Safety for desktop PC

ryrona

DeletedUser405 I would too, but it relies on Wayland which Qubes does not currently support

Wayland support is on the way though. As far as I understood, the QubesOS team recently recruited someone to exclusively work on bringing Wayland support to QubesOS.

The usage of Flatpak is also a problem from what I have understood, since it is incompatible with the current way software updates in Qubes are installed. This might likely also be possible to workaround.

But we should expect SecureBlue on QubesOS to be a year or two away at least. Here is the bug tracker ticket created by one of the QubesOS devs:

https://github.com/QubesOS/qubes-issues/issues/9755

pixelfairy

ryrona I use flatpak on qubes-os. Not aware of any issues with that. Also used appimage. I've had trouble with snaps updating in the past, but that seems to be fixed now.

p-marg

DeletedUser405 Like I said, If you need a solid OS today that just works, Fedora Silverblue is one I see recommended frequently!

wuseman

p-marg
Secureblue is based on Silverblue and is, as the name implies, more security-focused. It's what I would use if I wanted to harden my computer.

Elgoog

What exactly is Universal Blue? Am I correct in understanding that it is SilverBlue with more packages installed?

Psyonico

Elgoog What exactly is Universal Blue? Am I correct in understanding that it is SilverBlue with more packages installed?

Sort of.

Universal blue isn't a single distro. It's a series of distros based on silver blue with additions for other things.

So Bazzite is the distro of theirs that I'm most familiar with. Bazzite is fedora silverblue with a focus for gamers, so it comes with some software that gamers would likely use preinstalled (Steam, Lutris for example)

Finik

Perhaps it is worth considering Kicksecure Linux. Its model largely eliminates Debian's security issues, but it takes from it a wide range of support and convenience

p-marg

Finik I really wanted Kicksecure to be a solid security-focused project, but I ended up feeling frustrated. Updates seem to get delayed, and the way things are handled feels a bit messy and unreliable.

Compared to Secureblue’s clean and careful approach to privacy and security, Kicksecure just doesn’t quite measure up for me, and GrapheneOS devs seems to recommend against Kicksecure for various reasons.

I'm personally downloading and installing Secureblue on my ThinkPad right now!

https://xcancel.com/GrapheneOS/status/1861465637886754839#m

ryrona

Finik Perhaps it is worth considering Kicksecure Linux. Its model largely eliminates Debian's security issues

No, KickSecure largely does nothing to improve your security and privacy compared to Debian. 1) They haven't implemented any kind of app sandboxing, so any compromised app can read and destroy all your files, and access sensitive hardware like microphone and web camera. 2) They haven't enabled any kind of exploit hardening for apps, the one they did have (hardened_malloc) they removed again. 3) They haven't done anything to improve kernel security against driver exploits. 4) They haven't even replaced default applications with safer default, going as far as still having Firefox with invasive telemetry as the default browser.

p-marg I'm personally downloading and installing Secureblue on my ThinkPad right now!

Out of those two distributions, I think that definitely is the right choice.

wuseman

Finik
The only way I would use Kicksecure is in a VM running something else. Maybe Secureblue.

cattaneo

After reading the entirety of this thread, along with the supplemental links provided, I installed Secureblue. However, I coudn't import bookmarks and passwords into the web browser, nor could I find instructions on how to do so on their website. So I replaced
it with Bluefin, which I really like. I would rather run Secureblue, but I check my financial accounts every morning, so bookmarks and passwords in a web browser are a must.

ryrona

cattaneo I would rather run Secureblue, but I check my financial accounts every morning, so bookmarks and passwords in a web browser are a must.

Just create new bookmarks?

cattaneo

I'm not sure how long it would take to recreate 205 bookmarks but I am sure I don't want to find out!

DeletedUser405

cattaneo
Secureblue has a discord, maybe you could ask them there

ryrona

cattaneo I'm not sure how long it would take to recreate 205 bookmarks but I am sure I don't want to find out!

Oh, wow, you sure seem to have a lot of financial accounts. I am glad I only have one bank :P

pixelfairy I use flatpak on qubes-os. Not aware of any issues with that.

Oh, really? Are the FlatPaks installed in and updated as part of the templates? I might want to look into this again for my own setup.

pixelfairy Usb devices are filtered though a vm. This is to protect the user, but makes it hard, maybe impossible, to do things like install grapheneos.

Hard, but not impossible. I installed GrapheneOS from QubesOS. Just create a new sys-usb like qube but that isn't a disposable, launch it instead of sys-usb, and do the installation from there, and then delete it again afterwards. That way you avoid having to proxy the USB connections to another qube, but have direct access to the USB devices.

pixelfairy

cloerr I'm happy with qubes-os for that last few years. Its a little more up front setup, and you should already be familiar with linux because it sometimes has rough edges. The whonix integration and disposable vms is great, esp if your doing anything sketchy. Now I feel constrained by the traditional desktop model. The compartmentalization also helps with organizing work and data. They have a good model for intentionally passing clipboard and file data. The vms are light enough to kinda use as browser bookmarks. Easy to do most of your browsing in disposable vms. Easy to route different traffic through different vpns, or tor instances.

Reasons you wouldn't want qubes.

No 3d acceleration. They're working on a gui domain to address this. Theres no hardware 2d either, but its fast enough to watch youtube videos in full screen on 1080p.
Usb devices are filtered though a vm. This is to protect the user, but makes it hard, maybe impossible, to do things like install grapheneos. Haven't tried adb from it either, but even looking at the files on a phone didn't work for me. Haven't had trouble with other usb devices.
Your laptop might not support it. This isn't as much a problem now, but the newest laptops might miss some driver support.
Some things are extra steps. For example, using a password manager, you have to copy / paste across domains (its ctrl+alt instead of just ctrl) but you get used to it. Usb devices, including thumb drives have to be attached to a qube before you can use it. Just plugging it in only notifies that its available.

You can dual boot or install a traditional linux to get around the edge cases if your not as paranoid. Secureblue looks interesting and might be a better fit for you. Haven't tried it yet, but will.

Qubes-os has its own forum here if you have more questions. https://forum.qubes-os.org/

pixelfairy

ryrona

Flatpaks and snaps installed as user. You might need to flatseal to fix permissions issues. Some apps run better from the terminal than directly from the qubes menu.

Hard, but not impossible. I installed GrapheneOS from QubesOS. Just create a new sys-usb like qube but that isn't a disposable, launch it instead of sys-usb, and do the installation from there, and then delete it again afterwards. That way you avoid having to proxy the USB connections to another qube, but have direct access to the USB devices.

Thanks! I'll have to try that!

« Previous Page