# Debian-based distro that has the latest kernel patches? **URL:** https://discuss.privacyguides.net/t/debian-based-distro-that-has-the-latest-kernel-patches/20046 **Category:** Questions **Created:** 2024-08-13T03:32:32Z **Posts:** 86 ## Post 1 by @anon55142611 — 2024-08-13T03:32:32Z Continuing the discussion from [Are LTS kernels recommended for security? - #7 by SkewedZeppelin](https://discuss.privacyguides.net/t/are-lts-kernels-recommended-for-security/19985/7) * * * Damn, that’s a very detailed overview on the issue. Thanks for digging it up. Though, this is getting off-topic at the same time topic related. Is there debian a distro based with [kernel.org](http://kernel.org) Kernels ? I am looking forward to use a distro that has update cycle as Fedora, Community based, No-Snaps and is based on **Debian**. None seems to fit my case. I was considering to switch from Fedora to Debian due to its LTS base and security patches only. As I get frustated by amount of updates in fedora. But this is changing my whole stance. --- ## Post 2 by @anon49578468 — 2024-08-13T07:31:19Z There is a mismatch between wanting latest kernel patches security and using debian. Debian philosophy fundamentally clashes with using latest kernels due to maintainability issues. > It may not be actionable by users or developers. Stable kernels from [kernel.org](http://kernel.org) are not packaged for Debian. Even if they were, they are probably not suitable for installation by default due to issues with [maintainability](https://www.kicksecure.com/wiki/Dev/maintainability). (Source: Kicksecure Wiki) If you want latest patches and updated kernels, fedora is the best choice tbh, maybe followed by openSUSE TW. Do note that Fedora follows stable and not latest, but you can switch to Fedora Rawhide to get the bleeding edge kernels and patches. But expect a bunch of updates :frowning: --- ## Post 3 by @anon55142611 — 2024-08-13T10:54:16Z The problem for me is using a Debian based ones, not exactly debian. Debian project is cool. I am trying find a distro that is not ubuntu and is like Fedora’s release cycle but a debian distro. I am vouching for debian as most apps, are in `.deb` format. I really hate AppImage. I mean it’s useful when needed across multiple system during work. But not when I am trying to install an app that will be used by me on a daily basis. I tried distrobox. But, there are apps, that are broken due to non-connectivity of Browser extensions and isolation of apps installed in distrobox. --- ## Post 4 by @anon49578468 — 2024-08-13T12:00:19Z A cursory search about bleeding edge Debian distros does not yield too many [favorable answers](https://www.pcsuggest.com/debian-rolling-release-distribution-list/). How about using a VM? But if the problem is interdependence, then VM will be worse than distrobox. If there are specific apps you are willing to disclose, it would be easier to suggest specific solutions. I also hate AppImage :laughing: .As for the apps in .deb form, I think you can probably find rpms for most of them too, unless the app you use is super niche. Would also be better to use RPM instead of deb in my personal opinion ([reason](https://fedoraproject.org/wiki/Staying_close_to_upstream_projects)) --- ## Post 5 by @anon55142611 — 2024-08-13T12:50:46Z Those are distros, that I cannot rely on. Actually none fits my thought. Only Debian. As it’s the one truly backed by community. Fedora/SUSE are community backed too but there is still a company behind it and rolling. So, it’s getting yicky for me. I actually made my mind that it would be better to use Debian. Considering that, I won’t be interested in updates and new features rather a system that gets critical security updates and big feature updates once in a while. But these posts are changing my mind. I dislike landscapes changing very soon. I liked it before but not now. The app in question is [freedownloadmanager](https://freedownloadmanager.org), It’s the only best free download manager available with great browser integration. I just can’t connect the app inside distrobox to the extension on the host. --- ## Post 6 by @brivacy — 2024-08-13T12:57:04Z It depends on the company like if it is redhat or suse. It is ok to use there kernel as they don’t use lts mostly but provide regular security patches and other enhancement to there version of kernel. The reason companies use redhat or suse. But for home users it is recommended to use something like non lts or if wanted they can use lts but that should not be older than a couple of release like now it is 6.10 you can get 6.6 or 6.1 happyly --- ## Post 7 by @asanyan — 2024-08-13T14:54:51Z If you are considering returning to Fedora, also consider Arch, as it is not backed by some big spooky corporation > [@anon55142611](#): > > I am vouching for debian as most apps, are in `.deb` format. You can install deb packages in other distributions too. Lots of AUR packages install from the .deb release [(example)](https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=vesktop-bin) --- ## Post 8 by @anon63378630 — 2024-08-13T15:11:49Z `archinstall` can get you up and running in a few minutes with acceptable defaults too these days. --- ## Post 9 by @anon55142611 — 2024-08-13T15:24:15Z I am using Fedora 40, KDE version. Problem is insane amount of updates. And apps that I wanna use are mostly available but still some are AppImages or Community maintianed Flatpaks. I want to use a Debian based distro that `.deb` packages. Since almost everything is available in that package format and I want to stick to official package rather than community maintained at the most. Arch, I don’t wanna lose some chapters of my life to it. Just some `.deb` with KDE. These updates cycle is making me confuse. Should I still stay in Fedora or jump to debian which is based on LTS. --- ## Post 10 by @anon55142611 — 2024-08-13T15:29:06Z For me, KDE is better as of now. DE isn’t my