What is your desktop OS?

Overlay1404

Just made the switch from Windows 11 to Bazzite as my daily driver. Really enjoy it as someone who has never used a Linux distro as the OS for their main computer. I have relatively simple needs (mostly just gaming and browsing), so the simplicity of this OS works well for me.

Styx

macOS main desktop
CachyOS if I hop on Linux

gta3

overpass

Ubuntu

Nobody

GOS Pixel Phones & Tablets
Qubes OS Laptop and Desktop
BDS a few servers and firewalls
SecureBlue Server and Desktop (in testing)
My own linux distro build compiled my own linux kernel (in testing)

DrJack60

I finally got secureblue downloaded (posted elsewhere that the download & checksum were different versions, it was the day after new download was released), but didn't realize it could not be run as trial via live install. I am trying to figure out which way to go for my needs.

I had used Mint for several years, then Manjaro due to security concerns. The constant need to download updates was a bit annoying. An occasional glitch would waste far too much time when something didn't want to work. I was an early adopter of the Pixel Tablet & hoped to use it as a laptop replacement, but it just was too awkward (keyboard; hub that sometimes didn't play nice; limited private, secure, open source apps; inability to use secondary screen at any time; etc).

Now I'm back in the exploration phase again. In professional work I do not use EMR (a true advantage to being an "off-grid" doc) and so the laptop is used for patient summaries, letters, etc. Scanning & electronic fax is needed (WHY are medical facilities & support corporations so far behind the curve w/ secure email?!). I don't use "E-prescribing" because THAT requires some sort of proprietary software (I write old fashioned, hand written Rx's instead!). So basically I need word processing, scan, fax, email ... but of course go online as well (web browsing, both professional & personal). I do realize I should use the Tablet for web browser, but then I'm having to shift between multiple devices (and of course my GrapheneOS phone for phone, browsing, Signal/Molly, sms, and ProtonMail).

I certainly would appreciate any input / suggestions. I may grab yet ANOTHER cheap laptop - love the size & weight of my little HP 13" laptop, bought it SPECIFICALLY for the size, then discovered it had issues with Linux in various forms - just uncertain how to best meet my needs securely & maintaining patient privacy.

GrouchyGrape

DrJack60 as someone who also works in the medical field (and sometimes feels like the only one that actually cares about HIPPA), I used secure blue for most of that work. At the end of the day, do the best you can, but understand that you also need to get your work done and the medical field is still stuck in 2005 so it's never going to be perfect.

That being said, if you aren't running a private practice, your OS choice shouldn't be your decision. If you are running your own practice, I highly recommend hiring internal IT.

TheGodfather

WestQuester But as a counterpoint, this thread was dedicated to rebuffing that article on Linux being insecure:
https://www.linux.org/threads/is-linux-a-secure-operating-system.51579/

That link is terrible. It's obvious that most people who responded there have no clue about security whatsoever.

BuffaloStance

TheGodfather

Read this and mind the list of security experts (including D. Micay) linked at the bottom of the page.

cmahns

Been using Linux since about 2005 or 2006 as a secondary OS, but have been solely using Linux as my sole OS since 2012. After distro hopping using the big distros (Arch, Fedora, OpenSUSE, Ubuntu/Mint) and some downstream variants (early Qubes adopter) I landed back on Debian and haven't used anything else for my personal computing for nearly ten years now. I use stable on my servers and sid on my workstation and laptop.

It's really not for any one reason beyond just wanting to keep things simple for myself. I like that I can get most packages from apt directly without needing to install things from the main Debian repos without needing to add additional third party ones, using flatpak, or resort to things like pip/npm. The project's democratic governance model is secondary to me, but I do like that it's a large and long running example of how democratic FLOSS can be. Part of why I stick with it even if its more work to lock down.

HomerJay

Is anyone using Windows Arm? Is it better or worse in comparison to Windows 11 pro? What are your thoughts about anivirus here?

argante

BuffaloStance I'll defend Linux. Blaming Linux is a bit like a chef trying to make a pizza. He has the ingredients: flour, yeast, etc. Let's say Linux is our flour. The pizza failed, everyone complains it's inedible. And what does the chef say? He'll claim it's not his fault... it's the flour's fault, because he won't admit he messed up.

Sandboxing - there are many ways to do this, and Linux offers effective solutions, from the much-maligned DAC (1, 2) to seccomp and SELinux.
Exploit Mitigations - PaX, SELinux, hardened_malloc, LKRG, CFI
Kernel - SELinux, PaX, LKRG, kernel gcc plugins, CFI etc.
The Nonexistent Boundary of Root
- any MAC (SELinux)?
- there's a good chance you'll find tutorials online older than you, which strongly recommend mounting /tmp with the noexec,nosuid options. This will block this example. Why doesn't anyone do this?
- TPE (1998) - but SELinux is enough here
- sysctl -a | grep fs.protected (ported from Owl)
- etc.

My point is that Linux provides plenty of tools for building a reasonably secure solution. It's Linux distributions that provide us with flawed solutions.

WestQuester

BuffaloStance

That linked page was what I was referring to when I said people can find things online to support their biases, no matter what they are. Regarding the "Sources". If you actually read them...

The Daniel Micay one really says nothing about Linux.
The Twitter one says nothing about Linux.
The other Twitter one is a dead link.
The PDF presentation says that Linux security is important because so much infrastructure runs on it.
The notes says Linux contributors should care more about security (always the case, yes)
Two more are links to Twitter posts about caring about security
One is a video panel discussion on improving security

There is one linked forum post that supports the article's opinion. The other links are garbage. So don't be fooled by the appearance of supporting information.

