# Linux privacy **URL:** https://discuss.privacyguides.net/t/linux-privacy/23462 **Category:** Questions **Created:** 2024-12-26T09:24:31Z **Posts:** 45 ## Post 1 by @Breeze7846 — 2024-12-26T09:24:31Z In other threads, it has been vehemently and repeatedly stated that the assumption that mainline Linux distros are worse than apple is in fact false Why? This makes no sense at all. If that was the case, PG would recommend apple. They don’t. They never have. They recommend spins of fedora, SUSE, Qubes, and at other times have recommended ubuntu and even Debian. Plus, apple has repeatedly exaggerated their privacy claims; remember the scanner they wanted to put on everyone’s phone earlier this year? Why on earth would apple be preferable to mainline Linux? --- ## Post 2 by @anon48875053 — 2024-12-26T09:34:25Z > [@Breeze7846](#): > > Why on earth would apple be preferable to mainline Linux? Security. I mean, considering the fact that PG still recommends 1Password, I don’t see why we couldn’t recommend macOS. --- ## Post 3 by @Breeze7846 — 2024-12-26T09:38:25Z **how?** That is quite a claim. First, security at the expense of privacy is the opposite of what PG is about. Just do a locked down windows TPM computer in that case. Second, again, how? Some Linux distros have things like secure boot, file hashing, kernal hardening… Claiming Apple, of all companies, and a proprietary system, is more in line with privacy than Linux is a really hard sell. If anything, this just sounds like an argument to delist 1Password, rather than open the floodgates to other services Could we get a member of the PG team to chime in on this? @jonah? --- ## Post 4 by @anon48875053 — 2024-12-26T09:46:46Z > **[Linux Insecurities](https://privsec.dev/posts/linux/linux-insecurities/)** > > There is a common misconception among privacy communities that Linux is one of the more secure operating systems, either because it is open-source or because it is widely used in the cloud. However, this is a far cry from reality. > There is already a... --- ## Post 5 by @IksNorTen — 2024-12-26T09:50:12Z What do you think of Fedora 41 (Workstation) or SecureBlue ? --- ## Post 6 by @Breeze7846 — 2024-12-26T09:50:23Z So the argument is that rather than risk Linux not being perfect, we jump into something like apple which has proven to run against privacy interests? Sounds like a circular argument. Make no mistake, many distros have the issues you mentioned in the blog. But most are not insurmountable, and several distros take it seriously --- ## Post 7 by @Breeze7846 — 2024-12-26T09:50:40Z PG site recommends it. That’s good enough for me personally --- ## Post 8 by @anon48875053 — 2024-12-26T09:55:21Z secureblue is the cream of the crop of Linux distributions. --- ## Post 9 by @anon48875053 — 2024-12-26T09:58:43Z PG doesn’t currently recommend secureblue on the site, doesn’t mean that it’s either good or bad. The recommendation means that you should take a closer look to it, not use it as an authorative source. --- ## Post 10 by @Breeze7846 — 2024-12-26T10:02:21Z Touche, they do recommend fedora though. Secureblue is just an uber version of fedora. --- ## Post 11 by @IksNorTen — 2024-12-26T10:03:33Z Uber ? --- ## Post 12 by @Breeze7846 — 2024-12-26T10:04:19Z German. In conversation in this case, it means “super.” --- ## Post 13 by @IksNorTen — 2024-12-26T10:05:37Z Oh, okay :sweat_smile: I’m very interested by installing SecureBlue, but I had so much trouble installing the workstation version that I don’t feel comfortable replacing it --- ## Post 14 by @Breeze7846 — 2024-12-26T10:08:26Z Dont overstress yourself. Fedora workstation is solid. Take some time to learn it and increase confidence; it is a good option --- ## Post 15 by @IksNorTen — 2024-12-26T10:11:23Z Okay, because a few days ago the SecureBlue dev’ @RoyalOughtness told me that if I wanted security, I won’t have it with Workstation : [Secureblue - Atomic Fedora Hardening - #167 by RoyalOughtness](https://discuss.privacyguides.net/t/secureblue-immutable-fedora-hardening/16086/167) --- ## Post 16 by @Breeze7846 — 2024-12-26T10:13:56Z There is security and then there is security. Fedora is a great starting workstation, and it inherently doesn’t spy on you. So, nice start to privacy and Linux. For better security, yeah SecureBlue is better… But for most, this won’t give a practical upgrade. At the very least, you should be experienced with Fedora/Linux to really get the most out of SecureBlue, so personally I would learn workstation first if you are new to Linux --- ## Post 17 by @anon48875053 — 