# Installing tor browser on secureblue **URL:** https://discuss.privacyguides.net/t/installing-tor-browser-on-secureblue/33935 **Category:** Questions **Created:** 2025-12-17T13:55:47Z **Posts:** 64 ## Post 1 by @imitation-unkind — 2025-12-17T13:55:47Z I’ve been attempting to install tor browser on secureblue. At every turn something has prevented it from launching. so far best I can tell its a userns problem, but even the ujust command to enable that has not fixed it. I would really love advice about this. if I cannot use tor browser on this os it is practically unusable to me. --- ## Post 2 by @anon64393690 — 2025-12-17T13:59:01Z Did you disable hardened\_malloc for Tor only? AFAIK it doesn’t play well with Firefox --- ## Post 3 by @any1 — 2025-12-17T14:27:06Z > [@anon64393690](#): > > AFAIK it doesn’t play well with Firefox If Firefox is built with `--enable-replace-malloc` it would work. --- ## Post 4 by @anon63378630 — 2025-12-17T15:02:08Z ``` flatpak install https://dl.flathub.org/repo/appstream/org.torproject.torbrowser-launcher.flatpakref flatpak --user override --env=LD_PRELOAD= org.torproject.torbrowser-launcher ``` --- ## Post 5 by @any1 — 2025-12-17T15:36:43Z You would still run into the same problem and have to remove LD\_PRELOAD from the Flatpak. --- ## Post 6 by @sha123 — 2025-12-17T16:57:45Z Running Tor Browser with a weakened sandbox due to Flatpak is not a good option. Better layer it. --- ## Post 7 by @anon63378630 — 2025-12-17T17:29:40Z > [@sha123](#): > > weakened sandbox Better to just run Tails in a VM? > [@sha123](#): > > Better layer it. but then you’d have to `ujust with-standard-malloc tor-browser-launcher` in a terminal each and every time --- ## Post 8 by @null — 2025-12-17T17:33:11Z You can remove LD\_PRELOAD with Flatseal if you want a GUI. ![Screenshot From 2025-12-17 18-28-20_1](https://forum-uploads.privacyguidesusercontent.com/original/3X/a/a/aaff672764da60099d0958cbec9e0a6da5af77ef.png) --- ## Post 9 by @KevPham — 2025-12-17T19:03:02Z Have you thought about using Whonix via virt-manager? If that is a bit too much work for you, you can also use Gnome Boxes or Distro Box to run Tor Browser in just about any Linux distribution you want within SecureBlue --- ## Post 10 by @leahh88g4 — 2026-01-21T13:13:59Z So what is the recommended way to install Tor on Secureblue? --- ## Post 11 by @leahh88g4 — 2026-01-23T15:33:07Z @RoyalOughtness could you please let me know what the recommended way is to install Tor (and other browsers)? I am not on Discord and do not know where else to get support. Thank you! --- ## Post 12 by @Man — 2026-01-23T16:03:15Z > [@KevPham](#): > > Gnome Boxes or Distro Box to run Tor Browser in just about any Linux distribution I don’t know how much this matters but the secureblue FAQ has a warning about this practice. > **[Security implications - Distrobox](https://distrobox.it/#security-implications)** > > Isolation and sandboxing are not the main aims of the project, on the contrary it aims to tightly integrate the container with the host. The container will have complete access to your home, pen drive, and so on, so do not expect it to be highly... > > > Right now the distrobox's containers are created in privileged mode and share a …lot of sensitive host's folder. > > This is done because the aim is tight integration with the host, not sandboxing. > > --- > > It would be nice to have an **optional** (see: disabled if not specified) `--unprivileged` or a `--sandbox` flag in `distrobox-create` to have a more isolated container to work with. --- ## Post 13 by @Man — 2026-01-23T16:13:26Z If the YouTube video I watched earlier was accurate, they are going to integrate browsers through Bazaar once it is ready, then flag the Flatpak versions and block them. ![IMG_20260123_161644](https://forum-uploads.privacyguidesusercontent.com/original/3X/5/b/5b06accc5309742781d7c0529b4a4d2ce383b39e.jpeg) --- ## Post 14 by @leahh88g4 — 2026-01-23T16:49:28Z Thanks, but I am still confused on how to install Tor (and other browsers). I find it very difficult to get info/tutorials on Secureblue - I am willing to learn but if there are is no support it seems impossible for a beginner. --- ## Post 15 by @Man — 2026-01-23T17:04:01Z I don’t know if it is possible to securely install other browsers at present. Secureblue is such a new project. I would recommend booting Tails if Tor is required or Mullvad Browser + VPN on another distro in the meantime. There are ways to route all traffic through Tor if you want to use Trivalnet + Tor. It isn’t a