3 ms·
Yes, Fedora Silverblue would be my recommendation for something balancing security but being mainstream enough. If you want more mainstream you could go with v
by Iolaum 2y ago
Yes, Fedora Silverblue would be my recommendation for something balancing security but being mainstream enough.
If you want more mainstream you could go with vanilla Fedora or some spins if you are opinionated about your desktop environment.
If you want more security you can look at things like QubesOS.
- nicecars 2y agoFedora Silverblue's Secure Boot is also primarily for UEFI support and not fundamentally designed to create a boot chain or detect attacks on the OS. Additionally, it has weaknesses in kernel protection mechanisms (insufficient kernel module loading restrictions), inadequate system call protection, and incomplete memory protection mechanisms. While its immutable design is notable, the detection and defense mechanisms against base system attacks are inadequate, with limited security verification of the rpm-ostree system itself. Linux distributions' exploit mitigation features include basic ASLR, DEP, and RELRO, but their implementations are incomplete. Advanced protection features like those found in macOS (such as PAC, Pointer Authentication, strict stack protection, and JIT spray attack prevention) are either not implemented by default or are limited in scope. Resolving these issues would require an enormous investment of time and cost to apply parameters and patches, and these solutions are not available by default. While QubesOS's approach is interesting, it lacks Secure Boot, and its security relies on sandboxing through OS isolation via the Xen hypervisor, while the operating systems within still contain the aforementioned issues (though running a macOS-level secure OS in QubesOS might be a solution).