I see. But, I am using Linux Mint, and the traditional one is Fedora, I am a Linux beginner for over Three Months of experience with Linux Mint, I am not sure what distro to use for that reason. Plus, I have to learn new commands, like How do I update and use full-update? How do I install using the command line, and stuff like that. I am not sure if there are instructions on these.
Mint is based on Ubuntu, which is based on Debian. Updates and installing/removing software should work the same on any traditional distro in the debian family (sudo apt update && sudo apt upgrade and so forth).
I am not sure if there are instructions on these.
Start with the official docâs of the distro you use or want to use, and also consider the docs from the upstreams (Ubuntu and Debian in the case of Mint). Also know that with almost any linux command you can add --help to the command to learn more, or use man to read a brief manual page for the command or package (e.g. man dnf or dnf --help)
Fedora is in another distro family, so commands will differ more (sudo dnf upgrade or sudo dnf install <package>)
1 Like
I couldnât have phrased a better response than this one. Itâs direct to the point. Understanding more about your threat model is a self-realization and a continuous journey with a lot of learning.
@Doctrine, do you really need those distros that you are exploring? Have you also checked the Linux distro recommendation page? There is quite good information there, and even in this forumâs previous posts, we see a lot of good discussions. We canât do much if the hardware is compromised, as @anon66226834 pointed out. I donât want to sound biased, but most of us would probably be well-served with Fedora and tuning it to our liking.
2 Likes
For starters, you never mention anything about your threat model, so we canât quite tell exactly what youâre trying to defend against and therefore we cannot provide tailored advice on which OS you should be using. That being said, Iâll be honest and admit that choosing a âprivate/secureâ operating system isnât going to result in you finding an ideal choice, but rather it will result in you picking the best available option that you can make work. Iâll try to briefly summarize my recommendations for you, but without any information on your threat model, this is just going to be very general advice.
-
Use Tails if you require an anonymous system that prioritizes counter-forensics over security. Tails is particularly appealing if you are unable to change your installed operating system and do not want to risk leaving traces of sensitive activity on your device. In my opinion, itâs probably the easiest of the bunch and itâs well suited for those who do not want to be âcaughtâ using âsuspiciousâ software. For instance, if youâre concerned about your PC being inspected by authorities.
-
Use Whonix if you require an anonymous system that prioritizes security over counter-forensics. Itâs important to keep in mind that Whonix is not used as a standalone operating system. It is used within a virtual machine, so picking the right host OS and hypervisor will play an important role in how well youâll be able to protect your security and anonymity. Whonix recommends Debian, Kicksecure, or Qubes OS as your host operating system. However, I think a good argument could be made for using one of the Privacy Guides recommended operating systems (such as Fedora Workstation or Fedora Silverblue) over Debian. In addition to being more secure, Fedora might be easier to use and could be better suited as a host operating system for general use in addition to being a Whonix host if thatâs how you intend to use your computer.
-
Use Qubes OS if you require the utmost security. It is very picky with hardware and has a large learning curve, but if you are facing a well-resourced adversary, it is probably worth the struggle. Qubes OS is also not used entirely on its own, you will have to choose which guest operating systems youâre going to run in virtual machines. For anything requiring anonymity, using Qubes in conjunction with Whonix (known as Qubes-Whonix) would be the way to go. Just keep in mind that while there are benefits to using Qubes as a host for Whonix, there are also disadvantages. For anything which doesnât require anonymity, I assume using a Fedora guest OS might be the best option for general use.
-
If you primarily plan on using Whonix on your PC and are unable to make use of Qubes OS or find that the cons of Qubes-Whonix outweighs the pros for your situation, then I would consider using Kicksecure if youâre able to put up with it. (As mentioned earlier, there are pros and cons to choosing a Debian-based system versus something more up to date such as Fedora.)
-
If you do not require strict anonymity protection and are just looking for a more privacy-respecting operating system for general use, Iâd stick to one of the easier Privacy Guides recommended operating systems, Fedora Workstation being the easiest to use of the bunch.
4 Likes
I think you are feeling overwhelmed due to there being no objectively âgood enoughâ desktop OS. Let me try to present a step by step thinking process that might help:
- Evaluate the threat model
- Explore your options
- Evaluate which best fits your need
Lets do this step by step now. Starting with threat model.
I think there are 3 main ways Corporate/Mass Data Collection currently happens:
- Operating System Level: Telemetry and data collection baked into the OS. This is mostly a threat if you use Windows or Mac devices, and thus usually using a linux distribution or something similar solves this.
- Application Level: Application telemetry and data storage done by applications. This can be solved by doing two things: Limiting what the application can collect, and/or using applications that collect minimal/no data. To do this, you should always use sandboxed applications with permission control (this may range from using flatseal, to using bubblewrap or VMs, or even different devices to use specific applications. Also, always use trusted applications that are not collecting data by default.
