# Best Linux x11 DE **URL:** https://discuss.privacyguides.net/t/best-linux-x11-de/29328 **Category:** Off Topic **Created:** 2025-07-22T15:26:58Z **Posts:** 40 ## Post 1 by @PaulF — 2025-07-22T15:26:58Z Hello, It’s known that Wayland DEs (GNOME & KDE) must be chosen over x11 DEs ; Yet, **among the x11 DEs** (Xfce, Lxqt, Mate…), is there one DE that offers a supplement of security over the others ? Thanks, --- ## Post 2 by @KevPham — 2025-07-22T15:35:17Z Security wise, there is not a significant difference among X11 DEs. The difference can be seen between X11 and Wayland itself, not the DEs. I wouldn’t place too much emphasis on DEs over an actual hardened configuration. --- ## Post 3 by @PaulF — 2025-07-22T16:32:05Z > [@KevPham](#): > > over an actual hardened configuration. toward a Wayland DE ? --- ## Post 4 by @Cyber-Typhoon — 2025-07-22T16:40:59Z @KevPham correct me if I’m not following you but I think what you are trying to point is that the focus on selecting a DE for security may not be necessarily a primarily thing. Applying certain settings/configurations such as kernel hardening, LUKS2, TPM2, Appamor or SELinux, Secure Boot, Firewall, DNS mask, MAC randomization, Fapolicyd, AIDE, Audting/Monitoring SUID binaries and logs from your system, adopting security practices such as updating firmware of your system, running applications sandboxed, etc… should be a primarily focus. --- ## Post 5 by @user1 — 2025-07-22T16:42:37Z > [@PaulF](#): > > Yet, **among the x11 DEs** (Xfce, Lxqt, Mate…), is there one DE that offers a supplement of security over the others ? He’s asking specifically about DEs --- ## Post 6 by @Cyber-Typhoon — 2025-07-22T16:47:06Z Yeah, I got that. I was trying to clarify what I think @KevPham was saying in the additional line. OP’s question about DE related to security of x11 was already address in @KevPham first sentence and seems clear to me. --- ## Post 7 by @anon11657877 — 2025-07-22T16:47:36Z None of them since they all use X11 anyways. The only ones that offer security over the others are the Wayland DEs that properly secure privileged Wayland protocols (so only GNOME and KDE), and even then GNOME is still ahead since it sandboxes thumbnailers and it was faster to implement permission controls. But many of us don’t want to use GNOME because of performance or usability issues. If it’s the non-standard environment (most people come from Windows) that people have difficulty adjusting to. They have a choice. Either they can use KDE or a less secure desktop environment which has always been slower to adopt security features, or they can install GNOME system extensions which is like asking to get hacked. X11 desktops aren’t secure and cannot be made secure since you’re using X11 which doesn’t even implement GUI isolation and it’s a huge sandbox escapade. So as for which one to use (Xfce, LXQt, Mate…) just pick whichever one works for you I guess. Some of these desktop environments might have experimental Wayland support. --- ## Post 8 by @TheDoc — 2025-07-22T18:38:06Z I’d first like to reiterate that you really should try to stick to a Wayland DE which [secures privileged Wayland protocols](https://secureblue.dev/images#security-recommendation). No X11 desktop is reasonably secure due to the complete lack of GUI isolation. > [@PaulF](#): > > Yet, **among the x11 DEs** (Xfce, Lxqt, Mate…), is there one DE that offers a supplement of security over the others ? I remember there were discussions in the Kicksecure community where they mentioned that there are security and privacy concerns with [GNOME](https://www.kicksecure.com/wiki/Dev/GNOME) (and [KDE](https://www.kicksecure.com/wiki/Dev/KDE)?) beyond Wayland. For various reasons including said concerns, they want to stick to minimal desktops. Kicksecure and Whonix use Xfce but I heard they may be switching to LXQt due to its more active development and quicker adoption of Wayland. So if you had to use X11, you might be better off with the most minimal desktop. Xfce development seems to have slowed quite a bit, so I’m thinking LXQt might be the way to go. MATE is pretty