5 ms·

> Any suggestions which distro takes security serious? OpenBSD.

ncmncm 5y ago
On the "base install". OpenBSD's attitude is, if you install insecure 3rd party code, it's on you. QubesOS, based on Xen hypervisor, provides compartmented security: a hole in an app need not provide access to anything else. You have multiple mostly long-running VMs for different roles. Hardware access is managed in VMs that do not run app code. 16GB RAM is just barely enough, and apps get no access to a GPU. But it's solid and mature. The 4.1 release, due someday, has had a lot of UX attention. SpectrumOS is an an attempt at lighter-weight security. Based on NixOS, apps run in a minimal, temporary VM spun up just for the app, sub-second, for experience more like Docker than Virtualbox. Still very much under development. Donate to Alyssa Ross on Github to accelerate dev work.
- lokedhs 5y ago
  This is the best answer. Qubes OS is really the only practical way to run Linux in a secure manner right now. Its isolation features are not just useful for security, it makes experimentation really easy as one of never has to worry about messing up the installation. Spectrum may be an option in the future, and I really hope it succeeds.
  - messe 5y ago
    Fedora Silverblue is becoming interesting as well, especially with "Toolbox" a tool that lets you quickly spin up relatively isolated containers as long-lived development environments, separated from the main OS-installation.
    - lokedhs 5y ago
      Silverblue has some promise. However, at this point, security is not a consideration. Toolbox is nice, and gives some of the convenience that you get from Qubes, but unfortunately none of the security. Code running in a toolbox container still has access to the user's home directory, and based on the bug reports on the topic, there are no plans to address this limitation.
      - messe 5y ago
        > Code running in a toolbox container still has access to the user's home directory, and based on the bug reports on the topic, there are no plans to address this limitation. I knew it could have access, but damn, I expected that would be optional. That's disappointing. It's a real shame. With some additional hardening, it could achieve a nice balance between convenience and security.
- ncmncm 5y ago
  I should add that QubesOS has the only secure X environment ever. The central VM ("dom0") controls the actual screens and input devices. Each VM runs its own X server, writing to a raw memory buffer. dom0 copies window contents from those buffers to windows on the real screens, and forwards input from events that address a window to (only) the right VM. SpectrumOS is built around Wayland instead. Microphone and camera streams are, likewise, forwarded from dom0 to whatever VM you select to receive them, if any. USB gadgets you plug in, similarly, may be operated by the VM of your choice.
zokula 5y ago
OpenBSD is donkey brains for security. MS-DOS is more secure than OpenBSD.
brobinson 5y ago
https://isopenbsdsecu.re https://isopenbsdsecu.re Slide 43 is worrying.

On the "base install". OpenBSD's attitude is, if you install insecure 3rd party code, it's on you. QubesOS, based on Xen hypervisor, provides compartmented security: a hole in an app need not provide access to anything else. You have multiple mostly long-running VMs for different roles. Hardware access is managed in VMs that do not run app code. 16GB RAM is just barely enough, and apps get no access to a GPU. But it's solid and mature. The 4.1 release, due someday, has had a lot of UX attention. SpectrumOS is an an attempt at lighter-weight security. Based on NixOS, apps run in a minimal, temporary VM spun up just for the app, sub-second, for experience more like Docker than Virtualbox. Still very much under development. Donate to Alyssa Ross on Github to accelerate dev work.

lokedhs 5y ago
This is the best answer. Qubes OS is really the only practical way to run Linux in a secure manner right now. Its isolation features are not just useful for security, it makes experimentation really easy as one of never has to worry about messing up the installation. Spectrum may be an option in the future, and I really hope it succeeds.
- messe 5y ago
  Fedora Silverblue is becoming interesting as well, especially with "Toolbox" a tool that lets you quickly spin up relatively isolated containers as long-lived development environments, separated from the main OS-installation.
  - lokedhs 5y ago
    Silverblue has some promise. However, at this point, security is not a consideration. Toolbox is nice, and gives some of the convenience that you get from Qubes, but unfortunately none of the security. Code running in a toolbox container still has access to the user's home directory, and based on the bug reports on the topic, there are no plans to address this limitation.
    - messe 5y ago
      > Code running in a toolbox container still has access to the user's home directory, and based on the bug reports on the topic, there are no plans to address this limitation. I knew it could have access, but damn, I expected that would be optional. That's disappointing. It's a real shame. With some additional hardening, it could achieve a nice balance between convenience and security.
ncmncm 5y ago
I should add that QubesOS has the only secure X environment ever. The central VM ("dom0") controls the actual screens and input devices. Each VM runs its own X server, writing to a raw memory buffer. dom0 copies window contents from those buffers to windows on the real screens, and forwards input from events that address a window to (only) the right VM. SpectrumOS is built around Wayland instead. Microphone and camera streams are, likewise, forwarded from dom0 to whatever VM you select to receive them, if any. USB gadgets you plug in, similarly, may be operated by the VM of your choice.

zokula 5y ago

OpenBSD is donkey brains for security. MS-DOS is more secure than OpenBSD.

brobinson 5y ago

https://isopenbsdsecu.re https://isopenbsdsecu.re Slide 43 is worrying.