# Add Brace, a toolkit to enhance privacy/security on Linux **URL:** https://discuss.privacyguides.net/t/add-brace-a-toolkit-to-enhance-privacy-security-on-linux/27298 **Category:** Tool Suggestions **Created:** 2025-05-05T14:46:18Z **Posts:** 15 ## Post 1 by @anonymous261 — 2025-05-05T14:46:18Z ### Check this box to affirm you have no conflict of interest. on ### Website > **[GitHub - divestedcg/Brace: Offers a wide range of opinionated settings that...](https://github.com/divestedcg/brace)** > > Offers a wide range of opinionated settings that prioritize privacy, security, and usability for a curated set of Linux programs. ### Short description @SkewedZeppelin 's configuration toolkit that can increase security and allow one to quickly install certain apps ### Why I think this tool should be added On Fedora Atomic, Brace has some overlap with secureblue’s configurations. However, unlike secureblue, Brace isn’t limited to just Fedora Atomic. It seems to be available on every PG recommended distro. (I’ve also been schooled on Brace multiple times so I can really see its usefulness :laughing:) > [@Linux malware can avoid syscall-based endpoint protection](https://discuss.privacyguides.net/t/linux-malware-can-avoid-syscall-based-endpoint-protection/27295/2): > > Both secureblue and my brace disable io\_uring. > [@Security comparison - GNOME and KDE Plasma](https://discuss.privacyguides.net/t/security-comparison-gnome-and-kde-plasma/26656/12): > > just use brace as a whole: it does that and way more: [GitHub - divestedcg/Brace: Toolkit compatible with multiple Linux distros that allows for installation of handpicked applications, along with corresponding configs that have been tuned for reasonable privacy and security.](https://github.com/divestedcg/brace) combine it with firejail, fapolicyd, [real-ucode](https://github.com/divestedcg/real-ucode), and my [hardened\_malloc](https://github.com/divestedcg/rpm-hardened_malloc) package (which now [supports](https://github.com/GrapheneOS/hardened_malloc/pull/252) buffer overflow checks) running brace-audit gives you the steps to do this all ### Section on Privacy Guides Linux Overview --- ## Post 2 by @KevPham — 2025-05-05T17:20:28Z What applications does Brace install for you? I haven’t had a close look at the repo yet, but it seems like it installs a hardened version of Chromium? I’d love any testimony from your experiences using it, if applicable. --- ## Post 3 by @anonymous261 — 2025-05-05T18:17:35Z I personally find that Brace’s applications are less important than the configurations. But Brace does help install stuff like Tor Browser without having to compile it from source or use the Tor Browser Installer, which is useful. --- ## Post 4 by @an9 — 2025-05-07T03:44:22Z Hello, I know the question wasn’t directed at me, but I want to share my experience. I’ll put here the direct link to the program package, to facilitate the discussion: > What can I say? When I used this Brace Toolkit, as mentioned by the other member, it only installs the settings you expect. To install the recommended programs you have to run a command built into toolkit. Once you’ve done that, it will give you suggestions: > INFO: This script is intended for use on desktop machines, not servers! > INFO: This script is geared towards personal use and some packages may not be appropiate for business systems! > > Would you like to simply install all recommended packages? > “Yes” “No” > > category=‘Internet’ > packagesFedora=‘firefox mozilla-ublock-origin chromium liferea’ > > category=‘Reference’ > packagesFedora=‘kiwix-desktop’ > > category=‘Tor’ > packagesFedora=‘tor torsocks onionshare torbrowser-launcher’ What new, or different, experience did I get from using the command? I chose to install the apps category by category and discovered Tor Browser Launcher! Being related to Tor Browser, I went to see if it was safe. Then I discovered (rediscovered) the author Micah Lee! Until then, even though I’d seen his name in other places, I hadn’t recognized it or given it due importance. Today I read his blog and remember his apps, thinking about demonstrations, human rights, etc. Anyway, my experience is that I discovered some cool new apps, which I installed for “fun” and “discovery”, uninstalled most of them, and used a few while I was on Linux, until I went back to Windows. --- ## Post 5 by @anonymous261 — 2025-05-14T00:03:39Z @anon63378630 Please let me know if you would prefer me to ask this elsewhere, but are there any plans for adding in Brace the option to replace GNU utils with [uutils](https://uutils.github.io/), sudo with [sudo-rs](https://github.com/trifectatechfoundation/sudo-rs), bash with [fish shell](https://github.com/fish-shell/fish-shell/pull/9512), and sysctl with [systeroid](https://github.com/orhun/systeroid)? I was considering opening up a topic to ask PG to suggest these replacements in the Linux Overview, but if Brace would be able to install them, PG recommending Brace would already do that. Thanks! --- ## Post 6 by @anon63378630 — 2025-05-14T03:48:35Z @anonymous261 changes like that would be out of scope and should be done by the distro --- ## Post 7 by @anonymous372 — 2025-07-24T20:04:23Z Would you be able to consider Phoenix instead of Arkenfox for Brace? > [@Phoenix, a suite of Firefox configurations](https://discuss.privacyguides.net/t/phoenix-a-suite-of-firefox-configurations/29410): > > Website [https://codeberg.org/celenity/Phoenix](https://codeberg.org/celenity/Phoenix)Short description Phoenix is a suite of configurations & advanced modifications for Mozilla Firefox, designed to put the user first - with a focus on privacy, security, freedom, & usability. Why I think this tool should be added@celenity People have been talking a lot about Arkenfox, so I thought this would be worth mentioning. Phoenix has hardening that Arkenfox and even Librewolf don’t have, on top of having updates as timely as stock Firefox. … --- ## Post 8 by @lucasmz — 2025-09-17T03:02:25Z I like Phoenix, I mean, some stuff annoys me sometimes, but it’s more due to BadBlock than anything, arkenfox is just like a simple base that requires the user to know more about security, e.g. you should disable Firefox’s password manager in favor of your own, whereas Phoenix makes these decisions the default for you. Having both brace and Phoenix collides though, I end up removing it from the build. Brace is very nice, there’s some annoying changes, like disabling connectivity checks, RFP in Firefox, dconf configs that modify things that are too personal, enables systemd-resolver’s broken DNSSEC validation, but otherwise, it’s a good starter. Personally I’ve had to [fork it]([lucasmz/brace-usability: Toolkit compatible with multiple Linux distros that allows for installation of handpicked applications, along with corresponding configs that have been tuned for reasonable privacy and security. - Codeberg.org](https://codeberg.org/lucasmz/brace-usability)) to try and solve these annoyances. The surrounding ecosystem though, with real-ucode and firejail builds though, is quite nice, real-ucode is a real lifesaver. Tavi themselves told me to run `dmesg | grep microcode`and that showed me my processor was vulnerable. Installing it solved it, always recommend updating your firmware though. This is something Secureblue doesn’t try to solve. The Phoenix developer also has a fork of Brace: [celenity/Slingshot - Codeberg.org](https://codeberg.org/celenity/Slingshot) --- ## Post 9 by @lucasmz — 2025-09-17T03:10:54Z Some notable things to me that Brace fixes for example are: blocks unauthenticated installs/removals with PackageKit on Fedora, enables opportunistic DoT, enables IPv6 privacy extensions (disabled on Fedora! as if it was a server or something! bad), uses NTS for secure time (helps with the use of time in TLS), MAC randomization in networking… All missing in the recommended by everyone Fedora. --- ## Post 10 by @doan — 2025-09-17T22:35:16Z Hi everyone, especially @anon63378630, thank you for creating Brace, it is very useful. Also, I would love to get feedback from Brace users. I’m not technical, so please excuse me if these questions seem basic. I am interested in using Firefox with ArkenFox via Brace on my Fedora GNOME system for better privacy and fingerprint protection, but I want some usability tweaks. Here are my ideas and questions: 1. ArkenFox “braced” as an upgrade? Does Brace’s modified ArkenFox/Firefox act as an enhanced version of plain ArkenFox? Is its goal to match or replace the Mullvad Browser in terms of privacy/fingerprint protection? How does it compare to the original ArkenFox in terms of protections (e.g., same base settings)? For advanced fingerprinting protection, I already use the Mullvad Browser, so I don’t see much advantage in using Firefox with Brace’s default setup. 