2024-12-26T10:15:16Z > [@Breeze7846](#): > > Dont overstress yourself. Fedora workstation is solid. Take some time to learn it and increase confidence; it is a good option I could call secureblue solid, but definently not regular Fedora. > [@IksNorTen](#): > > Okay, because a few days ago the SecureBlue dev’ @RoyalOughtness told me that if I wanted security, I won’t have it with Workstation : [Secureblue - Immutable Fedora Hardening - #167 by RoyalOughtness](https://discuss.privacyguides.net/t/secureblue-immutable-fedora-hardening/16086/167) And he told you the truth. --- ## Post 18 by @Breeze7846 — 2024-12-26T10:25:50Z I wouldn’t argue with a fedora dev. He is correct. My only point was that Fedora workstation is a large improvement from windows, and can help newcomers learn the ropes with Linux. Throwing them into more advanced distributions where they get frustrated with permissions etc can turn them off entirely --- ## Post 20 by @sha123 — 2024-12-26T12:13:12Z > [@IksNorTen](#): > > @RoyalOughtness told me that if I wanted security, I won’t have it with Workstation That’s not what he said. > [@Breeze7846](#): > > Just do a locked down windows TPM computer in that case. What is a ‘windows TPM computer’? > [@Breeze7846](#): > > Some Linux distros have things like secure boot, file hashing, kernal hardening… Secure boot is very limited on Linux and probably doesn’t protect against what you think it does. What do you mean by file hashing and what does this have to do with security? Every OS can calculate hashes of files. --- ## Post 21 by @asanyan — 2024-12-26T12:43:38Z Kinda offtopic but aren’t non-appstore apps not sandboxed in macOS? --- ## Post 22 by @anon42475305 — 2024-12-26T16:01:11Z They aren’t required to be, but even then, macOS at least has a robust permission model for sensitive permissions, even if it doesn’t come close to Android / iOS. It far exceeds what is available and likely what will be available on desktop Linux for at least for the next decade. * * * Qube’s is among the most secure Linux desktop OS. The problem is the Linux guests which are still chronically insecure. The most secure Linux besides Android (if you want to count that) is without a doubt ChromeOS. Functionality and especially privacy wise though it is of course far from a good choice. --- ## Post 23 by @asanyan — 2024-12-26T17:01:30Z What about sandboxing with bubblejail/firejail, what is wrong with it ((other than pulseaudio))? --- ## Post 25 by @RoyalOughtness — 2024-12-26T21:36:30Z To be clear, I didn’t say that :smile: What I said was that secureblue is preferable to workstation (and atomic for that matter). That doesn’t mean that you’ll “have security” with secureblue. Security isn’t a switch you can turn on and off. Frankly, if security is your priority you shouldn’t be using desktop linux at all. secureblue is for people whose first priority is using desktop linux, and second priority is security. --- ## Post 26 by @Niek-de-Wilde — 2024-12-26T21:46:03Z I would appriciate if you were to drop the salty attitude instead of bringing up the fact you disagree with it in ever single thread :). --- ## Post 27 by @Breeze7846 — 2024-12-26T22:16:21Z Hey, may I ask your personal and subjective opinion on what would be a secure OS and or distro? --- ## Post 28 by @asanyan — 2024-12-27T00:34:46Z > [@Anon47486929](#): > > easy access to kernel I mean, there are many ways to reduce kernel attack surface. It’s surely not as good as whatever Android does but it’s not broken (which is great), and Gentoo users can compile their entire OS with hardened flags to further improve security. Lack of verified boot is a problem, but we’ll get there. Plus, it’s not nearly as important as application confinement (which is already in a good state). --- ## Post 31 by @Emilio — 2024-12-27T15:02:41Z I am considering installing Fedora 41 Silverblue I use Fedora 41 right now but I would love to hear what other says about the Silverblue privacy & security --- ## Post 32 by @Emilio — 2024-12-27T15:05:27Z Secureblue do you mean Silverblue just to be sure ? --- ## Post 33 by @seize — 2024-12-27T15:09:57Z They mean [SecureBlue](https://github.com/secureblue/secureblue) which is basically a hardened version of Fedora Silverblue. --- ## Post 34 by @Emilio — 2024-12-27T15:11:06Z Ok ok now I understand how to hardened Silverblue ? --- ## Post 35 by @seize — 2024-12-27T15:18:12Z Personally i haven’t used Fedora Silverblue outside of a few short tests. RPM-Ostree is a learning curve i have yet to tackle. So i’ve stuck with fedora workstation for the last