substitute for Tor Browser though. There are other reasonably secure atonic Fedora based distributions that will make migrating easier once secureblue is ready. Ostree is the reason you are struggling to install Tor Browser however. > **[Fedora Atomic Desktops](https://fedoraproject.org/atomic-desktops/)** --- ## Post 16 by @sha123 — 2026-01-23T19:05:29Z > [@leahh88g4](#): > > Thanks, but I am still confused on how to install Tor (and other browsers) - Install either via download or layer torbrowser-launcher via rpm-ostree - Enable unprivileged user namespaces for unconfined\_t domain via ujust (or write a Selinux policy for tor browser) - start tor browser without hardened malloc (via ujust) --- ## Post 17 by @Cyber-Typhoon — 2026-01-23T19:23:52Z That is my understand as well. --- ## Post 18 by @leahh88g4 — 2026-01-24T07:28:45Z Thanks, but this is what I mean: as a beginner, what even is layering (and how to do it)? what are namespaces? I cannot find any beginner-friendly tutorials on all these things. And most importantly: would installing an app in such a way be a security risk? --- ## Post 19 by @Man — 2026-01-24T08:55:40Z I believe secureblue is immutable, so you can’t modify the core system. Non-Flatpak applications can be added on top of but not tightly integrated into the core OS. This is to prevent malicious programs interfering with root system files, which keeps you safe. The downside is this also reduces functionality if configuration files cannot be edited. Unless the developer verifies and intergrates an application at that deep level the system will reject it. Flatpak is sandboxed so it runs without interfering with the core OS. But sucure browsers are actually less secure in this environment. If you want to install new programs, as a begginer, then wait for the OS to mature. The developers are working on an easy way to layer browsers into the system. I would reccomend regular Fedora, where these browsers can be installed natively, without Flatpak. It is still private but slightly less secure. Since sucureblue is based on Fedora you will learn valuable skills before switching to secureblue. It may even be possible to ‘upgrade’ to an immutable version of Fedora then switch to secureblue without reinstalling. But I’m not certain about that. --- ## Post 20 by @Securefan — 2026-01-24T09:22:09Z I suggest to use whoonix/tails via virt-manager. It’s the most secure and privacy way to do it and it should be the recommended way. --- ## Post 21 by @sha123 — 2026-01-24T11:32:09Z > [@leahh88g4](#): > > as a beginner, what even is layering (and how to do it)? On “immutable” distros, this means adding a layer with the software on top of the immutable base image. On securueblue this happens via `rpm-ostree install` command. > [@leahh88g4](#): > > what are namespaces? You need to read this up for yourself. Too much to explain. It is basically a very lightweight form of virtualization on Linux, which does not have the same security guarantees as “normal” VMs. > [@leahh88g4](#): > > I cannot find any beginner-friendly tutorials on all these things. Check out the Secureblue homepage, especially the FAQ > [@leahh88g4](#): > > And most importantly: would installing an app in such a way be a security risk? Yes, but I think it is an acceptable risk. Unprivileged user namespaces increase the risk of privilege escalation. But on a single user system, you are screwed anyway, if malware runs as your user in an unsandboxed way and most sandboxes deny access to unprivileged user namespaces nevertheless. As @Securefan said, using a Whonix VM instead would be the most secure option, but it is also much more inconvenient and resource hungry. --- ## Post 22 by @PtiBouchon — 2026-01-24T12:06:00Z > **[Example: setting up Torbrowser](https://github.com/igo95862/bubblejail/wiki/Example:-setting-up-Torbrowser)** > > Bubblewrap based sandboxing for desktop applications - igo95862/bubblejail --- ## Post 23 by @leahh88g4 — 2026-01-24T16:32:12Z > [@sha123](#): > > Check out the Secureblue homepage, especially the FAQ Well, most of that isn’t really beginner-friendly either :frowning: So just to confirm: I should be downloading the Tor.tar.xz-file and what would be the correct command the for rpm-ostree? Second question: I also tried to set up a Wireguard tunnel, I did exactly as described on the Secureblue website by importing the .config-file, and while it looks like it is working (the connections enabled and no error messages), I cannot open any website, so it obviously is not working. Are