minimal too but hasn’t come up in discussion as they’re also behind in Wayland adoption. It would therefore seem that KDE (X11), Pantheon, Cinnamon, Deepin, etc, might be the worst options in this regard, but to be honest I might be splitting hairs. --- ## Post 9 by @PaulF — 2025-07-23T13:31:48Z > [@TheDoc](#): > > there were discussions in the Kicksecure community where they mentioned that there are security and privacy concerns with [GNOME](https://www.kicksecure.com/wiki/Dev/GNOME) (and [KDE](https://www.kicksecure.com/wiki/Dev/KDE)?) beyond Wayland Actually, can the enhancements offered by Kicksecure fix the lack of GUI isolation of x11 DEs (in this case Xfce), as well as their other drawbacks ? --- ## Post 10 by @TheDoc — 2025-07-23T14:26:35Z Unfortunately not, there is absolutely [no isolation](https://theinvisiblethings.blogspot.com/2011/04/linux-security-circus-on-gui-isolation.html) between programs running within the same X server. This issue currently exists for every X11 window manager. The only OS which has sort of mitigated this problem is QubesOS, not because they fixed X11 but because isolation can be provided by the Xen hypervisor. I’ve heard rumours that Xlibre (fork of Xorg) is going to try to address this, but I’m doubtful as to whether that’ll actually materialize. --- ## Post 11 by @PaulF — 2025-07-24T10:57:46Z Which configuration do you think is best in a security viewpoint : Debian + Wayland DE OR Debian + Kicksecure + x11 DE (Xfce) (I’ve mentioned Debian because Kicksecure targets this distro) --- ## Post 12 by @TheDoc — 2025-07-24T12:37:30Z It’s hard to say, there’s pros and cons to both and I’m not really qualified to say which is better overall. I’d encourage people try to stick to [PG recommended distros](https://www.privacyguides.org/en/desktop/) like Fedora Workstation or Secureblue. Workstation (or the KDE variant) should be usable for most users and Secureblue appears to be the most secure option. PG does mention Kicksecure, but it should only be considered if you require the use of a Debian-based distro for some reason. If I were in that camp and looking to maximize security, I’d look into using Kicksecure and swapping out Xfce for GNOME, KDE, or LXQt (Wayland). I assume they have documentation or forum posts discussing what downsides there could be to moving away from Xfce. --- ## Post 13 by @anon11657877 — 2025-07-24T15:31:00Z So a perpetually outdated distro + a desktop with GUI isolation and possibly secure privileged protocols or a perpetually outdated distro + some hardening a lot of which made useless because you’re still using x11 which is a huge sandbox escapade Why is Kicksecure recommended again? --- ## Post 14 by @KevPham — 2025-07-24T15:52:46Z > [@TheDoc](#): > > I assume they have documentation or forum posts discussing what downsides there could be to moving away from Xfce. As you mentioned earlier, A lot of these “downsides” mentioned by the KickSecure and Whonix devs revolve around their personal frustrations with bloatware and minimalism. The developers simply have more experience working with XFCE and have certain philosophical design choices. While that is completely understandable for a volunteer development team (and should be respected), I don’t know why these “security-oriented” projects are still insistent on XFCE after the overwhelming evidence in support of Wayland-based DEs. I even noticed a few forum comments calling out KDE supporters during Whonix’s transition to XFCE…but should that factionalism even a serious thing to worry about for serious projects like Whonix and Kicksecure? --- ## Post 15 by @anon11657877 — 2025-07-24T16:48:38Z I can see why people would still use x11 DEs because performance issues and all or GNOME and KDE were too bloated, but if security matters more than anything else wouldn’t it make the most sense to use GNOME without any extensions despite it being the slowest and buggiest from my experiences and has a terrible workflow? The lack of support from other DEs is one thing keeping people from switching to Wayland and it’s made worse that none of the