5 ms·

Obscurix – Arch Linux-based OS configured for privacy, security and anonymity

88 points by URfejk 6y ago

alex_reg 6y ago
A comparison with Tails would be nice. A big difference is the base distro. I used Arch for many years, so I love it as daily driver. But for a security-critical context such as this, Debian with it's stability and very security-aware package maintainership seems like a better choice. Some answers are in the FAQ: https://obscurix.github.io/faq.html https://obscurix.github.io/faq.html
- URfejk 6y ago
  >But for a security-critical context such as this, Debian with it's stability and very security-aware package maintainership seems like a better choice. Or Centos.
  - qz2 6y ago
    This. Rationale is SELinux.
    - joana035 6y ago
      Linux security modules, always good to have. AppArmor, SELinux, Smack, and TOMOYO are good examples.
  - eikenberry 6y ago
    In my experience CentOS means EPEL and EPEL means throwing that stability and security-aware packaging out the window.
- deleted 6y ago
  [deleted]
ExcavateGrandMa 6y ago
"Obscurix is not finished yet. It is still in alpha. Do not rely on it for anonymity or stability yet." something bugging me :Ð
tipoftheiceberg 6y ago
How does this compare to Qubes+Whonix ?
- baobabKoodaa 6y ago
  > How does this compare to Qubes+Whonix ? From Obscurix FAQ: "Whonix is another anonymity focused operating system. It is meant to be run inside virtual machines instead of from a USB like Obscurix. Whonix has a more leak-proof method of forcing all traffic through Tor but it isn't amnesiac or forensics resistant like Obscurix." Basically, Whonix requires a VM sandbox escape in order to leak your IP address. Obscurix does not have any comparable protection against malicious applications leaking your IP address. The purported advantage of Obscurix is its "amnesiac" property, but it doesn't sound very compelling. Everyone should be using full disk encryption in any case, regardless of what OS they are running or what other steps they are taking to improve security. It's not clear to me why I should care about the amnesiac property of the OS when everything is encrypted.
  - jchw 6y ago
    Amnesiac is a level above FDE. You can’t be compelled to decrypt that which does not exist.
    - baobabKoodaa 6y ago
      Can you describe to me a practical use case where use of Amnesiac is warranted, but encryption of data is not? If you're uploading whistleblower documents to Wikileaks, sure you could use Amnesiac to do the upload, but where are the documents? Are they on an unencrypted USB stick? You clearly need encryption for this use case. Are you buying/selling drugs on the Tor network? You probably need some cryptocurrency keys, where are they? On a USB stick in plain text? You clearly need encryption for this use case. Or maybe you're a security researcher who's trying to anonymously report a vulnerability to a corporation that's known to go after researchers. Where is your poc code? On an unencrypted USB stick? You clearly need encryption for this use case.
mlvljr 6y ago
Misread as "configured for piracy" :V
bobbyd3 6y ago
I understand the use cases for certain Linux distribution spinoffs that can eliminate complexity but it also breaks my heart when they use an ultra customizable distribution like Arch Linux. Typically, I will [1] customize my own installation media to do or contain whatever software or configurations I need without a third-party making assumptions for me. This is quite possibly what I like most about Arch Linux. I know what is going on under the hood because I set it up. I'm likely not a typical user for most spinoffs. I use Arch Linux, FreeBSD, Gentoo, RHEL, Debian, SLES, and Ubuntu for different use cases as required. [1] https://wiki.archlinux.org/index.php/archiso https://wiki.archlinux.org/index.php/archiso *EDIT: Forgot and added a couple distros that I actively use (wish I could consolidate to one. Maybe one day)

88 points by URfejk 6y ago

A comparison with Tails would be nice. A big difference is the base distro. I used Arch for many years, so I love it as daily driver. But for a security-critical context such as this, Debian with it's stability and very security-aware package maintainership seems like a better choice. Some answers are in the FAQ: https://obscurix.github.io/faq.html https://obscurix.github.io/faq.html

URfejk 6y ago
>But for a security-critical context such as this, Debian with it's stability and very security-aware package maintainership seems like a better choice. Or Centos.
- qz2 6y ago
  This. Rationale is SELinux.
  - joana035 6y ago
    Linux security modules, always good to have. AppArmor, SELinux, Smack, and TOMOYO are good examples.
- eikenberry 6y ago
  In my experience CentOS means EPEL and EPEL means throwing that stability and security-aware packaging out the window.
deleted 6y ago
[deleted]

ExcavateGrandMa 6y ago

"Obscurix is not finished yet. It is still in alpha. Do not rely on it for anonymity or stability yet." something bugging me :Ð

tipoftheiceberg 6y ago

How does this compare to Qubes+Whonix ?

baobabKoodaa 6y ago
> How does this compare to Qubes+Whonix ? From Obscurix FAQ: "Whonix is another anonymity focused operating system. It is meant to be run inside virtual machines instead of from a USB like Obscurix. Whonix has a more leak-proof method of forcing all traffic through Tor but it isn't amnesiac or forensics resistant like Obscurix." Basically, Whonix requires a VM sandbox escape in order to leak your IP address. Obscurix does not have any comparable protection against malicious applications leaking your IP address. The purported advantage of Obscurix is its "amnesiac" property, but it doesn't sound very compelling. Everyone should be using full disk encryption in any case, regardless of what OS they are running or what other steps they are taking to improve security. It's not clear to me why I should care about the amnesiac property of the OS when everything is encrypted.
- jchw 6y ago
  Amnesiac is a level above FDE. You can’t be compelled to decrypt that which does not exist.
  - baobabKoodaa 6y ago
    Can you describe to me a practical use case where use of Amnesiac is warranted, but encryption of data is not? If you're uploading whistleblower documents to Wikileaks, sure you could use Amnesiac to do the upload, but where are the documents? Are they on an unencrypted USB stick? You clearly need encryption for this use case. Are you buying/selling drugs on the Tor network? You probably need some cryptocurrency keys, where are they? On a USB stick in plain text? You clearly need encryption for this use case. Or maybe you're a security researcher who's trying to anonymously report a vulnerability to a corporation that's known to go after researchers. Where is your poc code? On an unencrypted USB stick? You clearly need encryption for this use case.

mlvljr 6y ago

Misread as "configured for piracy" :V

bobbyd3 6y ago

I understand the use cases for certain Linux distribution spinoffs that can eliminate complexity but it also breaks my heart when they use an ultra customizable distribution like Arch Linux. Typically, I will [1] customize my own installation media to do or contain whatever software or configurations I need without a third-party making assumptions for me. This is quite possibly what I like most about Arch Linux. I know what is going on under the hood because I set it up. I'm likely not a typical user for most spinoffs. I use Arch Linux, FreeBSD, Gentoo, RHEL, Debian, SLES, and Ubuntu for different use cases as required. [1] https://wiki.archlinux.org/index.php/archiso https://wiki.archlinux.org/index.php/archiso *EDIT: Forgot and added a couple distros that I actively use (wish I could consolidate to one. Maybe one day)