there any other things that need to be changed/added when using Wireguard? --- ## Post 24 by @Cyber-Typhoon — 2026-01-24T16:48:12Z > [@leahh88g4](#): > > Well, most of that isn’t really beginner-friendly either Just curiosity, why a beginner needs Tor browser? --- ## Post 25 by @Man — 2026-01-24T18:11:38Z If you use a commercial VPN they might offer a command line program which can be installed using Homebrew. WireGuard isn’t begginer software. Are you trying to access the web or another network? WireGuard tunnels aren’t for general internet connections unless you are evading censorship. It’s for connecting one computer to another, or one computer to a network as if it was local, not browsing Wikipedia. --- ## Post 26 by @null — 2026-01-24T18:17:35Z There can be a billion reasons why people is using Tor. You don’t need to be a internet-wizard to use Tor. Tor is for everyone and is beginner-friendly. I think Tor is most people first real introduction to digital privacy and anonymity or I know it was when I was growing up. I think a better question is why would a beginner use Secureblue when Secureblue isn’t beginner-friendly or meant to be a beginner-friendly. --- ## Post 27 by @sha123 — 2026-01-24T18:25:31Z > [@leahh88g4](#): > > what would be the correct command the for rpm-ostree? You really should learn the basics about the different ways of installing software on immutable Fedora distros. That’s something you can do for yourself. In this case its `rpm-ostree install torbrowser-launcher` --- ## Post 28 by @leahh88g4 — 2026-01-25T04:52:55Z > [@Cyber-Typhoon](#): > > Just curiosity, why a beginner needs Tor browser? Anonymity when browsing? > [@Man](#): > > Are you trying to access the web or another network? Simply in order to use my home network from other places. It is very easy to set up a Wireguard config, the router already has a setting for it. > [@null](#): > > why would a beginner use Secureblue when Secureblue isn’t beginner-friendly or meant to be a beginner-friendly. Yes, I agree, but I have experience with beginner-friendly distros such as Mint or regular FEdora. Unfortunately these have security issues and that is why I am trying to learn about Secureblue. But if there aren’t any tutorials for beginners or support, that is exactly why beginners turn back to Windows. Everything was/is working there, all browsers, Wireguard etc. No issues whatsoever. Even on Mint and Fedora most of it was working/possible. But again - it seems like the standard user who is not a tech nerd only has the choice between bad privacy = Windows or bad security = standard Linux. > [@sha123](#): > > In this case its `rpm-ostree install torbrowser-launcher` I am confused. Why would you use Flatpak for Tor? I was under the impression NOT to use Flatpak for any browsers, even on the regular distros (not atomic) I have always installed it with the tar-file. --- ## Post 29 by @Cyber-Typhoon — 2026-01-25T07:05:28Z > [@leahh88g4](#): > > I am confused. Why would you use Flatpak for Tor? The command shared is not a Flatpak installation instruction. --- ## Post 30 by @username0990 — 2026-01-25T09:27:01Z > [@leahh88g4](#): > > Yes, I agree, but I have experience with beginner-friendly distros such as Mint or regular FEdora. Unfortunately these have security issues Well, what are these security issues? --- ## Post 31 by @Man — 2026-01-25T09:45:39Z > [@leahh88g4](#): > > But if there aren’t any tutorials for beginners or support, that is exactly why beginners turn back to Windows. I have already explained that sucureblue is not yet ready for general use. It is still in an early development stage. Use Fedora or a more established atomic variant if you need good tutorials. Windows users shouldn’t start with obscure beta distros less than a year old. --- ## Post 32 by @null — 2026-01-25T09:55:56Z > [@leahh88g4](#): > > Unfortunately these have security issues and that is why I am trying to learn about Secureblue. But if there aren’t any tutorials for beginners or support Maybe give Fedora + [Brace](https://github.com/divestedcg/brace) a try. It’s a harden Fedora you can still use the normal Fedora community support. --- ## Post 33 by @sha123 — 2026-01-25T10:32:11Z > [@leahh88g4](#): > > I am confused. Why would you use Flatpak for Tor? It’s not a Flatpak. You should really learn the absolute basics. --- ## Post 34 by @leahh88g4 — 2026-01-25T15:20:53Z > [@username0990](#): > > Well, what are these security issues? There are numerous threads on PG about the insecurity of Linux desktops. > [@sha123](#): > > It’s