# Add Gentoo Linux, Void Linux and Alpine Linux **URL:** https://discuss.privacyguides.net/t/add-gentoo-linux-void-linux-and-alpine-linux/12221 **Category:** Tool Suggestions **Tags:** rejected **Created:** 2023-04-02T05:38:39Z **Posts:** 11 ## Post 1 by @iloveprivacy0 — 2023-04-02T05:38:40Z In [Linux Hardening Guide by Madaidan](https://madaidans-insecurities.github.io/guides/linux-hardening.html), the author recommends the following suggestions for a secure Linux distro: > - Avoid distributions that freeze packages, as [they are often quite behind on security updates](https://madaidans-insecurities.github.io/linux.html#stable-release-models). > - Use a distribution with an init system other than [systemd](https://systemd.io/). systemd contains a lot of unnecessary attack surface and [inserts a considerable amount of complexity into the most privileged user space component](https://www.agwa.name/blog/post/how_to_crash_systemd_in_one_tweet); [it attempts to do far more things than necessary](https://ewontfix.com/14/) and goes beyond what an init system should do. An init system should not need many lines of code to function properly. While a common argument in favour of systemd is its ability to sandbox system services, this can be replicated on other init systems through sandboxing utilities like bubblewrap, [as documented below](https://madaidans-insecurities.github.io/guides/linux-hardening.html#sandboxing). > - Use [musl](https://musl.libc.org/) as the default C library. musl is heavily focused on minimality, which [results in very small attack surface](https://github.com/NixOS/nixpkgs/issues/90147#issuecomment-643473182), whereas other C libraries such as glibc are overly complex and prone to vulnerabilities. For example, [over a hundred vulnerabilities in glibc have been publicly disclosed](https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=glibc), compared to the [very few in musl](https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=musl). While counting CVEs by itself is often an inaccurate statistic, in this case, it represents an overarching issue and is symptomatic of underlying security issues. musl also has invested in [decent exploit mitigations](https://www.dustri.org/b/security-features-of-musl.html), particularly its [hardened memory allocator](https://www.openwall.com/lists/musl/2020/05/13/1), heavily inspired by GrapheneOS’ hardened\_malloc. > - Preferably use a distribution that utilises [LibreSSL](https://www.libressl.org/) by default rather than [OpenSSL](https://www.openssl.org/). [OpenSSL contains tremendous amounts of totally unnecessary attack surface and follows poor security practices](https://arstechnica.com/information-technology/2014/04/openssl-code-beyond-repair-claims-creator-of-libressl-fork/). For example, it still maintains OS/2 and VMS support — ancient operating systems that are multiple decades old. These abhorrent security practices are what led to the dreaded [Heartbleed vulnerability](https://en.wikipedia.org/wiki/Heartbleed). LibreSSL is a fork of OpenSSL by the OpenBSD team that applies [superior programming practices](https://en.wikipedia.org/wiki/LibreSSL#Changes) and [eradicates a lot of attack surface](https://opensslrampage.org/). Within LibreSSL’s first year, [it mitigated a large number of vulnerabilities, including a few high severity ones](https://www.openbsd.org/papers/libtls-fsec-2015/mgp00005.html). > > The best distribution to use as a base for your hardened operating system would be [Gentoo Linux](https://www.gentoo.org/), as it allows you to configure your system exactly how you want it to be, which will be extremely useful, especially when we come to [more secure compilation flags](https://madaidans-insecurities.github.io/guides/linux-hardening.html#hardened-compilation-flags) later in the guide. > > However, Gentoo may not be feasible for many people due to its significant usability pitfalls. In this case, [Void Linux](https://voidlinux.org/)’s musl build or [Alpine Linux](https://www.alpinelinux.org/) would be a good compromise. Note that this guide has been mentioned a lot on Reddit, so I also wonder how PG team thinks about it. If the arguments are still valid, shouldn’t we adopt the suggestions? Or are there more concerns that the guide failed to cover? Thanks! --- ## Post 2 by @dngray — 2023-04-02T07:04:23Z I’m not going to debate each point. I have used the distributions he suggests for various projects and purposes. The article does cherry pick certain points from history and tries to make some conclusion out of it. > Preferably use a distribution that utilises [LibreSSL](https://www.libressl.org/) by default rather than [OpenSSL](https://www.openssl.org/). In fact some distributions have changed back to OpenSSL. Alpine Linux being one of them as they had issues with it. Now they are thinking of changing back again [https://gitlab.alpinelinux.org/alpine/tsc/-/issues/28](https://gitlab.alpinelinux.org/alpine/tsc/-/issues/28). For regular desktop usage, void, alpine and gentoo are quite painful, and unless you want to do a lot of tinkering. The reason we like Archlinux (which I might add is one of the distributions Madaidan uses) is because of it’s reproducible builds. You probably don’t need optimized useflags (those can often cause crashes) and very specific edge cases. It’s not going to make your computer noticeably faster, and only marginally more secure, which can also be better achieved by something like Qubes-OS anyway. The whole hardening guide there lacks any specific threat model and I wouldn’t recommend using it because it unless you have a way to keep track of all the changes you’ve made. You should understand what each change means, and how it may impact your usage. There are a very