2. I’d love to use ArkenFox braced, but I would adjust a few things for daily use, like: - Setting RFP `privacy.resistFingerprinting` to false (for dark mode support). - Setting `privacy.resistFingerprinting.letterboxing` to false (for max screen resolution). - Setting `javascript.options.wasm` to true. I know this weakens fingerprinting resistance. It seems counterintuitive to tweak a hardened setup just to make it practical for daily use. Would it be better to use standard Firefox with the recommended configuration + uBlock Origin, or even Brave (which I’m not a big fan of)? What would be the minimum level of protection I would still have? 1. With Brace’s ArkenFox, it seems impossible to add extensions or new languages via Firefox UI (tested a few). Is this by design? How do I safely add something like a language pack without compromising security? Is it through user-overrides.js or something similar? Overall, Brace seems ideal for folks like me who can’t manually configure ArkenFox, and I really appreciate its combination of Firefox hardening with other good tools. Any tips for my Fedora setup? Thanks! :grinning_face: --- ## Post 11 by @anon63378630 — 2025-09-20T13:59:35Z > [@doan](#): > > plain ArkenFox ArkenFox is a template, brace changes some few settings as marked with the `//BRACE` comments > [@doan](#): > > match or replace the Mullvad Browser no, you should still make use of Mullvad and Tor Browser where appropriate, but just use eg. Braced Firefox as your eg. good/safe/login only browser. > [@doan](#): > > but I would adjust a few things for daily use I do not recommend making any changes like that. > [@doan](#): > > impossible to add extensions extensions are purposely blocked for security, nearly all of them are a risk > [@doan](#): > > or new languages via Firefox UI (tested a few) this is new to me, I always assumed they were bundled, I’ll look into it --- ## Post 12 by @lucasmz — 2025-09-21T13:18:29Z > [@doan](#): > > I’d love to use ArkenFox braced, but I would adjust a few things for daily use, like: Brace’s Arkenfox is not very different from upstream; if you check [brace/usr/lib/firefox/browser/defaults/preferences · master · Divested Computing Group / Brace · GitLab](https://gitlab.com/divested/brace/-/tree/master/brace/usr/lib/firefox/browser/defaults/preferences?ref_type=heads) and check for “BRACE” inside of the arkenfox file, it’s mostly disabling JIT, enabling RFP instead of FPP, and disabling some other features, and some fixes because arkenfox isn’t intended to be installed this way; Phoenix’s JIT settings seem a bit more mature: [Making sure you're not a bot!](https://codeberg.org/celenity/Phoenix/src/commit/c380a04b76eafdc47fc9cea5dc6515df007d0f5e/build/phoenix-unified.js#L1747) there’s a few more flags being messed with than the ones in arkenfox+brace and an important note about WASM requiring JIT --- ## Post 13 by @lucasmz — 2025-09-21T13:27:58Z > [@anon63378630](#): > > extensions are purposely blocked for security, nearly all of them are a risk I could understand this if it excluded password managers, you can’t even install Bitwarden or KeePass: [brace/usr/lib/firefox/distribution/policies.json · master · Divested Computing Group / Brace · GitLab](https://gitlab.com/divested/brace/-/blob/master/brace/usr/lib/firefox/distribution/policies.json#L31) which to me is more likely to allow for phishing attacks, as now the user has to copy passwords and paste them in, and so the basic URL checks provided by a password manager is lost; also the support for manager passkeys are lost, not only that but now they’re passing through the boundary of the desktop instead of staying somewhat contained into the browser, and other apps can read that password from the clipboard, which isn’t secure in desktop environments --- ## Post 14 by @asanyan — 2025-09-21T15:37:02Z > [@lucasmz](#): > > other apps can read that password from the clipboard if unconfined, the number of ways a desktop app can spy on the user is infinite. If the clipboard specifically is a concern, you can always use autotype functionality. Also, things like [https://discuss.privacyguides.net/t/zero-day-clickjacking-vulnerabilities-in-major-password-managers](https://discuss.privacyguides.net/t/zero-day-clickjacking-vulnerabilities-in-major-password-managers) aren’t possible with desktop password managers --- ## Post 15 by @doan — 2025-11-05T22:09:08Z Thank you all for your responses and clarifications. To ensure better compatibility, is it best to stick with the default ArkenFox? After all, it’s a flexible template, and I’m prioritizing compatibility over privacy, security, and fingerprint resistance. However, I’m still looking for a middle ground. I suppose you don’t recommend this modification because it goes against the purpose of Brace. Could these changes be overwritten or removed during future Brace updates? I’d like to continue using Brace for its additional tools while keeping the default ArkenFox untouched. Is that possible?