- Network Level: Browsing habits and data about your online service usage that is collected for advertiser profiles. You can prevent this by using VPNs, Tor Browser, VMs to run a network (like whonix and qubes), etc. depending on your preference.
Now note that none of them are going to use any advanced methods, because tbh they donât need to. Most consumers donât deny them this data, and the ones that do are usually not their target demographic anyways. Remember they donât care about your data specifically as much as they do care about averages.
Not relevant to desktop OS question as these efforts are targeted towards encrypted communication (Signal, Whatsapp, etc.) for now, and not encryption done on OS level (FDE, file encryption, PGP, etc.)
No desktop OS can save you from bad hardware/hardware backdoors. Tails, Whonix, Qubes, etc. all rely on you having a machine that you trust when it comes to basic hardware (like Intel, Qualcomm, etc.). You have to trust someone in the end, even in systems like Graphene OS or even NSA computers lol.
Explore your options
You have listed Tails, Whonix, Kicksecure, and Qubes. They all have very different usages. Lets see which of these can mitigate which threats we discussed above.
- Tails: Can stop OS level and Network level data collection to a reasonable extent. Cannot stop malicious applications, for example see how Facebook and NSA exploited Tails. But that doesnât matter, our threat model is still mass surveillance.
- Whonix: Can stop Network level data collection very well. Can protect against web applications that try to compromise your IP. But depends on being run on a trusted operating system, since it uses VMs. But again, doesnât matter much: Google is not deploying a zero day to see which anime you like or what music you are listening to.
- Kicksecure OS: Can stop OS level and network level data collection. Can protect from application probing your OS.
- Qubes: Overkill, but does protect from OS level, network level, and even application level data collection. Can also protect against malicious apps and networks. But again, remember our threat model. It is VERY overkill to use Qubes OS for preventing corporate data collection.
Evaluate your best fit
This part is up to you.
My advice
I would say just use Fedora or something (I would recommend any fedora atomic distro personally). No point doing all this effort for a threat model that is trivial to protect against. I would advise you to not get too obsessed over this, it will drive you crazy. Donât run around trying to find the âperfectâ solution. Be reasonable and rational.
4 Likes
Can you provide a source for NSA part? Iâm only aware of Facebook incident
And how do you know if the hardware is compromised? Please tell us.
I imagine you canât ever be completely sure. The best tactic is to purchase vetted and popular hardware from reputable manufacturers
It was the FBI, the NSA was not involved in the exploitation of Tails.
No one would know except the manufacturer.
I also agree with this advice. For a daily driver, almost any Linux distribution is miles better than Windows or MacOS in terms of privacy. Personally I would try to avoid Ubuntu as there have been some strange defaults like an Amazon default install + Canonical driving the distro which is for profit, but itâs still ok for beginners. with that I would recommend for daily desktop distroa Fedora, Linux Mint, Asahi for MacBook with M chips, or Ubuntu. For a slightly different flavor you can try Manjaro, which is Arch based, but will leave the differences to your research.
Really the first choice doesnât matter so long as itâs well supported and easy to research when you have issues.
After youâve got a strong understanding of maintaining your daily driver distribution, then start to explore âwhat does my daily driver distribution not do what I want it to?â. Most distros you can configure to be reasonably secure and private within reasons. Only if you want to take it to the next level, then start shopping around again.
With this, I have different use case for distros:
- Desktop: Manjaro, as I like the Arch, really no major preference
- Server: Rocky Linux, as I favor stability and wanted to stick close to RHEL
- Pentesting and IT: Kali Linux on a portable USB Drive, really for work stuff and a handy backup way to access hard drives
- Portable USB Drive for Untrusted environments / disposable VM: QubesOS/Kicksecure/Whonix/Tails, depending on the use case you need
I havenât needed to use the untrusted drive really much at all, and spend most of my time on the daily driver.
That is correct. It is a secret. Only the Feds would know.
As @anon66226834 pointed out, it was FBI not NSA in the specific case I was mentioning. Apologies for the confusion, I was writing from memory 
. But NSA too does use attacks that Tails is often vulnerable to (compromised applications, libraries, etc.), including through the infamous Equation Group.
Yup, the vendor should be reputable AND also generic/open to the public.
Like you buying a dell laptop from a random computer shop is definitely better than you ordering it online from a marketplace with your personal information and address, which is still better than ordering a custom made one, since the custom one might actually be targeted towards âinterestingâ people (see Anom and Crypto AG)
Whonix is based off of Kicksecure
If youâre afraid of privileged backdoors in ARM and x86, then all hardware is essentially compromised. Not saying that they are used in a malicious fashion, but they can be.