What is your desktop OS?

Linux

p-marg Linux

https://secureblue.dev/articles/flatpak

https://github.com/secureblue/secureblue/issues/193#issuecomment-1953323680

https://secureblue.dev/faq#appimage

This commend is nice, but I would prefer to go through the permissions and filter manually.
I hope some distro implements a feature that auto opens Flatseal on every app installation and forces permission checking before first run.

DeletedUser713 Flatpak is not a real sandbox as in not being enforced by the underlying OS (which is a must for a real sandbox, otherwise apps can escape the sandbox by just being configured that way - which they do).

Do you still refer to permissions that allow sandbox escaping?
Other platforms like Android also allows apps to request extremely powerful permissions like accessibility service, adb access or even device admin.
The main problem is that Flatpack permission are opt out and not opt in.
Yes, this has to change in the future, but for now we first need to establish Flatpack as a packaging format.

DeletedUser713

Linux The main problem is that Flatpack permission are opt out

Yes, that's why I wrote that it isn't a real sandbox in my comment above. A sandbox that is opt-in is not a sandbox. Apps that won't abuse permissions don't need a sandbox anyway, from a malware point of few.

Linux

DeletedUser713 Yes, that's why I wrote that it isn't a real sandbox in my comment above. A sandbox that is opt-in is not a sandbox. Apps that won't abuse permissions don't need a sandbox anyway, from a malware point of few.

On the technical level it has everything that a sandbox needs, the problem is the implementation.
And if an app requests invasive permissions it will not get installed by most people because Flathub flags this as unsafe and probably also attracts suspicion from people who then will examine it.

TrustExecutor

r134a Interesting. You mean Securecore right? Secureblue hardened Fedora CoreOS.

r134a

TrustExecutor No, i actually went with a secureblue vm as was not really familiar with coreos yet. However i might migrate again from a secureblue vm to securecore vm when time permits, as securecore seems indeed more minimal / less attack surface? with only one specific purpose in mind, containerized workloads.

p-marg

Linux Secureblue allows Flatpak permissions to be set as opt-in instead of the default opt-out behavior, I agree, it should be opt-in by default.

TrustExecutor

r134a
Ah.there is a lot of moving parts in a desktop OS though. If you are linux literate you can always try an Alpine VM with hardened_malloc as it is in the Alpine community repos. And then lock it down with apparmor profiles and other hardening.

DeletedUser534

Fedora KDE

gta3

Ubuntu linux

Hathaway_Noa

Dual boot:

Windows (veracrypt)

Ubuntu Linux (LUKS)

Phone: GrapheneOS

DeletedUser676

Dual Boot Laptop

If You are forced to use Windows for some Software like me then - "Windows 11 IOT LTSC" is the least horrible version of Windows IMO. Basically bare bones.

Daily Driver is Fedora. Im not a huge fan of Gnome but im already all set up and hate distro hopping. I like Gnome better than KDE. I need to learn much more before switching again. I think learning "Riceing" will make me happier than trying to find Distro I like the "UI" of more.

I want to try Qubes through. Hopefully runs ok on VM. Would want to get used to it on VM before fully committing.. Ha ha

DeletedUser771

Windows IoT LTSC, Kicksecure, Tails or OpenBSD.

I harden Windows with Group Policy, I disable Microsoft Defender, I replace Windows Firewall with Simplewall since it enables me to drop ICMP echo requests, I disable Windows Event Log, I fully encrypt the disk with VeraCrypt, I enable DNS over HTTPS (DoH) and I install store apps with WinGet.

DeletedUser534

DeletedUser676 I suppose you will love Cosmic DE when it hit's stable. It's GNOME but done right and with features! :D

Regarding Windows, version 10 IOT LTSC is the least horrible version. I just can't digest 11 at all.

user2025

DeletedUser676 QubesOS doesnt run in any VM type hypervisor setup.
However,learning curve is challenging. Once understood and mastered,your whole approach to life &work will be changed. ;)

user2025

DeletedUser771 install Portmaster and see how many "calling mothership" active links,requests and connections does,without your accord or awareness.
Come back here and report it...i can send you screenshots but let you discover...sadly.

DeletedUser771

user2025 That's why I use Simplewall as an outgoing firewall.

DeletedUser771

DeletedUser534 Windows 10 IoT LTSC can't play some newer games, doesn't natively support DNS over HTTPS, no longer has support for the Microsoft Store app (you can't install store apps with it anymore, and the same goes for WinGet unless you use it to install older copies of the store apps you want to install which requires a third-party scraper if you catch my drift), and has other issues.

DeletedUser534

DeletedUser771 I know, that exactly why I use it. The lack of the things you mentioned is irrelevant for my use case and all games work just fine for me.

DeletedUser771

DeletedUser534 I use 11 IoT LTSC. You can't play The Last of Us Part 1 or Part 2 on it since they don't support it, and there's other modern games that don't support it either. Microsoft may still support 10 IoT LTSC but that doesn't mean game or application developers will.

DeletedUser676

I went with 11 since I hear Steam is dropping support for 10 and since 11 Pro is what Laptop shipped with "not that that matters". I didn't want to have Software in future that I need drop support for 10 and be forced to switch agian in future. I Do like 10 better though and was useing 10 IOT LTSC on my last laptop.
I just went with 11 for future proofing.
Dont have to use Wimdows much anyway so its fine.
Got Gameing on Linux working perfect now so dont even need Steam support for Windows 11 anymore.

Im likeing Linux better everyday. If all Windows Software worked on it I would delete Windows.

ForScan im looking at you...

« Previous Page Next Page »