few years. As for hardening Sliverblue i believe the best (beginner approachable) way to harden Silverblue is to _morph_ a Silverblue install into a Secureblue i stall. --- ## Post 37 by @Throwaway — 2024-12-27T19:25:47Z Only problem with Linux is that the open source model means that many applications are maintained by developers who sometimes don’t have the resources of a Google or Apple or Microsoft to keep them updated. Some apps are not updated frequently. They are labors of love by underpaid developers doing the best they can. Some people say open-source is always better than closed source, but that would be true only if they are both maintained the same way. Contrary to what some will say, the big tech companies don’t want a hacking scandal and do spend millions on security. Granted their privacy policies are suspect, but I wouldn’t exactly call Apple’s security posture a joke. Linux is great, but be realistic about what you’re using and if/how it’s maintained. --- ## Post 38 by @asanyan — 2024-12-27T19:45:34Z Whether that is a problem or not depends on the program. If it’s offline-only, it’s perfectly safe to run it even if unmaintained and vulnerable as long as it runs unprivileged and sandboxed. --- ## Post 39 by @TheDoc — 2024-12-29T00:43:24Z > [@Breeze7846](#): > > Why on earth would apple be preferable to mainline Linux? Some people promote Mac (or even Windows) over desktop Linux because they implement [better security](https://www.privacyguides.org/en/os/linux-overview/#missing-security-features) features and exploit mitigations. I think there could be valid use cases for preferring Mac over desktop Linux, but I also think a lot of the “anti-Linux” proponents take it way too far. Some go so far as to say that desktop Linux must be avoided at all cost, implying your security will be compromised if you use Linux. While desktop Linux (excluding ChromeOS) is fairly small, there are still many millions (or tens or hundreds of millions?) of desktop Linux users. There is no epidemic where desktop Linux users are getting infected and hacked, certainly not more often than Windows users. To be fair, this is at least in part because desktop Linux has a much smaller market share and cyber criminals are less likely to target it. There could be other factors too, like the fact that most Linux users are meant to install applications from an app store rather than trying to search the web for an executable file. I’ve seen friends, family, and myself easily get infected on Windows before, but never on Linux. Until we start seeing that change, desktop Linux (especially less bad [distros](https://www.privacyguides.org/en/desktop/)) should be good enough for the average person _for now_. That being said, depending on your irrelevance for your security is a terrible situation to be in. It is extremely important that developers improve the security of desktop Linux to at least match what is offered by its more mainstream competitors, especially now that it is gradually becoming a more popular option and therefore more appealing to cyber criminals. --- ## Post 43 by @anon64969329 — 2024-12-29T07:30:59Z You made that entire long post without a single good argument for your case. It’s just quite a lot of name calling and sarcasm. Also guilt tripping people that upvoted my comment. The strongest argument you have is that “a lot of people swear by GrapheneOS” which means absolutely nothing. That Debian LTS part was also really weird and pretty much a strawman. Half of the post is just you arguing with yourself and calling names. Oh, and it was quite interesting to say that I outsource trust while in the next sentence doing that yourself with “why so many entities say GrapheneOS is secure” --- ## Post 45 by @asanyan — 2024-12-29T12:33:29Z Apologies for butting in, but I don’t think their intention was to criticize GOS itself but rather people who simply take whatever is said by them as absolute truth. Just because -very smart person- said something doesn’t make it true, even more so when missing context. Take for instance the thread about filesystems, where someone claimed ext4 was insecure simply because some GOS developer said so, while completely disregarding what they meant by this. While GOS is a great project and sets a high bar when it comes to security, it doesn’t mean that everything that is below their standards is complete garbage, which is what many people who “swear by GOS” think, and assume their threat model applies to everyone else. Sure there are “FOSS cultists” but there are many “GOS cultists” too.