not a Flatpak. You should really learn the absolute basics. I understand rpm-ostree is not Flatpak, but torbrowser-launcher is Flatpak…on Tor’s website you only get the tar-file and whenever I installed Tor in a regular/non-atomic distro I followed [Tor’s guide](https://support.torproject.org/tor-browser/getting-started/installing/#linux). There is no mentioning of torbrowser-launcher… --- ## Post 35 by @Cyber-Typhoon — 2026-01-25T15:38:57Z > [@leahh88g4](#): > > but torbrowser-launcher is Flatpak No. --- ## Post 36 by @Man — 2026-01-25T16:20:20Z If it was the Flatpak version then Flatpak would be in the command. There is a Flatpak version but it also exists as a non-Flatpak variant for Fedora. > **[torbrowser-launcher - Fedora Packages](https://packages.fedoraproject.org/pkgs/torbrowser-launcher/torbrowser-launcher/)** > > View torbrowser-launcher in the Fedora package repositories. torbrowser-launcher: Tor Browser Bundle managing tool --- ## Post 38 by @IsItJustMe — 2026-01-26T00:55:30Z Just to throw in my 2 cents. I feel your pain. I just reinstalled secure blue and very quickly realized why I ditched it in the first place. This time around it must have been updates because my vpn app quit working. Just installing what I would consider basic I would get warnings about disabling security features being disabled and the app would not work anyways. I am not blaming Secure blue, it’s my own lack of knowledge. I use the phone for most everything anyways and just went back to a Ubuntu flavor, may try fedora. Secure blue is just too complex for me. I do have a set up like a docking station that I use for graphene os as a desktop to an external monitor, keyboard, mouse and ports to hook up any flash drives I may need. --- ## Post 39 by @ImTooPhaT — 2026-01-26T09:23:02Z I use secureblue and yeah, it’s complex. I can’t get Mullvad wireguard to work. The way I use VPN on secureblue is by using ProtonVPN extension for now. --- ## Post 40 by @null — 2026-01-26T10:46:56Z VPN’s is easy to install on Secureblue. Terminal → ujust --choose → install-vpn → when you can choose Mullvad, IVPN or ProtonVPN. --- ## Post 41 by @ImTooPhaT — 2026-01-26T10:48:47Z Oh, I tried importing wireguard config which secureblue recommends. I’ll try that method. So I would type ujust–mullvad install-vpn ? --- ## Post 42 by @Scott — 2026-01-26T10:49:56Z > [@Cyber-Typhoon](#): > > Just curiosity, why a beginner needs Tor browser? How does a person’s experience change their threat model? --- ## Post 43 by @null — 2026-01-26T10:52:40Z `ujust --choose` then choose install-vpn in the menu. --- ## Post 45 by @null — 2026-01-26T11:47:13Z I think the developer just hate Gecko-based browsers he could easily make a ujust --choose menu for other browsers. --- ## Post 46 by @sha123 — 2026-01-26T14:43:42Z I wouldn’t say he hates Gecko-based browsers, but he definitely does not put in effort to make other browsers work without the need to sacrifice overall system security, since Trivalent is considered _the_ browser on Secureblue. You still need to disable some of the unprivileged user namespaces restrictions for other browsers to work, not just Geck-based ones. For other Chromium-based browser it would just need a simple fix to get them to work on Secureblue, while still keeping user namespace restriction for `unconfined_t` active. Most Chromium-based browsers share the vast majority of Selinux rules to get them to work. There is already a policy for Trivalent which could be adjusted for other Chromium browsers or the Chromium rules refactored and split out into a separate module. In the most basic form it only needs additional file context rules, and maybe some small adjustments for some special use cases like a browser shipping a VPN. Or you split out general Chromium rules and have small per-browser policies sharing these rules, for example via attributes. For Firefox-based browsers it would mean quite more work, since you would need a base policy for Firefox first, but for some commonly used Chromium-based browsers it wouldn’t be a big deal to make them work by default on Secureblue. I can understand that a project with only a few core contributors needs to be very careful with their resources and time, but in this case it might be worth putting some time into it, since this is probably a common issue for users. --- ## Post 47 by @leahh88g4 — 2026-01-26T15:17:24Z > [@sha123](#): > > other browsers work without the need to sacrifice overall system security So when installing tor or any other browser