problem, the Core OS is. `deb` feels great but nothing is rolling except Ubuntu which I don’t wanna touch. LTS or Rolling. I feel LTS to be great. But I still wanna use it but people say not every patch is applied to it which pushes me away from debian. I ain’t trusting Private companies at all recently. So it’s hard to make a decision. --- ## Post 11 by @gregandcin — 2024-08-13T16:23:59Z `archinstall` is _mostly_ stable. Sometimes it makes a broken install. But yeah, Arch, Fedora, and SUSE Tumbleweed are the only traditional distros with decent close-to-upstream packages from what I can tell --- ## Post 12 by @asanyan — 2024-08-13T16:28:14Z Hmmm. @gregandcin , @anon63378630 what do you think about Void Linux? It supports both SELinux and AppArmor, and avoids systemd, though it doesn’t look like they ship linux-hardened in the main repos. --- ## Post 13 by @gregandcin — 2024-08-13T16:31:12Z Void is a much smaller community compared to the ones we have mentioned. If you want to use anything but the upstream kernel, you will have to install your own kernel. Not my favorite, but if you know how to admin a Linux system then I guess its _fine_ --- ## Post 14 by @sha123 — 2024-08-13T16:52:28Z > [@gregandcin](#): > > `archinstall` is _mostly_ stable. `archinstall` is terrible. It crashed every single time I tried it. I switched to EndeavourOS, which has an actually working installer and provides a reasonable starting point for a non-bloated Arch distro. --- ## Post 15 by @asanyan — 2024-08-13T16:59:20Z Obligatory [ALCI](https://alci.online/) mention --- ## Post 16 by @donutfreak — 2024-08-14T02:22:09Z I like Void and have been using it for a couple years. I’m an Ubuntu then Arch convert. I’m not using it for privacy; I just like how the project is run and it’s relatively drama free. The void-packages repo on github maintains a couple other kernels. Rough count, 8 different versioned [kernel.org](http://kernel.org) lines. Many other popular projects that aren’t in the main Void repos can be found there. Not an end user distro, but an experienced linux user could use it as an end user. --- ## Post 17 by @anon55142611 — 2024-08-14T03:10:14Z Ok, Let’s cut it short. I just feel Debian to be great for my use case but haven’t migrated to it and was firm on the decision. Due to data transition and Backup. But as I said, the recent post has changed my whole stance, should I go with debian as > [@anon55142611](#): > > people say not every patch is applied to it which pushes me away from debian Is staying in the stable/latest release of kernel, really that much important ? --- ## Post 18 by @anon43985288 — 2024-08-14T04:27:01Z Probably not. Latest kernel sometimes ships new features that you probably won’t be able to take advantage of until Debian updates your applications to be compatible with these new features. --- ## Post 19 by @Cyber-Typhoon — 2024-08-14T05:36:00Z If I was going to use a Debian based distribution I’d use Kicksecure, like is advised in the [recommendation](https://www.privacyguides.org/en/desktop/#qubes-os) section. --- ## Post 20 by @Register3435 — 2024-08-14T05:37:33Z [Ubuntu did announce (potential?) changes regarding their kernel update policy](https://lwn.net/Articles/985043/). > To provide users with the absolute latest in features and hardware support, Ubuntu will now ship the absolute latest available version of the upstream Linux kernel at the specified Ubuntu release freeze date, even if upstream is still in Release Candidate (RC) status. Other than that, I’m unaware of any Debian-based distro that does what you ask. Ubuntu or Testing/Sid are the only relatively popular distros I know of that try to go faster than the usual Stable release cycle. Edit: Should also mention that I imagine the perceived disadvantage of the ‘stable release’ distros go further than just the kernel. And I know that we’re on PG, but you could consider the ‘harm’ from using a slower distro to be of less impact on your life than that brought by using a non-Debian distro. --- ## Post 21 by @anon55142611 — 2024-08-14T05:51:24Z So, It’s just okay to use debian I guess. If it feels right for me. > [@Cyber-Typhoon](#): > > If I was going to use a Debian based distribution I’d use Kicksecure, like is advised in the [recommendation](https://www.privacyguides.org/en/desktop/#qubes-os) section. I am unsure about it. It’s more of focused for a Whistleblower like stuff when I see it. --- ## Post 22 by @anon43985288 — 2024-08-14T06:08:04Z Yeah. Use Debian if that’s where you are most comfortable. Just set a policy to do updates in reasonable time and if it were me, I would install applications via Flatpak and further deny all apps that don’t need :home or other similar sensitive permissions with Flatseal. There’s not a good guide to do this so it’s very much trial and error but it is a very effective way to sandbox apps. --- ## Post 23 by @anon55142611 — 2024-08-14T06:17:45Z Actually, that’s what I have been planning to do too. Kicksecure seems good but using XFCE and doesn’t seem to provide other DE’s as an option. So, I doubt, I would use it. --- ## Post 24 by @sha123 — 2024-08-14T07:42:23Z > [@anon43985288](#): > > Probably not. Latest kernel sometimes ships new features that you probably won’t be able to take advantage of until Debian updates your applications to be compatible with these new features. It’s not about features, it’s about security and other bug fixes. --- ## Post 25 by @anon43985288 — 2024-08-14T07:54:33Z Security is not a product to consume, features however are. --- ## Post 26 by @anon55142611 — 2024-08-14T08:00:32Z I am considering OpenSUSE slowroll. So, I get the latest but also with a gap. Instead of dumping updates, it’s the closest I could have. So, Tumbleweed users are always on the latest whereas Slowroll (essentially tumbleweed under the hood) will release updates as required after testing not instantly. --- ## Post 27 by @jerm — 