor, but it would still require an extreme amount of work to do properly, so I’d recommend sticking with a distro that does that for you.
Thanks for the reply. Unfortunately it seems things haven’t changed much in the last decade as far as hardening is concerned, seems like you have to come from an infosec background and constantly read log files or set up new yara rules (or have some software do it which comes with its own set of concerns). I was recently under the impression that docker images were virtualized until I learned they’re free to break out at any time with kernel vulnerabilities which are much more numerous than hypervisor escapes, so it doesn’t surprise me there are issues with flatpaks/bubblewrap/firejail. Sandboxing solutions seem much more mature on Windows unfortunately, with both Sandboxie/Windows Sandbox and Kaspersky (I know) having their own versions of scope-specific apps and limits. But I think I have a lot more reading to do before assuming.
The situation is improving, just very slowly. Solutions are slowly being figured out to various usability issues created by sandboxing (for example, there has been discussion for a while regarding how to solve the game controller issue I mentioned), which will allow the more user-friendly solutions to be more hardened by default. Also, even though I have many issues with Flatpak, with a bit of configuration (even graphically with Flatseal) it can effectively sandbox many programs already, as long as you use Wayland.
On the MAC front, there is a 3rd party project (apparmor.d) that’s trying to build a portable set of AppArmor profiles for all common programs/environments on desktop Linux. As you might imagine this is a huge project and far from done, but it’s actually surprisingly complete already.
Although I get the idea, going all in on the privacy would mean you can never log in with a single account you have since they bind it to your ip and you’ve lost. Also using vpns all the time or tor if possible/necessary. Imo, its far too much work to go full paranoia mode.
So I‘m running debian stable with kde (dont do it on nvidia!) and pop os on a laptop. Firefox, adblock plus and pihole do most of the heavy lifting. Gaming, working and other activities on the same machine works well without vms. I do use vms in specific dev Environments though.
For kids, an immutable distro sounds like a great idea. Good luck and have a nice day.
Thanks for the reply. Why no Debian stable with KDE… which part doesn’t play nicely with nvidia (Debian or KDE?)
I already use VPNs/for for 99% of my daily browsing/activities on my personal PCs, is there a higher chance of account lockout with VPNs on linux besides a few services like Netflix?
Debian stable is pretty much a meme since it prioritizes stability over everything else. So you get the oldest kernel and will get the latest features months after every other distro. Since kde has only recently gotten wayland+nvidia support, it is pretty janky on debian stable still. It just makes no sense imo for a desktop pc. Pop is way better.
Oh that makes sense, thanks.
As pointed out by @themoonisacheese, immutable distros are getting some traction recently and they are good for making a system reproductible, allowing easy rollbacks, but this should not make a big difference, privacy-wise. It also add some work for configuration / learning. Here are two levels I’m thinking of from what you presented:
You go with any stable (big fan of Debian here too) so to avoid data breaches from brand new packages (xz…), then you can compartimentize your application with Flathub and manage the rights with Flatseal. If you go with software with less telemetry (Firefox), this should be a reasonable and easy to use setup. The rest of the privacy will depend on what is going on inside of your web browser, probably.
The next step would be something like Qudes-OS + Tor. If your workflow / usecase allows it, this should be a good step up for privacy. Your laptop seems beefy enough to handle the many VMs, and the install is easy enough imo.
Tumbleweed is perfectly fine. You should look into linux-hardened kernel.
Thanks, I found this but there doesn’t appear to be much activity. Is there anything you would recommend? It seems like OpenSUSE updates so much that a hardened kernel would break a lot.
Imo immutable distros are what’s paving the future. Personally I’m a debian fangirl, but if you want to learn something new then I’d take a look towards these, otherwise you’re essentially just configuring all the things the same ways as before, which is fine but I think we’re moving away from this.
Your laptop will be fine, although it has a Nvidia graphics card so that’s always a dice roll. You probably will have problems with brightness control and sleep mode.
For your privacy goal, honestly just using a properly configured firefox on any Linux is fine. You’re already using linux, and for the rest your browser really shouldn’t leak that much info, so it’s up to the normal avenues of blocking trackers etc.