like Brave by layering the way you described, would that be “worse” in terms of security than using these browser on Windows? Regarding Wireguard: my problems I am encountering don’t even seem to be Seureblue related as the VPN does not work with other distros either, I tried regular Fedora, Ubuntu and Mint. But the config-file is correct since it works without problems in Windows (with the Wireguard app). --- ## Post 48 by @anon40723879 — 2026-01-26T16:22:41Z I agree that this is likely their posture - but to be fair , I think they have ‘moved’ away from being too strict as the project has progressed. I have recently installed Secureblue and can honestly say it was a ‘Graphene OS’ like moment . I am naturally interested in privacy but am non-technical and less ‘interested’ in security - so I want OS’s that are as secure as possible while still allowing PG approved privacy apps to run effectively. I read all the Secureblue FAQs and their Deepwiki and checked on Flathub that key privacy apps existed so I knew what to expect. I was pleasantly surprised that I could set up Mullvad VPN so easily I initially set up the FF/MB/TB trio via Flatpak ( only really having to disable hardened malloc in Flatseal ) I ditched FF when I found that Trivalent worked without problem for my set of logins … I uninstalled MB and TB Flatpaks after reading about the MB app being non-approved and SHA123 describing layering . TB and MB are both now layered via rpm-ostree ( MB helped by the fact that the Mullvad repo was already installed for Mullavd VPN ) , so this was literally rpm-ostree install mullvad-browser. The only ( fairly significant disadvantage) is that the harden-malloc needs turned off via ujust every time i use MB/TB ( vs the Flatpaks where it is turned off permanently ) I my view , I have moved to a much more secure system while not having to give up any of my ( strongly held ) privacy principles and I have Mullvad VPN , Mullvad Browser and Tor Browser all working fairly easily . Secureblue is completely free , SHA123 has pointed out it is a small group of dedicated people running it and , in my view, it is way ahead of Windows/Apple. If I have a bit of inconvenience to remind me to undertake ‘mindful browsing’ it’s a price I am prepared to pay. Have a good day everybody --- ## Post 49 by @IsItJustMe — 2026-01-27T02:48:00Z That is what I did and mullvad app comes up blank. It worked fine on my last install a couple of weeks ago. --- ## Post 50 by @ImTooPhaT — 2026-01-27T09:32:43Z I installed Mullvad yesterday, but I was not getting internet. However, I installed ProtonVPN instead and it worked? --- ## Post 51 by @null — 2026-01-27T11:24:16Z Try `run0 systemctl enable --now mullvad-daemon` and reboot. --- ## Post 52 by @null — 2026-01-27T11:28:10Z > [@IsItJustMe](#): > > That is what I did and mullvad app comes up blank. Maybe you need to enable XWayland? --- ## Post 54 by @ImTooPhaT — 2026-01-27T12:00:33Z I did that. I’ll probably try it again at some point. --- ## Post 55 by @IsItJustMe — 2026-01-27T13:44:02Z I just wanted to share some more thoughts. I am not any longer angry with Secureblue. I really hope I am not out of line saying this, and this applies to me as I am guilty of not wanting to put the work in sometimes figuring out new systems. I got so used to the “I want it now, I want it fast” ungrateful mentality. I think Secureblue should stay the course and lock down stuff, even if it breaks convenience features. It is my responsibility to learn the OS and not the Developers responsibility to dumb it down for me by making a gradually less secure OS to please everyone. On top of that, taking away needed time focusing on security and or privacy development. In my later years I have learned the value of “Time”. Once gone it can’t be reclaimed. If not for developers putting in the time, their own time, especially with little donations, this digital world could be a lot worse. If someone wants security and or privacy bad enough, they’ll seek it, learn it and apply it. I write this because of my own passive aggressive statements about Secureblue and some self reflection on my attitude in general and I am sorry for the unproductive comments and ungratefulness that someone, somewhere is putting in the time so I can have a more secure OS at no cost to those who don’t have a lot of money to donate. Nothing wrong with questions or discussions. Please don’t misunderstand. I would hate to see any developer in the privacy and security domain succumb to dumbing down an OS or project