2024-08-14T09:39:28Z > [@anon55142611](#): > > The app in question is [freedownloadmanager](https://freedownloadmanager.org), It’s the only best free download manager available with great browser integration. Have you looked into other apps like [https://motrix.app/](https://motrix.app/) seems a lot modern. If you want a popular option which is also open source and works great, you can use [JDownloader.org - Official Homepage](https://jdownloader.org/jdownloader2) but I really hate everything about it other than software, in their main installer (not the one I linked) they add an adware, and how their source code requires you to install an IDE to view it. --- ## Post 28 by @anon55142611 — 2024-08-14T09:53:22Z [https://abdownloadmanager.com/](https://abdownloadmanager.com/) - This satisfies my need. They will provide RPM package in the future - This is a very recent project. I tried motrix, Browser integration not good, aria2 - messes up. --- ## Post 29 by @sha123 — 2024-08-14T15:10:56Z > [@anon55142611](#): > > I am looking forward to use a distro that has update cycle as Fedora, Community based, No-Snaps and is based on **Debian**. None seems to fit my case. The more I dive into Linux security, the more I stop caring about fixing it, because it is such a mess, which you can’t fix in a reasonable time and effort as an end user. The main problem is a lack of proper security model and security boundaries around applications. But as long as the threat landscape is the way it is now on Linux and you stick to official repos, I think it’s unlikely that you will have severe security incidents, even if you choose Debian. Is it the best choice for security? No. But it fits your requirements. --- ## Post 30 by @anon55142611 — 2024-08-14T15:23:38Z > [@anon55142611](#): > > I am considering OpenSUSE slowroll. So, I get the latest but also with a gap. Instead of dumping updates, it’s the closest I could have. > > So, Tumbleweed users are always on the latest whereas Slowroll (essentially tumbleweed under the hood) will release updates as required after testing not instantly. I dunno for sure if this will happen. But I need to test Debian and also SUSE to figure it out. Linux is great but at the sametime, it’s a huge mess. --- ## Post 31 by @anon55142611 — 2024-08-14T05:26:14Z So, It’s just okay to use debian I guess. If it feels right for me. by [discourse@privacyguides.org](mailto:discourse@privacyguides.org): --- ## Post 32 by @asanyan — 2024-08-14T17:43:17Z > [@sha123](#): > > security boundaries around applications It’s getting there though. Shouldn’t AppArmor + Bubblejail + A secure display server fix most issues? PulseAudio is still an issue but other than that, I can’t think of anything else that is a major concern. --- ## Post 33 by @anon63378630 — 2024-08-14T17:48:32Z > major concern. the part where we have ~12 years worth of awesome compile time hardening features capable of mitigating entire bug classes that no major Linux distro has bothered to ship --- ## Post 34 by @asanyan — 2024-08-14T18:09:59Z Hmm, could you share which ones? I currently have this in CFLAGS ``` CFLAGS="-march=x86-64 -mtune=generic -O2 -pipe -fno-plt -fexceptions \ -Wp,-D_FORTIFY_SOURCE=3 -Wformat -Werror=format-security \ -fstack-clash-protection -fcf-protection \ -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer \ -flto -fvisibility=hidden -fsanitize=cfi" # Clang ``` I think the first 4 lines are a default in makepkg.conf (unless I added and forgot about it) --- ## Post 35 by @anon54160479 — 2024-08-15T09:21:55Z @anon55142611 Maybe you can have a look at Spirallinux: > **[SpiralLinux - Linux, faster than a snail](https://spirallinux.github.io/)** > > SpiralLinux is a user-friendly preconfigured Debian system with live installation Maybe it fits your needs --- ## Post 36 by @BabyIceberg — 2024-08-18T15:03:16Z Try Peppermint OS --- ## Post 37 by @anon55142611 — 2024-08-19T07:38:17Z I don’t think I will ever find a debian based distro as I desire. Debian seemed good, when I tried it in a VM. But yeah, it’s super stable with almost no updates when I installed the latest one. It’s good for people that doesn’t turn on system or senior citizens. Only thing I don’t get is Plasma 6. Which I might need to wait for sometime. Because of which I can’t switch. OpenSUSE is another thing I considered because of it’s slowroll option. But it is still in experimental phase and YaST, it’s very odd. So, I decided to settle on Fedora and just put things that work the way I want. One thing I liked about OpenSUSE is their software update which I found out in `dnfdragora` as GUI. So, I guess I am all good as of now. Using debian in distrobox, in case if it’s needed. --- ## Post 38 by @anon21489307 — 2024-08-19T09:55:54Z > [@anon55142611](#): > > OpenSUSE is another thing I considered because of it’s slowroll It looks good in the paper, but in reality, you would be better off with Tumbleweed. For instance, when Tumbleweed’s update [broke Intel WiFi card](https://bugzilla.suse.com/show_bug.cgi?id=1226544) recently, it was fixed in a few days. Since the issue was known and fixed on Tumbleweed, it shouldn’t happen on Slowroll, right? [Nope](https://www.reddit.com/r/openSUSE/comments/1dq57h8/looks_like_the_bugged_intel_wifi_firmware_made_it/). It happened on Slowroll as well :joy: I don’t think it’s ready for prime time yet, at least, it’s not currently doing what it’s supposed to do very well. --- ## Post 39 by @anon55142611 — 2024-09-05T12:50:58Z It’s kind of a hard nut to crack. I am settling in fedora as I said. But I sure will swap things out at a later point of time. I just hope macOS was Open-source, it has a great ecosystem and unified UI. --- ## Post 40 by @anon55142611 — 2024-09-06T13:27:52Z Hey Guys, What do you think about ParrotOS, it uses Debian Testing out of the box with Tor only problem is, it uses MATE as its desktop environment. If not siduction ? --- ## Post 41 by @Cyber-Typhoon — 2024-09-06T15:03:30Z > [@anon55142611](#): > > What do you think about ParrotOS [Check this out](https://www.privacyguides.org/en/os/linux-overview/) --- ## Post 42 by @asanyan — 2024-09-06T15:13:10Z Parrot has a “home” edition --- ## Post 43 by @asanyan — 2024-09-06T15:21:41Z Honestly just go with with something Arch based. It’s not nearly as bad as most people make it out to be. No need to rely on flatpaks or anything like that, no issues with finding packages at all due to the AUR. And I’m sure that it’s possible to figure out a way to make btrfs snapshots work. --- ## Post 44 by @anon55142611 — 2024-09-06T15:45:45Z I just wish Debian was like Fedora. I recently read in a thread that Pop!