lightweight DEs have full Wayland support yet, although XFCE and LXQt seem to at least have experimental support. --- ## Post 16 by @TheDoc — 2025-07-24T17:19:11Z > [@anon11657877](#): > > Why is Kicksecure recommended again? It might be worth opening a discussion on this, but I’ll mention a few points: - Kicksecure seems to put a lot more value in privacy and freedom whereas Secureblue seems to be more solely focused on security. - Secureblue’s defaults aren’t very user friendly. I don’t have experience with Kicksecure, but on paper it seems like it may be easier to use. - There can still be situations where someone either finds Fedora-based or Atomic distros unsuitable, or where they require a Debian based distro. Kicksecure is in the process of switching to Wayland. It could be removed for using X11, but it may just make a reappearance at some point in the near future. Privacy Guides already includes a warning for Kicksecure so it might be a waste of effort to remove for now. --- ## Post 17 by @anonymous372 — 2025-07-24T17:30:47Z > [@anon11657877](#): > > X11 desktops aren’t secure and cannot be made secure For X11 distros, QubesOS would be best (which runs on XFCE but that doesn’t make it secure). This because the inter-qube isolation prevents apps in **different** qubes from mingling, but apps in the same qube are still vulnerable to X11’s insecurity --- ## Post 18 by @TheDoc — 2025-07-24T17:33:25Z > [@KevPham](#): > > As you mentioned earlier, A lot of these “downsides” mentioned by the KickSecure and Whonix devs revolve around their personal frustrations with bloatware and minimalism. To be fair, it’s [not totally without merit](https://github.com/Kicksecure/security-misc/issues/168#issuecomment-1850036468), though there’s disagreement to be had over exactly how much better that’d make Xfce over GNOME in that regard. This is setting aside the X11/Wayland issue of course. > [@KevPham](#): > > I don’t know why these “security-oriented” projects are still insistent on XFCE after the overwhelming evidence in support of Wayland-based DEs. [They agree](https://github.com/Kicksecure/security-misc/issues/168#issuecomment-1910286277) that switching to Wayland is important, the main issue has been a [lack of resources](https://github.com/Kicksecure/security-misc/issues/168#issuecomment-1872282375) to do it. I haven’t followed it closely but I believe they’ve been making progress on it. --- ## Post 19 by @PaulF — 2025-07-25T09:47:47Z > [@TheDoc](#): > > There can still be situations where someone either finds Fedora-based or Atomic distros unsuitable, or where they require a Debian based distro. Can you think of anything in particular about these situations ? Maybe related to the use of Debian for a server ? --- ## Post 20 by @anon11657877 — 2025-07-25T14:42:05Z > [@TheDoc](#): > > Kicksecure seems to put a lot more value in privacy and freedom whereas Secureblue seems to be more solely focused on security. This isn’t a bad thing, and it shows how both distros serve a different purpose. Kicksecure values privacy and freedom while still focusing on security hardening. This is what we need more of instead of solely focusing on security and ignoring freedom. I’d also add that Secureblue adopts to modern technologies like Wayland and Atomic-based distros while Kicksecure remains traditional with a Debian base, so it all comes down to personal preference. > [@TheDoc](#): > > Kicksecure is in the process of switching to Wayland. It could be removed for using X11, but it may just make a reappearance at some point in the near future. Discussion related > [@Remove Non-Hardened Firefox / Firefox Without Arkenfox](https://discuss.privacyguides.net/t/remove-non-hardened-firefox-firefox-without-arkenfox/29260/7): > > Personally, I think worth mentioning recommendations need to make a return to the site, at least to certain categories. Being unwilling to guide people when it comes to options that are less than perfect out of the box seems to be holding us back, when the reality is that most people would be far better off using a browser like Librewolf, provided