Linux is secure. Could it be more secure? Yes. Is it the most secure? I don't know. It wouldn't surprise me to find that Mac OS is more secure. But I believe Linux is secure enough and is used by many who care about security. It is definitely used by those who care about privacy.

So my advice to people is don't stress over which operating system is the most secure. The mainstream ones (including "mainstream" Linux) are secure enough. You're not going to get hacked or compromised any more if you run Linux than you would with Mac OS or Windows. Linux users are not more vulnerable. What would be more of a discriminator would be privacy and Linux wins every time there.

Eirikr70

argante @BuffaloStance It is quite common to read that Linux is insecure. But Linux is the operating system of the vast majority of the corporate servers. It is supported by all the Big Tech, which certainly rely on it for their own needs (maybe not Microsoft ?...). I don't understand how this situation is even imaginable. I mean ... Either corps have means to make it secure, and then it is not insecure by itself but just insecure in some implementations, or it is insecure and our data circulates everywhere since all the systems have exploitable flaws.

KCne

Eirikr70 But Linux is the operating system of the vast majority of the corporate servers.

https://privsec.dev/posts/linux/linux-insecurities/#why-is-linux-used-on-servers-if-it-is-so-insecure

On servers, while most of the problems referenced in the article still exist, they are somewhat less problematic.

On Desktop Linux, GUI applications run under your user, and thus have access to all of your files in /home. This is in contrast to how system daemons typically run on servers, where they have their own group and user. For example, NGINX will run under nginx:nginx on Red Hat distributions, or www-data:www-data on Debian based ones. Discretionary Access Control does help with filesystem access control for server processes, but is useless for desktop applications.

Another thing to keep in mind is that Mandatory Access Control is also somewhat effective on servers, as commonly run system daemons are confined. In contrast, on desktop, there is virtually no AppArmor profile to confine even regularly used apps like Chrome or Firefox, let alone less common ones. On SELinux systems, these apps run in the UNCONFINED SELinux domain.

Linux servers are lighter than Desktop Linux systems by orders of magnitude, without hundreds of packages and dozens of system daemons running like X11, audio servers, printing stack, and so on. Thus, the attack surface is much smaller.

argante I'll defend Linux. Blaming Linux is a bit like a chef trying to make a pizza. He has the ingredients: flour, yeast, etc. Let's say Linux is our flour. The pizza failed, everyone complains it's inedible. And what does the chef say? He'll claim it's not his fault... it's the flour's fault, because he won't admit he messed up.

In the case of OSs like GrapheneOS, they do everything they can to make the pizza nice and healthy. The pizza is still objectively limited because the flour has been demonstrated to be unhealthy. That’s why GrapheneOS is trying to move away from that type of flour

mmmm

argante not here to argue your point, rather your analogy. Yes, the wrong flour will indeed cause problems. You can 'fix' it, but you're better off just using the right flour.

lynx

I use a recent Mac. I love the modern and secure design of macOS and APFS (checksums on every block, copy on write, storage volumes,...). I think it's technically the most advanced desktop OS you can get.

Eirikr70

KCne Thanks !

argante

KCne That’s why GrapheneOS is trying to move away from that type of flour

Move away, but where? To MINIX, seL4, Redox? Google has long been trying to build a solution based on good isolation. They invested in porting Capsicum from FreeBSD to Linux. This project was rejected. Later, they planned Zircon, which was the basis for Fuchsia. The first release was in 2016, and there was much talk of replacing Linux in Android. Almost a decade has passed, and what? Nothing. We're still using Linux. That's the reality. Of course, we can wait another decade, but today and tomorrow we will probably stay with Linux.

KCne

I wouldn't be able to continue this discussion without going even more off topic, so I'm making another topic

argante Move away, but where? To MINIX, seL4, Redox?

This post from @final has some points that may be of interest to you:

Two new innovations I like to bring up time and time again:
https://xous.dev/
https://www.redox-os.org/

argante Almost a decade has passed, and what? Nothing. We're still using Linux

Our roadmap page was updated to reflect our approach better.

The initial phase for the long-term roadmap of moving away from the current foundation will be to deploy and integrate pKVM and CrosVM, reinforcing existing security boundaries. The Android Open Source Project has been making significant progress on this front, so our next milestone is to securely deploy Android apps using this virtualization setup.

You'll be able to see a lot of this progress after Android QPR1 releases on GrapheneOS

txco

SecureBlue on two machines for programming and other fun computing tasks. Locked down MacOS on an M3 for anything requiring an account login.

Eirikr70

gta3 Any1 saying otherwise is a corporate shill.

I'm not a native english speaker and I don't understand that sentence, but I can understand that the argument is quite weak ;)

Graphite1

Tried kicksecure - only gives me 800*600 resolution on a 4k monitor.
Linux mint no issues. Even Qubes works properly.

Testing distros to migrate from windows. Know nothing about linux so probably will use Mint as a starter to learn the ecosystem.

Eirikr70

Graphite1 Try Fedora KDE, or Kinoite.

gta3

Graphite1 Linux mint is a good start, or Ubuntu

If u jump in too much at the deepend like arch etc, u will likely be discouraged

Once ur good with mint or ubuntu, help ur friends / family move from windows, that's rewarding

« Previous Page Next Page »