\_OS ships with Latest kernel images. How about that ? --- ## Post 45 by @exaCORE — 2024-09-06T17:22:52Z Flatpaks have (some) sandboxing and if they are from the developer, I much prefer that option over AUR --- ## Post 46 by @asanyan — 2024-09-06T17:46:27Z Yes but native packages can still be sandboxed, and it’s easier to apply apparmor profiles with native packages. Native packages overall should provide better security if the user is willing to put some effort. --- ## Post 47 by @anon55142611 — 2024-09-07T07:52:27Z Not a good out of the box experience. --- ## Post 48 by @anon48875053 — 2024-09-07T09:38:23Z Flatpaks are the future, but it will take some time for traditional packaging fans to realize it the same way it took some time for X11 people to realize that Wayland is the future and X11 should just die. --- ## Post 49 by @anon46412288 — 2024-09-07T10:52:55Z Linux Mint allows you to install newer kernels directly, no need for latest kernel packages. As for a Fedora-like update cycle with Debian base, I’m not aware of any myself. --- ## Post 50 by @anon46412288 — 2024-09-07T10:54:08Z Native packages do have a better experience in some cases (such as Steam flatpak being kinda borked iirc, LibreOffice flatpak only using GTK which makes it look horrendous, etc) --- ## Post 51 by @anon55142611 — 2024-09-07T11:06:28Z Yes, so does Pop!\_OS. But problem is the DE. You can’t use DE you wish such as KDE. --- ## Post 52 by @anon46412288 — 2024-09-07T11:27:40Z Why not? > **[How to Install the KDE Plasma Desktop on Linux Mint](https://www.makeuseof.com/install-kde-plasma-on-linux-mint/)** > > Replacing the default Linux Mint desktop environment with KDE Plasma is as easy as running a simple command in the terminal. --- ## Post 53 by @anon55142611 — 2024-09-07T11:44:32Z I thought of the official spin by the Linux mint team. So, I can essentially have Ubuntu base which is stable with required updates + KDE the one I wish, which is cool. I thought I could only install the DEs only if they support as in Fedora where I have tried many DEs applied over my KDE and reverted back to KDE. --- ## Post 54 by @anon46412288 — 2024-09-07T12:43:31Z I guess that is fair. It’s better for you to stick to Fedora KDE spin for the update cycle then. --- ## Post 55 by @anon55142611 — 2024-09-07T14:04:31Z Actually, I hate the update cycle. I want fewer updates and a distro based on Debian, Stable. I think it could be possible now because of the idea you gave. --- ## Post 56 by @overdrawn98901 — 2024-09-07T15:07:46Z [Stable and LTS kernels](https://www.kernel.org/releases.html) are different goals than [Debian’s Stable](https://www.debian.org/releases/) which uses the 6.1 LTS kernel as of today, so opting for Debians Stable for all packages but with Linux Kernel Stable (or mainline) is a very specific goal. I’m curious, if you want Debians Stable release cadence, why not just use Debian Stanle and install the kernel version yourself or [look for a third party repo that manages it](https://linuxcapable.com/how-to-install-latest-linux-kernel-on-debian-linux/)? Slightly more work, but solves the problem. --- ## Post 57 by @anon55142611 — 2024-09-07T15:30:46Z To be honest, I started using Fedora since PG recommended it. It is actually good, but there are some nuances I get through in it. - My number one major issue is - Frequent updates, frustrating. Windows was better at it by giving updates on a per-month basis and security updates as needed. {Windows is now literal rubbish, I am glad, I left it. Windows 10 IoT Enterprise LTSC is good, I can use it. But a violation of licence agreement, and also it sends a lot of telemetry even when disabled via registry/group policy etc.}. I wonder what would I have done either in OpenSUSE or Arch. - Bug filled KDE plasma and frequent crashes. - PG’s page gave a fear that my system might be vulnerable because when I checked Debian packages page for Linux, there are a lot of vulnerabilities that aren’t fixed in the case of kernel itself. - Then there are the apps, most are available in `.deb` format, I hate `AppImage` format and use it only when the dev doesn’t release in any other format for linux. - So, In the Ubuntu based distros, I loved Linux mint and Cinnamon. But I left it for KDE. But I still liked the LM project and their updated and a bloat free Ubuntu. - And using Ubuntu base which is better than Debian in case of patching (my opinion not sure) + the latest kernel from mint and KDE plasma as I wish. * * * I am even considering switching back to windows. But KDE plasma is holding me back. If it was GNOME, I would have stepped back on day one itself. I also considered buying a Mac, it’s too good but the hardware and price isn’t sustainable and efficient. I could run the same device for 15 years or more with Linux. Recently, I found FreeBSD, I might consider it, if I like it. But I don’t know. As of now, this seems to be a better way currently. --- ## Post 58 by @overdrawn98901 — 2024-09-07T15:45:18Z > [@anon55142611](#): > > PG’s page gave a fear that my system might be vulnerable because when I checked Debian packages page for Linux, there are a lot of vulnerabilities that aren’t fixed in the case of kernel itself. Maybe there should be some