at the cost of security and or privacy just to make it work for those who are too lazy to do their own work and learn the software or tools. --- ## Post 56 by @leahh88g4 — 2026-01-27T15:38:31Z Oh, I am not mad or upset at the developer either! I am very thankful that projects like Secureblue exist, where people put energy and time into something without even getting paid. I also understand why certain things do not work or can’t work. My issue is just that I really want to learn more about it, learn how to do certain things, how to make them work on Secureblue, and that is unfortunately not possible for beginners. And that is a shame IMHO. I think it should be made possible for beginners as well to use distros that have better security so that they aren’t “forced” to use something that might offer good privacy but lacks in security. --- ## Post 57 by @IsItJustMe — 2026-01-27T16:48:28Z No worries, I was not fingering any individuals other than myself and random complaints I have seen over the years. --- ## Post 58 by @RoyalOughtness — 2026-02-03T06:40:37Z There’s a lot of stuff to respond to in here, so I’m gonna do it all in one big post. In the future though please direct these questions to our Discord :smile:. > Distro Box > a warning about this practice. Yes, the warning is just to inform the user not to treat Distrobox as a sandboxing tool > So what is the recommended way to install Tor on Secureblue? I would recommend using it in a VM. We recently shipped `virt-manager` OOTB, which you can use to provision a VM for Tor Browser. [FAQ | secureblue](https://secureblue.dev/faq#libvirt) > If the YouTube video I watched earlier was accurate, they are going to integrate browsers through Bazaar once it is ready, then flag the Flatpak versions and block them. Correct, see the Flatpak section of [this guide](https://github.com/RKNF404/chromium-hardening-guide?tab=readme-ov-file#flatpak-linux). That said, support for a nested, per-app user namespace toggle may be coming to flatpak [according to](https://github.com/imputnet/helium-linux/issues/46#issuecomment-3707223527) [Sebastian Wick](https://fosstodon.org/@swick), which is great news. :slight_smile: > if there are is no support it seems impossible for a beginner. Highly responsive community support is available on the Discord. > - Install either via download or layer torbrowser-launcher via rpm-ostree > - Enable unprivileged user namespaces for unconfined\_t domain via ujust (or write a Selinux policy for tor browser) > - start tor browser without hardened malloc (via ujust) A VM is of course preferable to this, but what you’ve described is unfortunately preferable to the flatpak, because of the [same issue](https://github.com/flathub/org.torproject.torbrowser-launcher/issues/67) with flatpaked browsers described [here](https://discuss.privacyguides.net/t/how-do-you-install-apps-in-secureblue/25877/14). > I believe secureblue is immutable, > you can’t modify the core system Incorrect on both counts, please read our [FAQ](https://secureblue.dev/faq#immutable). :slight_smile: > what even is layering (and how to do it)? > **[Package layering - Getting Started](https://docs.fedoraproject.org/en-US/atomic-desktops/getting-started/#package-layering)** > > Fedora Atomic Desktops are designed to be easy and straightforward to use, and specialist knowledge should generally not be required. However, Fedora Atomic Desktops are built differently from other operating systems, and there are therefore some... > what are namespaces? > **[User Namespaces | secureblue](https://secureblue.dev/articles/userns)** > > Brief explanation of unprivileged user namespaces and how the feature is handled in secureblue > I have already explained that sucureblue is not yet ready for general use. It is still in an early development stage. This is not accurate. Secureblue is ready for general use. > Some hardened OSes intentionally make apps like Tor Browser difficult to run unless you relax certain security assumptions. We don’t intentionally make it difficult to run. It has incompatibilities with hardened\_malloc and needs userns, both of which we provide convenient toggles for. > I think the developer just hate Gecko-based browsers he could easily make a ujust --choose menu for other browsers. There’s a difference between analyzing software relative to its competitors and hating said software. In any case, what you mentioned would amount to an anti-feature that enables users to shoot themselves in the foot. See the [earlier