desktop equivalent to GrapheneOS (perhaps based on ChromeOS?)

guser39

GrapheneOS there's still regular networking between the different isolated virtual machines.

This is incorrect. Network communication between individual qubes is blocked and requires the user to manually allow for such communication.

https://www.qubes-os.org/doc/firewall/#enabling-networking-between-two-qubes

GrapheneOS

guser39 What we wrote is accurate and isn't ignoring that functionality. It provides isolation between guests rather than making the operating systems and applications harder to exploit.

guser39 No, it's not incorrect, you're just nitpicking the wording and interpreting it as something far different from what we were clearly talking about. We did not imply in any way that every guest had to use networking. We explained QubesOS isolates network drivers in a dedicated guest and needed to clarify it does not mean guests using networking can avoid having a network stack exposed to attacks. The reason we mentioned that is because the lack of hardware GPU acceleration in each guest along with not having network card drivers in each of them is a way it differs from a stack of laptops. A stack of laptops could have some Macbooks and Chromebooks able to factory reset securely so the example you gave of disposable VMs isn't actually a counterexample of what we described it.

DeletedUser76

Seriously, should I just use Windows with some privacy settings tweaked? After going through all kinds of desktop OS (mostly linux), I am completely lost now. I feel like I just can't ditch big techs like Microsoft and Google the more I go deep into this world of privacy and security. Even though I do use GrapheneOS for my daily phone driver, my threat models aren't that high too. It's not like I must run away from NSA, etc. I would really like to hear from someone who has the ability to audit complex codes and has definite threat models....

P.S. Please don't recommend QubesOS. I will never use it again.

rellhom

DeletedUser76 Seriously, should I just use Windows with some privacy settings tweaked? After going through all kinds of desktop OS (mostly linux), I am completely lost now

how can you conclude that going to Windows is the proper choice? Just because Linux isn't perfect is no reason to go with certain evil that is Microsoft.

rbb

GrapheneOS They have very poor privacy too, not only poor security. Applications being able to access everything and lack of basic privacy measures is a problem

Would a Linux distro not be considered more private based purely on the data collection and telemetry of Windows and Mac? Most of what I've read about privacy seems have more to do with the users themselves and the applications installed, licks clicked, etc...

Open_Source_Enjoyer

@Duct9143
I think the most near you can get to this is by buying pc hardware that is secure boot and TPM compatible and install QubesOS on it.
If QubesOS is to much then a well maintained Linux distribution with all apps installed as Flatpacks so you can controll their permission with Flatseal should be a very good option.

Blastoidea

Does your desktop have a Titan 2 Security Chip or equivalent?

Open_Source_Enjoyer

Blastoidea
There are pc's with TPM chips, but this is more a hardware then a software thing that the GrapheneOS developers program for

Open_Source_Enjoyer

GrapheneOS They have very poor privacy too, not only poor security. Applications being able to access everything and lack of basic privacy measures is a problem aside from security. They're missing far more than modern exploit protections. They lack basic security measures and a proper application security model. There's near complete lack of systemic work on privacy/security throughout the OS.

areaman Linux variants: Can be very good on privacy, but lack the modern exploit protections in Android / iOS / Windows / MacOS. Of course, if you get exploited, your privacy goes to zero.

This is true for most ways of installing Linux applications, but you are forgetting about Flatpacks and Snaps.
Especially with Flatpacks you have a very high control over the permissions of the applications, even more than with GrapheneOS.

Blastoidea

Open_Source_Enjoyer
It is one of the reasons why GrapheneOS is only written for Google Pixels.

DeletedUser202

While only speculative/wishful (longer term) thinking at this point, with Google now developing an Android based Pixel laptop to compete with high-end laptops, it doesn't seem completely unrealistic for an "desktop" version of GOS to be possible in the future (assuming the hardware meets their criteria and it isn't too big of a project for the team).

But something to keep an eye on I think.

N1b

DeletedUser202 I remember to have read here that if an Android based Pixel Laptop comes out, GOS devs will likely support it.

We have to be patient with Google though, they are slow when it comes to a functional desktop mode. So never buy something from them for future potential, but only from what is offered at present.

For now, I guess MacOS will give most security. If you don't want to trust Apple, you'll have to dig into this subject more to check what levels of security/privacy are possible against your threat model.

I ended up using Fedora Silverblue on an AMD Framework 13 for now. It's far from perfect, but it is "just enough" at the moment and I'm hoping one day to have a proper GOS desktop mode.

GrapheneOS

N1b GrapheneOS desktop mode will need us to flesh out the support for virtual machines. There will likely be user-facing stock OS VM support at that point and we need to make sure to at least provide parity with it.

N1b

rellhom there are good reasons for any system, and it mostly depends on threat models and context (like hardware, and use cases). E.g. I'm required to use Zoom for work and it runs poorly on Windows and especially Linux and therefore (literally the only reason) I have a Macbook M1 to use for the many Zoom Calls.

As cool as Linux is in concept, it severely lacks simple, out of the box security and privacy features for desktop use. Windows will be better for most people not willing to dig into the details and provide good OPSEC.

That being said, Windows privacy sucks. I don't want to fight Microsoft on their own playground, so I'm avoiding it wherever possible (and ended up only using it for some Steam games that won't run well on my Steam Deck).

horde

N1b Windows will be better for most people not willing to dig into the details and provide good OPSEC.

You can't have good OPSEC will all that telemetry. Also there are a lot of other factors that affect your OPSEC other than the OS you are using.

« Previous Page