phrasing updates to PG. For security, you should have specific threats you are protecting against, and not lock yourself out of choices. For privacy, any Linux district works. From what I gather you favor UX and reliability, so I’d definitely gear towards slow moving and popular distros and not worry about rolling releases - hence why you like Debian so much :grimacing: Unironically, I think Ubuntu (Kubuntu for KDE) might be a good choice. Ubuntu is super solid, you can uninstall the bloat of initial installs, and ignore the whole flatpack stuff. Otherwise, Debian with the stable kernel might be “good enough”. What do you think? For Fedora, you could also simply choose to not upgrade for a bit. I often feel the need to upgrade every time I start the computer.. but you don’t have to! Wait to upgrade once every month rather than daily and give yourself a dedicated half day to fixing stuff. Better than having it randomly break all the time. I strongly encourage this practice, especially if reliability and time is a concern. If you are an upgrade junky, use Arch. --- ## Post 59 by @anon55142611 — 2024-09-07T15:56:39Z > [@overdrawn98901](#): > > Maybe there should be some phrasing updates to PG. For security, you should have specific threats you are protecting against, and not lock yourself out of choices. Yeah, that would help a lot. > [@overdrawn98901](#): > > From what I gather you favor UX and reliability Yeah, I actually want a distro that is like android but on x86. Just use it. Updates are done via store. Simple and work focused UI. > [@overdrawn98901](#): > > I think Ubuntu (Kubuntu for KDE) might be a good choice. This community backlash and hate on Snaps by community, stuck on me like some contagious disease and I am hesitant towards ubuntu totally. And stripping things out of ubuntu would kill it. > [@overdrawn98901](#): > > For Fedora, you could also simply choose to not upgrade for a bit. Yeah, I did. But whenever I get 5G wifi network, I just like that update it. And yeah, restarting for a single 4KB update sucks. > [@overdrawn98901](#): > > Wait to upgrade once every month rather than daily and give yourself a dedicated half day to fixing stuff. More security holes, and fixing stuff. KDE crashes which is fixed by these updates but there are new bugs and crashes now then, I hate it even though I have telemetry on for them and send crash reports. > [@overdrawn98901](#): > > especially if reliability and time is a concern. If you are an upgrade junky, use Arch. Hence why I think, Linux Mint + Latest Kernel + KDE because of being community based and the good security patches from Ubuntu and better AppArmor profiles. Dude, I am hating updates because of fedora. Is it really sensical to suggest or sarcasm ? --- ## Post 60 by @overdrawn98901 — 2024-09-07T16:22:55Z > [@anon55142611](#): > > Dude, I am hating updates because of fedora. Is it really sensical to suggest or sarcasm ? Arch based distros are bleeding edge in updates. More likely to break, but always on the latest of everything. I personally recommend Arch if and only if you enjoy tinkering with your setup, otherwise it’s very annoying as you said. I’m an upgrade junky and can’t resist it plus I enjoy tinkering, so I use Arch for Desktop, but for stability it’s not my first recommendation. It was mainly a joke recommendation for your case :smile: > [@anon55142611](#): > > More security holes, and fixing stuff Are these hypothetical security holes? I’d like to challenge this assumption that not upgrading every day leads to a critically vulnerable system. I’m not sure your threat model for security, but I highly doubt you are going to get pwned because you forgot to do a patch upgrade in a couple weeks. For example take [OpenWRT](https://openwrt.org/releases/23.05/notes-23.05.4), it’s using an even older LTS kernel (5.15), **and it handles all inbound and outbound network requests to my home**. This is a huge attack surface, but it’s focused on reliability like a server to run on consumer grade router hardware. Not saying you should install 5.15, or that you never need to upgrade, but perhaps thinking about what level of security you need may change approach in what distro you’d like. I think the assumption is you need the latest updates daily and super frequently, but what is wrong with weekly, or monthly? --- ## Post 61 by @xe3 — 2024-09-07T17:49:23Z > [@overdrawn98901](#): > > Unironically, I think Ubuntu (Kubuntu for KDE) might be a good choice. Ubuntu is super solid After reading through this thread and conversation between you and OP, Ubuntu (Kubuntu if KDE is desired) is also the distro I’d recommend. It seems like the major distro most inline with OP’s wants and priorities. And is in my opinion a solid all around choice. > [@anon55142611](#): > > But I still liked the LM project and their updated and a bloat free Ubuntu. Bit of a misconception. Mint is a very fine choice of distro (not the best from a security perspective, but not worst, and its quite beginner friendly and the Cinnmon Desktop is quite aesthetic). But in terms of “bloat” Mint comes with substantially _more_ pre-installed than Ubuntu out of the box, it has more packages pre-installed (~2200 vs ~1500) and has a larger disk footprint (~9.2GB vs ~8.4GB). In terms of pre-installed packages, Ubuntu now has slightly less pre-installed than even its upstream Debian does. This comparison isn’t a criticism of Mint, I bring it up only to dispel the assumption that Mint is the lighter option, or that Ubuntu isn’t. --- ## Post 62 by @donutfreak — 2024-09-07T21:45:11Z > [@xe3](#): > > But in terms of “bloat” Mint comes with substantially _more_ pre-installed than Ubuntu out of the box, it has more packages pre-installed (~2200 vs ~1500) and has a larger disk footprint (~9.2GB vs ~8.4GB). I’m not a Mint expert, but I admire the two distros they make and the community. Mint does extract the Snap support that Ubuntu uses. There