cross-posted from: https://futurology.today/post/1308742

Hey guys, first post here and on an alt, I hope I don’t get flamed. If there’s not enough info I’ll post another thread tomorrow.

Its been ~5-7 years since using Linux (Ubuntu/Kubuntu/Debian/Mint/Fedora/etc) as my daily driver. Windows since then for dev and games with kids, but now I have a laptop that can run my dev env in a VM.

I’m an advocate for privacy and security, but I’m also at the “config once, mostly work for a while” camp… I don’t like spending a ton of time fixing things. I don’t need Whonix or QubesOS-level compartmentalization (unless it runs Barbone’s now), but I tried OpenSuse Tumbleweed on a recommendation and the fine-tuning of flatpak controls seemed really nice. I’d love to be able to sandbox as much as possible without breaking things. Memory and exploit-hardened kernel/apps is a huge plus. Basically GrapheneOS as a Linux distro would be fantastic, even though it comes with its own issues.

Am I overthinking here? Should I commit to Debian, Fedora, or OpenSuse and learn to sandbox and harden properly (if so which has best docs and community)?

I forgot the copy-paste specs my laptop hardware info to my phone earlier, but its an HP Victus 15-fa0032dx

HP Victus 15.6" 144Hz FHD IPS Gaming Laptop (Intel i7-12650H 10-Core, 16GB DDR4, 512GB SSD, RTX 3050 Ti 4GB GDDR6), Backlit KYB, WiFi 6, BT 5.2, HD Webcam

I don’t use the Bluetooth or webcam, so those drivers aren’t necessary. Does Wayland work for this, and is that really necessary?

Sorry for the noob questions. Mid-30s guy with kids wanting to get this done this week if possible. Please excuse spelling and grammar mistakes.

SIDE NOTE: NOT AT ALL opposed to learning new systems, especially for security, as long as it doesn’t require hunting down obscure undocumented commands.

Thanks all

  • sugar_in_your_tea@sh.itjust.worksEnglish
    2·
    6 months ago

    Since you’ve used OpenSUSE Tumbleweed already, look at MicroOS, which is a container-based OS with an immutable system layer. As long as everything you need can be installed via flatpak and other containers, you should be good to go. Since your dev workflow is in a VM, it should work for you.

    It’s still in release candidate mode, but there’s both GNOME and KDE options to pick from (Aeon amd Kalpa respectively).

    I can’t speak to the security or privacy of either, but i’ve found openSUSE generally to have rapid updates and to generally be a well operated distro. I use Tumbleweed personally, but my whole dev flow is on the linux command line, so your experience may differ.

    • FutureProofBackdoors@futurology.todayOPEnglish
      2·
      6 months ago

      I’d say about half of what I do is command-line (VMs, host OS being Windows). I am liking tumbleweed but I need to actually install it to see how it plays with my graphics card.

      Since they’re new to me, how easy can/how often are malicious flatpaks introduced to the ecosystem and are they vetted somehow? It’s my understanding (at least for docker) that they aren’t virtualized so they share kernel functionality meaning any image is just a priv esc away from moving outside the container.

      • sugar_in_your_tea@sh.itjust.worksEnglish
        3·
        6 months ago

        Here’s how I see it:

        • repository apps are vetted to some degree, but that’s obviously limited on rolling release distros like Tumbleweed
        • flatpaks usually come from the devs directly and sandboxing is up to them, and you can modify it yourself
        • flatpaks bundle their own dependencies, package managers maintain a common set of dependencies - flatpaks probably ship more exploiitable liberties, but it’s sandboxed, whereas an exploit in a system package could have broader impact
        • distros frequently ship a sandbox like SELinux with provided packages configured for it

        There’s no clear winner hear. Do you trust the devs or the OS maintainers more? Do you trust flatpak’s sandbox or the system sandbox more? Does the difference actually matter for you?

        I think both are good options. Just pick a well maintained project and you’ll probably be fine.