Is "Sway (window manager)" more secure than GNOME?

Scott

Is "Sway (window manager)" more secure and/or does offer better privacy than GNOME?

Background to the question: I used Fluxbox for 1-2 years, but then switched back to Gnome for reasons of convenience. So I'm wondering if Sway or other minimalist WM give a security and/or privacy benefit? Or should I rather pay attention to ease of use and use just Gnome?

Thank you

onigino

Scott

Not sure if secure is a good comparison

I would argue Gnome is less secure in that is it designed specifically for non technical users, it has allot of internet search based integrations and exposes the user to network devices more easily than sway

Sway is a minimal tiling manager, it literally does nothing that you don't explicitly configure it to so.

Though I don't know if "secure" is a good standard to use as it is just a window manager it doesn't even include screenlock 'swaylock' which is a separate app

yore

Considering GNOME is used and tested far more than most others, it has fewer bugs and thus better security. In my experience, I have found GNOME to be the most stable (besides xfce but it's outdated, does not support Wayland, etc), whilst others like KDE Plasma cause problems much more often so I personally would go with GNOME. However with Linux, your DE/WM isn't be the biggest security consideration so use what you like best.

Open_Source_Enjoyer

I think from a security perspective the most important thing for a WM is to use Wayland because this is fundamental for sandboxing applications.

onigino I would argue Gnome is less secure in that is it designed specifically for non technical users, it has allot of internet search based integrations and exposes the user to network devices more easily than sway

Could you provid examples for this?

Open_Source_Enjoyer

onigino I would argue Gnome is less secure in that is it designed specifically for non technical users, it has allot of internet search based integrations and exposes the user to network devices more easily than sway

What internet search based integration do you mean?

AlphaElwedritsch

It doesn't really care, so the best would be to use KDE

DeletedUser88

GNOME is the only DE that should be used if security is a priority: https://github.com/secureblue/secureblue/blob/live/docs/RECOMMENDED.md

mrket

DeletedUser88 In any Wayland compositor which supports the security_context_v1 protocol, applications running in a sandbox (through something like Flatpak, for example) are restricted from doing stuff like recording the screen.
Non-sandboxed apps are insecure when using any DE, I don't think GNOME's slight edge in this regard really matters.

Viewpoint0232

DeletedUser88

But 90% of people using GNOME need to install random third-party extensions to make it not a complete pain to use, so unless you can actually bring yourself to use 100% vanilla GNOME with no extensions these marginal security improvements are meaningless.

Open_Source_Enjoyer

I want to add that if you want to benefit from the improved security of Wayland you should try to install only apps that support Wayland, preferably as Flatpacks and then use Flatseal to remove their permission to use X11.

yore

Open_Source_Enjoyer I wouldn't recommend Flatpak.

See:
https://madaidans-insecurities.github.io/linux.html#flatpak

DeletedUser88

yore https://github.com/secureblue/secureblue/issues/125#issuecomment-1859610560

Open_Source_Enjoyer

yore

What would you recommend then?
I don't know a packaing format for Linux that gives you more control over the permissions of a application

yore

Viewpoint0232 90% of people using GNOME need to install random third-party extensions to make it not a complete pain to use

Source?

DeletedUser88

Viewpoint0232 It's irrelevant that most people use extensions on GNOME as security likely isn't their goal. If someone is looking for a secure Linux experience then they would not be using extensions. In the current state of DEs, vanilla GNOME is the most secure.

Viewpoint0232 marginal security improvements are meaningless.

I wouldn't call it marginal. An app you installed having the ability to capture your screen without your consent on any other DE is quite a big risk.

Viewpoint0232

yore

I made it up but actually I wasn't bad, it's 83%: https://tech.slashdot.org/story/23/01/23/0355247/83-of-gnome-users-installed-extensions-survey-shows

yore

Viewpoint0232

83% of users have at least one (non-default) GNOME extension installed

54.69% responses came from Fedora users, while other distros percentages were sporadically spread out.

https://blogs.gnome.org/aday/2023/01/18/gnome-info-collect-what-we-learned/

However I was more leaning towards why you said GNOME needs "random third-party extensions" to make usage easier. Personally, my main use case for official GNOME extensions is taskbar and ArcMenu support. But I have used Fedora for many years without any (non-default) extensions and have found it to be a breeze. If anything, I find KDE Plasma to be less stable with bugs every so often in updates. xfce is quite stable but is very behind on advancements such as support for Wayland, which is important to prevent non-focused windows from seeing what is typed in the focused window.

Wayland isolates windows from each other by default and would be a much better choice than Xorg

https://madaidans-insecurities.github.io/guides/linux-hardening.html#gui-isolation

Based on what I know, GNOME is the best DE in terms of security as of yet.

mrket

yore Currently KDE and Gnome are the only DEs which have proper Wayland support, so saying Gnome is the best in terms of security isn't that impressive.
I think it would be much more interesting to know how it compares to using a simple wlroots compositor + some standalone (possibly sandboxed) tools.
Btw Xfce 4.20 adds partial support for Wayland, many of the programs work already though there is no "Xfce compositor" yet, they recommend using a wlroots-based one.

yore

mrket Good to know xfce is making progress.

The reason I prefer GNOME over Plasma is stability. There have been many bugs in the last number of updates hence why GNOME should be given precedence.