may be other significant differences. Do consider LMDE, the Ubuntu-free version of Mint. It’s probably still hefty, but should be lighter/smaller than regular Mint. --- ## Post 63 by @xe3 — 2024-09-07T22:29:31Z > [@donutfreak](#): > > I’m not a Mint expert, but I admire the two distros I will always have a small soft spot for both Mint and Ubuntu, these distros were my on-ramp to Linux many years ago and ignited my curiosity to explore further. Ubuntu did a tremendous amount to make linux accessible, fun, and aesthetically appealing at a time when this was not the norm. Mint built on this, adding their own small touches and flair, and eventually their own DE. (this was all long before snap so that wasn’t a differentiator at the time). > Mint does extract the Snap support that Ubuntu uses. There may be other significant differences. You are right, that is one substantive difference I am aware of, but I don’t see that as necessarily positive in the context of Ubuntu based distros or security. --- ## Post 64 by @anon55142611 — 2024-09-08T00:07:46Z > [@I'm looking for Good Linux distribution](https://discuss.privacyguides.net/t/im-looking-for-good-linux-distribution/20600/29): > > Have you looked into solus? It started out inspired by chromeOS and the developers put a lot of work into making sure it’s easy to use. They call it a “curated” rolling release distro because they test packages before releasing them into the main repository. It only updates once per week (they call it the weekly sync) as well so you don’t need to worry about updating every day. Maybe this suits my case possibly, I guess. --- ## Post 65 by @xe3 — 2024-09-08T01:23:42Z > [@anon55142611](#): > > Maybe this suits my case possibly, I guess. I liked/used Solus briefly. I was (and am) under the impression it was an independently derived distro (as in not a fork of anything else). I didn’t know (and am not convinced) that it is a fork of ChromeOS. It felt just like any other LInux distro, but I have only basic knowledge of Solus so I very possibly could be incorrect. I like the Budgie desktop Environment (the flagship DE for Solus, and a Fork of Gnome) but I believe it doesn’t yet support Wayland which is a (small) downside to me. A while ago, there was some rather substantial intra-project problems that led to a pretty substantial outage which kind of derailed the project for some time and made its future sustainability feel pretty precarious. IIRC their infrastructure, servers, website were down for some time (months). My recollection is it caused many people to lose some confidence in the project (in the short term, but that trust can be regained). I know they announced plans to reorganize/course-correct, but I don’t know if they were successful or if there was follow-through. Here are the blogposts announcing the continuation of the project and the planned changes following the drama [one](https://www.reddit.com/r/SolusProject/comments/12ndrvt/righting_the_ship/) | [two](https://getsol.us/2023/04/18/a-new-voyage/). I’m not motivated/interested enough to read through them now, but if you are interested in Solus, its probably a good idea. My knowledge of Solus is too outdated to be relevant now. But when I tried it, I though it was a cool distro doing interesting things. --- ## Post 66 by @overdrawn98901 — 2024-09-08T01:40:39Z > [@anon55142611](#): > > This community backlash and hate on Snaps by community, stuck on me like some contagious disease and I am hesitant towards ubuntu totally. And stripping things out of ubuntu would kill it. Maybe it’s time to revisit this as well. I hated Ubuntu for a while, also based on the community and Canonical. I realized I was being prejudice without a real reason why, so I gave it a shot. I’m running an Ubuntu server right now and it’s honestly great. I distro hopped on my server as well, so it’s not as though I didn’t have other experience. I couldn’t be happier - the amount of support for some of the problems I had just from docs and community forums really makes managing it simpler. You can also ignore Snaps (what I do), and uninstalling some default software doesn’t kill it. But if you really really hate things not community or non profit ran, I suppose it may not be it for you. --- ## Post 67 by @anon55142611 — 2024-09-08T01:43:07Z > [@overdrawn98901](#): > > But if you really really hate things not community or non profit ran Not like that, If communities are respected by companies. I don’t have a grudge against them. > [@overdrawn98901](#): > > Maybe it’s time to revisit this as well. I hated Ubuntu for a while, also based on the community and Canonical. Probably everywhere I go, I get recommended of Ubuntu or Ubuntu LTS. --- ## Post 68 by @Shampoo — 2024-09-08T01:58:43Z > [@xe3](#): > > I didn’t know (and am not convinced) that it is a fork of ChromeOS. I said started out as and said the devs kept the easy to use mentality. It hasn’t been a fork of chromeOS in years. Edit: it wasn’t a fork, I remembered an article incorrectly. It had google accounts integrated into it. --- ## Post 69 by @xe3 — 2024-09-08T03:24:00Z > [@Shampoo](#): > > It hasn’t been a fork of chromeOS in years. I only spent a few minutes searching, so possibly I missed something, but I can’t find any evidence that it was ever a fork of ChromeOS, or has any connection to it. Solus’ original 1.0 release from 2015 describes itself as: > Solus is a Linux-based operating system _built from scratch_ for the modern desktop and targeting the x86\_64 architecture. I do see some ‘listicle’ type SEO articles and [an article](https://www.linux.com/training-tutorials/solus-project-no-longer-just-chrome-os-alternative/) from 2016 that describe Budgie, the desktop environment used by Solus as having a similar UI/aesthetic to ChromeOS. [Edit: also this [phoronix article](https://www.phoronix.com/news/MTg1NTU) about Budgie]. But these are just describing the UI/UX in the