enabling a lot of the privacy features like resist fingerprinting often breaks login flows
True. Though, in this case, it's only enabled on hardened. So, the default config doesn't enable it.
and breaks dark mode detection on site
Yeah, that's really unfortunate. I suppose there's Dark Reader. But, I believe Arkenfox' maintainers held the opinion that a bandaid solution as such did more harm then worth it. At least for those that enable RFP for the sake of fingerprint protection.
Thanks for sharing.
Thanks for the appreciation!
Our goal is to continue the legacy of Mull by providing a free and open source, privacy and security-oriented web browser for daily use.
Do you work on IronFox?
Do you think I could run secure blue from a USB drive?
I'm not sure if it's exactly the same, but Jorge Castro (one of uBlue's maintainers) showed how some uBlue projects (perhaps this also applies to secureblue) can be installed on an external drive. Perhaps it's worth a look: https://www.youtube.com/watch?v=5DRaYQ6hKU0
I didn't downvote myself, but did consider it.
For one, it felt a bit out of place; Fedora isn't defined by systemd, nor Red Hat or IBM. One clear example would be how Fedora has chosen to stick with Btrfs; contrary to Red Hat's demands. Don't get me wrong, I don't deny any partnership or whatsoever. But it's not like Fedora's community has no agency.
Secondly, corsicanguppy's comment seems to imply that Fedora only sticks to systemd out of some obligation towards IBM/RedHat or something. As if the overwhelming majority of distros don't default to systemd.
Thirdly, Poettering works for M$ now. Sure. But systemd remains a Linux project. And quite a good one at that. Even if the likes of dinit and s6 are starting to offer some healthy competition, it's undeniable that systemd continues to have the advantage in terms of received man-hours (in development) and adoption. I hope that Fedora eventually gives others the chance to shine. But outright ditching systemd without a perfect replacement is just foolish.
Systemd is bloated
The bloat argument has absolutely no weight as long it's not properly defined. One's bloat is the other's sane default and vice versa. Please, if you're engaging in good faith, come up with a definition by which the likes of dinit and/or s6 are not bloated while systemd is. Please be complete and rigorous in your assessment.
and known to present security risks.
If you're referring to what's addressed in Madaidan's article, you should not forget that Whonix -the very distro Madaidan used to be a security researcher at- employed systemd to enhance security. And while one might say a lot about Poettering, one simply can't deny that they've got a sound understanding of good security standards and how to implement them. It's therefore unsurprising that both Kicksecure and secureblue (i.e. Linux' finest when it comes to hardened distros) heavily rely on systemd for their bidding.
Don’t see why looking at alternatives wouldn’t be seen as positive growth.
At least we can agree on this 😉.
Yeah, it seems that they even acknowledge that Tor and Mullvad are better for extreme threat models.
"The only browsers that can provide sophisticated fingerprinting protection against advanced scripts are Tor Browser & Mullvad Browser.
If you have an extreme threat model (Ex. Political dissident, journalist, or if you are in some other kind of high risk situation), please use one of those browsers."
I suppose we'd have to commend them for being fair.
Unfortunately, I've yet to experience Qubes OS myself. So I can't help you with that. Wish ya the best of luck though!
I hope at least the earlier problems with distrobox have been solved.
Is your intention to go in the direction of Qubes OS with extra steps?
Yo OP, did it work out in the end?
Thanks a ton for the elaborate answer!
I’ve moved to cachy OS mainly because I needed to get certain things working that were only packaged in appimage
Hmm..., I'm aware that the AppImage situation is pretty dire since it requires FUSE 2 libs while everyone and their grandmothers have moved to FUSE 3; software that's been almost out for a decade now. Thankfully, I've never actually experienced trouble getting it to work on any distro. Sure, installing some libs was often required, but nothing too fancy.
BUT I believe I could have worked it out in Aeon by fiddling around with distrobox
FWIW, I'm 100% positive that you could get it to work on Aeon. IIRC, I've also used AppImages through distrobox containers.
I think once there is a mature wayland-based Openbox replacement
Interesting. If it isn't too much of a trouble, could you pitch Openbox :P for me? I'm not too familiar with it, but you did get me curious.
(eyes on labwc)
Put into my backlog of stuff I've got to checkout.
I was hoping that this reply wasn't needed 😅. In all fairness, some of the replies found on ycombinator definitely offer legitimate criticism. However, secureblue's dev team didn't just ignore all of that as they can be found discussing on the very same thread. Since then, they've actually implemented changes addressing these concerns. For example:
Trading off possible kernel bugs against letting a whole LOT of userspace software run with real root privilege. And flatpak is a lot of attack surface no matter how you run it, and the packages have a bad security reputation.
This was raised as a good objection to some of its design choices. This eventually lead secureblue's dev team to maintain twice as many images for the sake of offering images in which this was handled differently. And it didn't stop there, it has continued to output a lot of work addressing concerns both found on that thread and outside of it. Consider looking into its commit history. Heck, even some of the GrapheneOS-people have provided feedback on the project.
Of course, no one dares to claim it comes close to Qubes OS' security model. Nor is this within scope of the project. However, apart from that, I fail to name anything that's better. Kicksecure is cool, but they've deprecated Hardened Malloc; a security feature found on GrapheneOS and that has been heavily inspired by OpenBSD's malloc design. By contrast, secureblue hasn't abandoned it. Heck, it elevated its use by allowing it to be used with Flatpak; something that hasn't been done on any other distro yet. This is just one example in which the secureblue dev team and its various contributors have shown to be very competent when it comes to implementing changes that improve security beyond trivial checkboxes.
Peeps may name other hardening projects. But fact of the matter is that I'm unaware of another hardened Linux project that's quite as feature-rich:
Please feel free to inform me if I've forgotten anything. So, basically, if you want a hardened daily driver for general computing, then one simply has to choose between Kicksecure and secureblue. I wish for both projects to flourish, but I've stuck with the latter for now.
Do you run Steam inside gamescope as well ?
Nope I don't. But that's because running Steam isn't really a thing for me to begin with. I don't own my games through Steam aside from a couple that are only accessible through it. Whenever I need to play those, I access those through another system; be it another distro or (God forbid) M$. For the games I've played on secureblue, none of them were owned through Steam. Hence, running Steam inside gamescope has not been something I had to do yet. Unsure, if it even works as supposed.
Does your setup support casks ?
I actually don't know. It probably doesn't, though. EDIT: Found the following within Bluefin's documentation: "Note that the cask functionality in homebrew is MacOS specific and non functional in Bluefin, flatpak is used instead."
Very enlightening! Thank you so much!
This is actually unfortunate for me. I seem to be prone to RSI related aches. Keyboard is fine~ish. But mouse can be pretty troublesome. Do you happen to know if it plays nice with trackballs and/or trackpads?