mushix99
If not mistaken, Kicksecure does compile the kernel with custom config parameters, hence doing hardening beyond syctl. They seem to provide a variant hardened-vm-kernel, which ad-hoc compiles the kernel on local machine for unique kernel pointers, and reduces hardware options to a minimum for faster compile time and better security.
You've linked an outdated page from when madaidan was involved in the project. Kicksecure is now hostile towards GrapheneOS, secureblue and linux-hardened.
Maybe that is due to Kicksecure's interdependence with Whonix incl. Tor Browser, which prioritizes anonymity/privacy over security. Tor browser has its own place in terms of anonymity and can't be easily substituted by Chromium-based browser - browser fingerprinting is such a difficult topic on its own. Chrome is a terrible privacy choice, Chromium still has quite a few Google dependencies - iirc that is why Ungoogled Chromium exists. I think to have encountered rare tracking connections (Google) even with Vanadium in the past, but that might have been solved by recent versions. It would be interesting to know, how secureblue's Chromium browser behaves with in this regard. But yes, you're are right, Chromium is the better choice from pure security perspective.
No, these claims are highly inaccurate and misleading. Firefox has much worse privacy and security, and it would be dramatically harder to reach the same point obtained with minor changes to Chromium.
Interesting point, actually never heard of this perspective . But doesn't Flatpak, which is advocated by secureblue as primary installation method, have a similar issue, with need to trust many individual developers? Debian at least is one responsible organization unit.
No, Debian has a massive amount of people who are trusted with nearly zero vetting or oversight. Many have demonstrated they're highly untrustworthy. Many have actively abused their positions. Debian trusts not only the upstream developers but also this large group of additional people, who are much less trustworthy overall than the upstream open source developers based on their actions and statements. Flatpak does not provide a proper app sandbox or permission model but it's at least substantial progress towards it.
But so can Kicksecure, it's even installed as default? Flatpak internally uses bubblewrap sandbox, so to harden Debian repo packages for Debian/Kicksecure I am wondering, if it makes better sense to directly use bubblewrap - or other sandboxes like systemd hardening options, firejail which all make use of linux namespaces, seccomp, capabilities or cgroups to more or less extend. Advantage of secureblue is, it comes with secure defaults, which makes it very convenient to use.
No, this is completely wrong. You cannot simply use these things to contain desktop applications. The applications need to be made to work within a sandbox. You're describing individual security features or controls rather than an app sandbox. Firejail also has a history of extraordinarily poor security and does not do what it's supposed to do.
I wish they would use Librewolf as substitute for Firefox, to make up for Firefox telemetry and ad connections. As stated above, it depends on chromium build at hand, how privacy-friendly this browser behaves. I gladly would take Chromium with ad blockers like U-Block Origin for security and privacy, but Google actively works against all blockers (Addon policy etc.).
This comes with significant privacy/security disadvantages rather than only advantages.
At least there seem to be incentives to work on it? https://www.kicksecure.com/wiki/Sandbox-app-launcher
You're referring to a bunch of out-of-date content from madaidan who is no longer working on Whonix or Kicksecure. Most of his changes were reverted and removed, not only hardened_malloc.