same way people frequently call KDE Plasma ‘windows-like’ or Gnome a little more ‘MacOS-like’ (and Budgie is a fork of Gnome). Do recall where you heard of the connection to ChromeOS? If there was a connection I’d be interested to learn about that history. I am curious why there aren’t any popular open ChromiumOS forks. --- ## Post 70 by @Shampoo — 2024-09-08T03:35:08Z > [@xe3](#): > > Do recall where you heard of the connection to ChromeOS I managed to find it. I remembered the article incorrectly and I thought it was a fork but it was Google accounts being integrated with the OS. [Solus Project: No Longer Just A Chrome OS Alternative - Linux.com](https://www.linux.com/training-tutorials/solus-project-no-longer-just-chrome-os-alternative/) --- ## Post 71 by @xe3 — 2024-09-08T03:47:24Z Thanks for digging that up, its actually the same article I managed to find also. (I can see how it would be easy to misremember the details of the article, the way the article is written, it does kind of give the impression of a greater connection to ChromeOS). Thanks for clearing that up. @anon55142611 has anyone mentioned [VanillaOS](https://vanillaos.org/help/faq) yet? It may be worth looking into. Its Debian based, atomic/immutable, rolling (I think), designed to be simple/beginner friendly and hard to screw up too bad. I haven’t personally used it. They [recently released VanillaOS 2 Orchid](https://vanillaos.org/blog/article/2024-07-28/vanilla-os-2-orchid---stable-release) which rebased to Debian Sid. --- ## Post 72 by @overdrawn98901 — 2024-09-08T04:13:46Z Hmmm I have one last suggestion: distro hop. Gather your top 3 distros or so, and just try them out for a month. Talking about a distro and then actually using it are quite different. Analysis paralysis can happen, and making a choice you can change can alleviate stress. Plus trying more distros will give you more comparison points on what you like :+1: You can make this change more seamless by creating a “/home” partition on your first (re)install if you haven’t done so already. That partition won’t be wiped out on each new install of another distro if you follow the setup process carefully. You’ll still need to reinstall your previous software (easy enough with package managers). However, if your configs live in /home along with the rest of your data, you will barely notice the change. I’ve done this and it’s allowed me to install multiple distros on my server, and it helped me settle on Ubuntu! I was able to keep all of my docker configs setup each time, and aside from a few hiccups, it’s worked well. I might even switch back to CentOS stream soon, since I want to try Podman and Podman is a RHEL originating package (I’d assume it works better by default on RHELs distros). --- ## Post 73 by @anon46412288 — 2024-09-08T06:47:33Z Well, being on a rolling release, I have got used to frequent updates. Why exactly do you hate it? It’s not like it turns off your computer in the middle like Windows. > Yeah, I did. But whenever I get 5G wifi network, I just like that update it. And yeah, restarting for a single 4KB update sucks. It really depends on what is being updated. Rule of thumb : Updates for the kernel, systemd and drivers (especially gpu drivers) need a reboot. If the program doesn’t need to be running all the time for the OS to function, then just close it and update. No need to reboot. --- ## Post 74 by @anon43985288 — 2024-09-08T07:03:00Z Since systemd 254 released over a year ago, > systemctl soft-reboot allows you to reboot the userspace in entirety. The only time you actually need to hard reboot is when you want to switch to a newer kernel. --- ## Post 75 by @anon48875053 — 2024-09-08T07:24:23Z > [@anon46412288](#): > > Well, being on a rolling release, I have got used to frequent updates. Why exactly do you hate it? It’s not like it turns off your computer in the middle like Windows. I never notice system updates on Aeon. They just happen in the background, and next time you boot or reboot your PC, it just boots into the new snapshot. If something broke (never happened to me), you just boot to the previous snapshot. --- ## Post 76 by @sha123 — 2024-09-08T08:07:26Z > [@anon55142611](#): > > Yeah, I did. But whenever I get 5G wifi network, I just like that update it. And yeah, restarting for a single 4KB update sucks. Did you use your distros GUI software center like ‘Discover’ by any chance to update? Use the command line to update instead and you need less restarts after updates. You can also activate automatic updates just for security updates, so you won’t even notice these most of the time and do a full update including feature patches one or two times a month. --- ## Post 77 by @anon46412288 — 2024-09-08T08:09:21Z Also KDE has an option to apply updates after reboot - ![image](//forum-uploads.privacyguidesusercontent.com/original/2X/8/82da78be090798fc6ae05aad4abb269b3d2037fb.png) Under System Settings \> System \> Software Update. --- ## Post 78 by @anon55142611 — 2024-09-08T08:44:12Z > [@xe3](#): > > has anyone mentioned [VanillaOS](https://vanillaos.org/help/faq) yet? Yeah, I know it already, Problem is rolling and no KDE variant. They planned it but need to wait for a while. I would like to use a LTS distro, but PG’s guidelines make me not to. > [@overdrawn98901](#): > > distro hop. I tired OpenSUSE, vast tools such as YaST, etc and rolling. So, no. Debian was good and was preparing to do the shift but as I said, I am not sure due to PG’s guidelines. Hence, why, “Linux Mint + Latest Kernel (Kernel only) + KDE” is my idea for now. Solus is there but what if in the future, the project is down. I am willing to donate them $1/month. But I can’t risk it and change stuff back later again. > [@overdrawn98901](#): > > You can make this change more seamless by creating a “/home” partition on your first (re)install if you haven’t done so already. I do know that, But I would definitely mess