they understand the potential implications, over Chrome, Opera, or even plain Firefox. Educating users is something we have the luxury of doing here,… Kicksecure could be made an honorable mention until it fully switches to Wayland, and perhaps Alpine Linux and/or possibly Gentoo could be added as honorable mentions too since they cater to specific niches (Alpine not using Systemd or the GNU userland and Gentoo being source-based), meet the criteria, but definitely can’t be recommended for most people who aren’t knowledgeable about computers and Linux. However PG already recommends more than enough Linux distros for use cases, and the software minimalism and anti-systemd niches are a small portion of the community. Most people don’t even know what an init system is let alone care about it. --- ## Post 21 by @anonymous372 — 2025-07-25T18:35:52Z > [@anon11657877](#): > > This is what we need more of instead of solely focusing on security and ignoring freedom. Secureblue is open source, and you can install Firefox on it if you want. The only privacy feature it misses is anti-fingerprinting on Trivalent, which can be mitigated by disabling Javascript on sites that don’t need it, using privacy respecting alternate front-ends, and using Startpage Anonymous View. Also, with X11 and the update cycle of Debian, Kicksecure is less secure than Fedora Workstation IMO --- ## Post 22 by @PaulF — 2025-07-26T10:45:22Z > [@anonymous372](#): > > Also, with X11 and the update cycle of Debian, Kicksecure is less secure than Fedora Workstation IMO I currently use Debian and Xfce as DE on a low-resources PC : → Fedora recommends [2GHz quad core processor](https://docs.fedoraproject.org/en-US/fedora/f39/release-notes/welcome/Hardware_Overview/) and my hardware has 2 cores of 1.10 GHz as Processor Base Frequency ; → it has ever been [discussed](https://discuss.privacyguides.net/t/gnome-minimal-resources/23949) on the PG forum that GNOME requires at least 8 GB of RAM and I’ve only 4 GB ; So, do you think the best thing I can do in this configuration to improve system security is to add **Kicksecure** to Debian ? --- ## Post 23 by @anonymous372 — 2025-07-26T16:11:32Z > [@PaulF](#): > > Debian and Xfce XFCE 4.20 has Wayland support, but it’s experimental and only recommended for advanced users. --- ## Post 30 by @bitosi — 2025-07-27T05:32:19Z Whats the practical usecase of TPM? I never knew why it would matter. --- ## Post 32 by @null — 2025-07-27T14:33:01Z > [@anonymous372](#): > > you can install Firefox on it if you want. How or do you mean flatpak? --- ## Post 37 by @Cyber-Typhoon — 2025-07-27T18:04:49Z > **offtopic** > > I’m just marking this as offtopic because I don’t think is related to the main discussion. > > TPM has several applications, modern hardware have it and it stores cryptographic keys. Which allows end-to-end verification of the boot chain. You can maybe think of them as internal smartcards, attest the firmware running on the computer and allow users to insert secrets into a tamper-proof and brute-force resistant store. Those depends on the PCRs configured when you setup them. Everyone has different scenario, on my laptop I configured PCRs 0,4 and 7. You can read more about them in the official documentation and I recommend to take a look to the Arch Wiki, it has quite summarized info about the topic: [Trusted Platform Module - ArchWiki](https://wiki.archlinux.org/title/Trusted_Platform_Module) --- ## Post 39 by @Valynor — 2025-07-27T18:28:35Z [Lots of off-topic removed] Please keep threads on point. --- ## Post 40 by @anonymous372 — 2025-07-27T18:51:21Z > [@Valynor](#): > > Please keep threads on point Got it, sorry for not asking to move the off topic discussion. > [@PaulF](#): > > is there one DE that offers a supplement of security over the others ? Back to the original question, I guess GNOME would be the most secure DE even with X11. The GNOME devs have proven they value security the most even excluding Wayland, and that’s why [PrivSec recommends Fedora GNOME for QubesOS](https://privsec.dev/posts/qubes/using-mullvad-vpn-on-qubes-os/)