Maybe I can move to the moon someday.

  • 0 Posts
  • 11 Comments
Joined 3 years ago
cake
Cake day: October 9th, 2023

help-circle
  • Qubes OS gives him high security with relative ease.

    Fedora Silverblue with auto update and Flatseal tightened apps is a nice middle ground.

    RHEL minimises supply chain attack risk and provides features like kernel hot patching. He can use free developer subscriptions. Also try SUSE.

    Security wise Chromium is a bit better than Firefox. Try to seal it up with SELinux. Red Hat only supports Firefox however.

    SecureBlue can be used as a reference, but it’s still downstream so personally I’d avoid using it in case of supply chain attacks unless securing Silverblue is too much of a hassle.

    Keep in mind that Flatpak sandbox interferes with browser sandboxes.




    1. Use a separate bootloader partition for every OS. Windows is known for destroying non-windows bootloaders. It rarely, if ever, touches anything else. Many distros have a /boot partition with initramfs since grub might not support booting from the root partition’s filesystem. Integrity is ensured with secure boot, /boot encryption is optional.

    2. LUKS is straightforward, and most non-DIY distros have encrypted root support built-in.

    3. Gnome has Google drive support in the file manager itself, although it’s not exposed to CLI yet.

    4. If you’re not short on storage, I personally highly recommend Flatpaks as they are containerised whilst also come with a sandbox solution. Avoid non-default frontends when using system packages.

    5. Check out immutable/image-based distros like Fedora Silverblue. They are proved to be extremely reliable and need little to no manual maintenance since all changes are atomic and generate a brand new OS.

    6. Avoid Nvidia GPUs. Their proprietary drivers are compatibility nightmares.