up. So, I am not doing it. > [@anon46412288](#): > > Why exactly do you hate it? It’s not like it turns off your computer in the middle like Windows. I update and restart my fedora. Then, while working after 2 or 3 hrs straight, I get another update cycle. Yeah, I could just set the notifications to weekly basis and update it. But I think it’s risky what if it’s 0-day vulnerability. > [@anon46412288](#): > > It really depends on what is being updated. Rule of thumb : Updates for the kernel, systemd and drivers (especially gpu drivers) need a reboot. Using offline updates in fedora, so updates are applied correctly instead of breaking when apply via live update. > [@anon43985288](#): > > systemctl soft-reboot You mean offline updates for packages except kernel ? > [@anon48875053](#): > > it just boots into the new snapshot In Fedora, it needs to update to the new packages when I reboot or start the deck in the morning. > [@sha123](#): > > Did you use your distros GUI software center like ‘Discover’ by any chance to update? Use the command line to update instead and you need less restarts after updates. A mix of both. > [@sha123](#): > > You can also activate automatic updates just for security updates Actually this is what I am trying to do in fedora and settle without swapping but nothing helps in fedora forum or web. --- ## Post 79 by @anon43985288 — 2024-09-08T08:54:48Z > [@anon55142611](#): > > You mean offline updates for packages except kernel ? Soft-reboot command doesn’t handle any updates of any kind. It’s purpose is to clear the userspace and re-initialize the system again starting from PID 1. But as you have guessed, you can’t bring down the kernel while it is still running. --- ## Post 80 by @anon46412288 — 2024-09-08T08:56:26Z > [@anon55142611](#): > > I update and restart my fedora. Then, while working after 2 or 3 hrs straight, I get another update cycle. I don’t think you are _required_ to update ASAP. You can just ignore them and update when you have time. That’s what I do with arch, I wait 2-3 days if there aren’t a ton of packages have updates. If the amount of packages that are updatable cross the 100-200 range, then I update. --- ## Post 81 by @anon48875053 — 2024-09-08T08:57:04Z > [@anon55142611](#): > > In Fedora, it needs to update to the new packages when I reboot or start the deck in the morning. Yikes. --- ## Post 82 by @anon46412288 — 2024-09-08T08:58:48Z That’s why I use live updates and reboot. Much faster done that way. --- ## Post 83 by @anon55142611 — 2024-09-08T09:00:06Z If there is a better suggestion to using LTS distros. I am all for it and would just jump quickly. Is my Linux mint idea good or way too bad. --- ## Post 84 by @overdrawn98901 — 2024-09-08T14:32:24Z > [@anon55142611](#): > > But I think it’s risky what if it’s 0-day vulnerability. I think this is the core issue. Your threat model doesn’t seem well defined. Are you actively being targeted by the government or an advanced intelligence agency? Why is this risky? Remember, risk isn’t binary. You aren’t completely safe, or dead out of water. It’s a spectrum to find balance. If you are worried about 0 days, you should probably be using QubesOS without thought - but I highly doubt this is the case. I strongly believe you really should post [what your security threat model](https://www.privacyguides.org/en/basics/threat-modeling/) is. This is throwing off recommendations and leading to a bit of thrashing. I still believe your update policy is too strict. > [@anon55142611](#): > > I am all for it and would just jump quickly. > > Is my Linux mint idea good or way too bad. Personally, I’ve explored the problem with you, offered alternatives that meet your criteria, and we are at different conclusions. Linux Mint is probably fine for you, and it being good or bad depends largely on your needs. PG is a **guideline** - it’s a recommendation but it isn’t the final say in your system. Not doing what it exactly says doesn’t mean you are left in the dust. With that, Linux Mint is a fine distro. It’s probably good enough for your needs, and if you found a way to install the latest kernel than that’s good too :+1: --- ## Post 85 by @anon63378630 — 2024-09-08T14:57:58Z > [@anon55142611](#): > > I get another update cycle. Fedora pushes updates out around midnight UTC every day and they sync to all the mirrors over the next 6 hours or so iirc. You should update/reboot daily, but updates are an absolute pita due to the offline update mechanism especially requiring luks password twice. This is honestly one of my biggest issues with Linux, is that no normal distro has truly functional _and_ reliable automatic updates. Atomic distros do fix this but they come at too steep a compromise (largely becoming dependent on the hodgepodge that is Flathub and throwing all the distro guarantees and ideologies out the window). > [@overdrawn98901](#): > > For example take [OpenWRT](https://openwrt.org/releases/23.05/notes-23.05.4), it’s using an even older LTS kernel (5.15) I didn’t actually realize this. My Divested-WRT ships OpenWrt master branch and switched to 6.1 over a year ago and 6.6 over four months ago: [https://divested.dev/unofficial-openwrt-builds/mvebu-linksys/CHANGELOG.txt](https://divested.dev/unofficial-openwrt-builds/mvebu-linksys/CHANGELOG.txt) > [@anon46412288](#): > > use live updates and reboot They truly are unreliable. And no normal Linux package manager can properly resume after a crash. It is something Windows handles superbly with their catalouging system. --- ## Post 86 by @Cyber-Typhoon — 2025-10-08T19:24:46Z > [@xe3](#): > > I liked/used Solus briefly. I was (and am) under the impression it was an independently derived distro (as in not a fork of anything else). I think this is correct and Solus would probably qualify to distro recommendations if wasn’t for the last item in the criteria. Although I don’t know how we measure if is a large project or not.