link](https://discuss.privacyguides.net/t/how-do-you-install-apps-in-secureblue/25877/14) to why using a Firefox-based browser on secureblue is contradictory. > think they have ‘moved’ away from being too strict as the project has progressed. If you say so :sweat_smile:. The goal has always been the same. Sane defaults with toggles to undo hardening as needed. > that the harden-malloc needs turned off via ujust every time i use MB/TB ( vs the Flatpaks where it is turned off permanently ) Please open a feature request for this :slight_smile: We should put this right into the desktop file for convenience > it is way ahead of Windows/Apple. Sadly no. For example, the most secure Windows system is [well ahead](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Only-a-Small-Portion-of-The-Windows-OS-Security-Apparatus) of secureblue and the Linux desktop generally. > It is my responsibility to learn the OS and not the Developers responsibility to dumb it down Making sure that hardening can be conveniently toggled off is very much in scope. We have long-term plans to make a GUI for all the toggles, which should improve convenience/reduce friction/improve user education. But this is fairly long term. > My issue is just that I really want to learn more about it, learn how to do certain things, how to make them work on Secureblue, and that is unfortunately not possible for beginners. I strongly encourage you to ask away on the Discord :smile: --- ## Post 59 by @leahh88g4 — 2026-02-11T15:44:30Z @RoyalOughtness thank you so much for your reply. Regarding support: like I had mentioned, I am not on Discord and do not plan to be :wink: So I’d greatly appreciate if you were moving to a different support platform! One more thing regarding Tor and other browsers on Secureblue: I understand you say that using them will weaken security. Do you mean that security will be even weaker than using these browsers on a regular Fedora installment (or Windows), or do you mean that security will “just” be weakened compared to only using Trivalent? So basically I am asking the security rankings of the following options: - Secureblue with only Trivalent and only apps ftom verified Flatpak - Secureblue with other browsers and apps, layered or as VM - Regular Fedora with only packages from Fedora repository - default Windows with Bitdefender and apps downloaded from the app developers sites Thank you very much for your help! --- ## Post 60 by @dadnerd — 2026-02-11T17:06:26Z > [@leahh88g4](#): > > - Secureblue with only Trivalent and only apps ftom verified Flatpak > - Secureblue with other browsers and apps, layered or as VM > - Regular Fedora with only packages from Fedora repository I believe you have these correct from most secure to least secure. Trying to fit Windows into this list is comparing apples to oranges and you’d probably have to specify which exact element of “security” you’re interested in comparing. --- ## Post 62 by @foyoizkdplcqd — 2026-03-15T17:20:44Z > It’s the most secure and privacy way to do it and it should be the recommended way. Don’t spread misinformation. Both tails and whonix has tons of flaws and huge attack surface. If any of it exploited it could easily deanonymize you. --- ## Post 63 by @foyoizkdplcqd — 2026-03-15T17:33:57Z > Why is installing the .tar and running the tor browser with standard malloc not recommended? who says its not recommended as long as you are using torbrowser to visit popular well known sites then you can safely use torbrowser extracted from .tar file. On the otherhand if you visit suspicious site or piracy site with torbrowser using this setup the malacious site can infect your host machine. If the host is infected then using torbrowser or anyother browser is no use. However if you have used virt manager with minimal vm in that minimal vm you have installed torbrowser and also made that vm read only then even if the torbrowser infected by malacious site cannot affect your host also you already made your vm ready only so after vm restart the malware also don’t persist. This is recommended way if you visit malicious or piracy site. --- ## Post 64 by @RoyalOughtness — 2026-03-17T01:11:55Z > Firefox says something about user namespaces being unrestricted in the tar, but as long as they are disabled in secureblue that shouldn’t be an issue I guess. No, that would be a significant issue. It would mean running TB without basic sandboxing, due to the unavailability of unprivileged userns to TB. So at minimum you’d have to toggle unprivileged userns on. A VM remains preferable.