manual changes to the distribution which will no doubt cause issues and be possibly overwritten with system updates. A question you should be asking yourself, is that if a distribution requires a 100 manual knobs to be changed to make it “secure” don’t you think there is some issue with the guide and suggestions? Alpine isn’t a very nice desktop distribution. Sure, it works well for containers (particularly as they don’t include init), but besides that it doesn’t really get a lot of real-world usage. I’ve used it before, it lacked things like polkit rules to decrypt encrypted removable storage, and lagged behind on using iptables-nftables for some significant amount of time. OpenRC is barely maintained and suffers from race conditions sometimes, is clunky and generally horrible to use. There was some effort to change to s6: [https://ariadne.space/2021/03/25/lets-build-a-new-service-manager-for-alpine/](https://ariadne.space/2021/03/25/lets-build-a-new-service-manager-for-alpine/) Most of the things mentioned in that guide aren’t particularly important for a device behind another firewall, such as a internet router. Regarding Musl, sure it’s nice to have support for that, but you can expect desktop based workloads to be less stable with it, particularly as there is less testing with it in general. Expect crashes, expect segfaults on desktop apps you might use. So there are pros/cons to a lot of things suggested there. We’re not saying that you shouldn’t use them if you’re willing to invest the time, just that we don’t have experience on that to provide any kind of assistance. The main reason we recommend Fedora, is because **out of the box** it has some pretty sane defaults. People like to link to Maidaidan’s articles without actually even understanding what they are talking about, because they think it makes them sound smart. That is why it gets linked on Reddit regularly. --- ## Post 3 by @anon73250778 — 2023-04-02T22:44:04Z Imagine if your grandmother read the PG guides that the team wrote, featuring Gentoo. Now she asks you to run Gentoo on her device _and keep it updated._ _All the time._ Also in granny’s mind, each time you refuse you update her machine, your inheritance decreases. Because of granny’s clout, she then tells and convinces her friends to switch to Linux and then you get to manage it too. Some switches to Void and some switches to Alpine… * * * You might not convince people to switch but when you do, it might turn into a support scaling issue in the future. --- ## Post 4 by @anon12632984 — 2026-07-19T02:12:22Z Yeah but why can’t you just add warnings saying “Note: these are some distributions we recommend, however proceed with caution”. You could say these distros are for experts only and use them at your own discretion. I use Alpine every day with no issues, and yeah there’s the occasional bug, but for more experienced users it’s a good privacy option. --- ## Post 5 by @overdrawn98901 — 2026-07-19T04:08:26Z > [@anon12632984](#): > > Note: these are some distributions we recommend, however proceed with caution Or stick to the inverse: just because it’s not recommended does not mean it’s a bad choice. --- ## Post 6 by @anon12632984 — 2026-07-19T05:59:56Z Ehh I’m not sure I agree. To each their own I guess. --- ## Post 7 by @overdrawn98901 — 2026-07-19T16:17:09Z There’s countless distros to choose from. Arguably the only distros recommended here are ones that provide secure defaults out of the box and does not have a steep learning curve (thought SecureBlue isn’t the easiest persay). I’d argue that Arch shouldn’t be recommended here, just Fedora and SecureBlue. And that’s someone from someone who used Arch and likes it. But I don’t think reproducible builds outweighs the effort and technical understanding for a layman user to make Arch more secure. If you know what you want, and evaluated a different distros is good for you, use it. Gentoo may likely perform better against some threat models. But one blanket PG recommendation won’t solve every users personal needs. --- ## Post 8 by @Tux — 2026-07-20T06:27:06Z Reminder: “madaidan” is just a blogger without publicly verifiable credentials. Many people who actually administer Linux systems disagree with him. See for instance this thread on [HackerNews](https://news.ycombinator.com/item?id=25590079). --- ## Post 9 by @user1 — 2026-07-20T07:14:12Z > [@Tux](#): > > Reminder: “madaidan” is just a blogger without publicly verifiable credentials. Well, not really. > My name is “madaidan”. I’m a security researcher [who works on various open source projects](https://github.com/madaidan), mainly [Whonix](https://www.whonix.org/). > **[madaidan - Overview](https://github.com/madaidan)** > > madaidan has 28 repositories available. Follow their code on GitHub. --- ## Post 10 by @sha123 — 2026-07-20T07:56:00Z > [@Tux](#): > > Reminder: “madaidan” is just a blogger without publicly verifiable credentials Reminder: Don’t discredit someone, just because you don’t understand his technical arguments. > [@Tux](#): > > Many people who actually administer Linux systems disagree with him There is a difference between sysadmins and security researchers. --- ## Post 11 by @Tux — 2026-07-21T00:56:49Z > [@sha123](#): > > Reminder: Don’t discredit someone, just because you don’t understand his technical arguments. I perfectly understand his arguments, and they don’t stand up to scrutiny. I find it hard to believe people here are willing to take any of what this self-proclaimed “security researcher” without verifiable credentials or experience says at face value. His “analyses” read more like dogmatic doctrine (see the systemd posts) and have been thoroughly debunked many times over on tech forums, so I won’t bother doing that here again.