Can you share that list?
Iâm working on it, itâs not finished, yet.
3 Likes
Oh wow, this is so helpful. 
Hey out of curiousity, why is tlp and tlp-rdw checked for on there? Are they more secure than power-profiles-daemon? My understanding is that they donât work properly on modern Fedora (TLP documentation mentioned 38+)?
Unfortunately my laptop locks up when it tries switching to battery on TLP anyway so it doesnât seem possible for me to utilize it regardless. 
@HushedWave
Fedora 41 deprecates power-profiles-daemon in favor of tuned.
ppd was also largely only useful on Intel systems with all the correct metadata set and exposed by the firmware by the vendor.
Iâve used tlp for years and havenât had issue with it, even on desktops to squeeze out some lower idle power draws.
It switches just fine and everything.
brace recommends tlp-rdw and combines with a config to disable wireless when wired is connected.
do check if you have any bios/efi updates available as well as drive firmware updates
Ah interesting! Iâll have to look into Tuned.
Definitely no BIOS updates since 2020 - which I have. Not sure how Iâd check for drive updates as this is an old Lenovo laptop⌠Thanks for the suggestion tho, if I can find a way Iâll give it a go. 
2 Likes
This has an amazing layout, but is this website considered to have genuine and accurate information by PrivacyGuides?
GrapheneOS contributors contribute to the website, so I consider most of their info is correct just like PrivacyGuides.
2 Likes
Jerm, you have some fast reflexes!
Iâm reading your link now, but is Comparison of Operating Systems recommended or endorsed by Privacy Guides?
Why would you rely on one source only? Youâre setting yourself up for failure by doing so.
The comparison is great, and the information is accurate too, it doesnât make a difference if PG endorses it or not.
5 Likes
I always read official GOS claims witha. Bit of skepticism because they have a tendency to sometimes pursue personal vendettas
1 Like
But it is Desktop OS page that they contributed to.
Apologies for the delay in response,
Say you had a diaryâŚ
I donât think your metaphor is valid. Youâre making an error assuming that something must be unpickable / unhackable in order to be secure. No such guarantee exists in this world, and that is not how security is designed to work. (Good) security is designed with a threat model in mind, security architects must always design their defences around a specified threat. Something is secure so long as it successfully protects against an attack in practice - not every hypothetical attack imaginable. If an individual was thwarted in their attempt to open that diary, it can be considered secure for that specific attack scenario.
However, if your lock was unpickable (secure), you could still be unprivate by unlocking your diary and showing your friends (loss of privacy via secure, authorized means).
This makes no sense. If you show your friends, there is no loss of privacy since you willingly shared that information.
Ergo you canât be private without being secure, but you can easily be secure without being private.
An invalid argument following from a false premise.
Privacy on the other hand is simply taking those locks and keys and making a personal determination about what corporate, state, etc actors to consider unauthorized.
No, thatâs just threat modelling.
What makes privacy nebulous (and I agree that it is definitely nebulous compared to security) is the fact that it shares many characteristics with security (as in a venn diagram) and I would imagine subsumes a great deal of security, while security is more specific.
Youâre making an error assuming that something must be unpickable / unhackable in order to be secure. No such guarantee exists in this world, and that is not how security is designed to work.
Nope, I was describing the concept using a platonic ideal. Perfect security means an unpickable and unbreakable lock. That doesnât mean that perfect security actually exists
This makes no sense. If you show your friends, there is no loss of privacy since you willingly shared that information.
This makes no sense. By this logic every windows user doesnât lose any privacy because they willingly shared information with Microsoft.
No, thatâs just threat modelling.
No, threat modelling is a method of determining what vectors exist that have the potential to break through your security mechanisms. Has nothing to do with determining who to authorize.
Frankly, it seems like you are unfamiliar with many of these terms youâre using. One place to check out would be the Microsoft Threat Modeling Tool for an introduction to threat modelling: Microsoft Threat Modeling Tool overview - Azure | Microsoft Learn
2 Likes
Real-world talk. The NSA is an actor unauthorized by me, but authorized by Google. How is my security when I connect to Google knowing no âotherâ unauthorized actor will have access to whatever contents Google has on me? I still consider myself hacked, do you?
1 Like
Itâs always hard to know when mockery is meant to hide ignorance or a hidden agenda.
Anyone who watched FBI Director Christopher Wrayâs testimony in Congress knows thereâs no attempt to hide the fact that tech companies hand over data in real time. They are made available in a âgovernment databaseâ. Boogeyman agencies need no permission to ask Big Tech for your data they already have, but to query their own data base they should ask for warrants (well, for US citizens at least). Which they donât. Mr Wray had to defend the FBI before the Congress for making almost a million warrantless queries.
But by all means, letâs continue pretending I was talking about Google lawfully responding to a subpoena.
2 Likes
There is no legally operating tech company that is immune from this. Because tech companies has to be hosted somewhere in this world.
2 Likes
This doesnât really contradict what I wrote, aside from the fact that I was simply using Google as an example.
But letâs take your example. You authorized google to see some data, and they shared it with someone else. So, your error was in trusting google with your data and authorizing them to see it. The actual transfer of data to the trusted party is secure. Thatâs what security means. Whether the party you decided to trust was indeed trustworthy has nothing to do with security and everything to do with sound judgement.
In your example, replace Google with a friend youâre communicating with over E2EE on Signal. Letâs say you tell them a secret in confidence. But they go behind your back and share your secret with someone else.
Does that make Signal insecure? By the logic in your original example, it would. But it obviously does not.
I still consider myself hacked, do you?
No and thatâs not what that means anyways. If you encrypt a secret to someone in confidence and then they share it with someone else anyways, then theyâre a bad friend, but they didnât âhackâ you.
I appreciate your reply!
It just seems like youâre giving up more compatibility by using a more obscure secure OS like FreeBSD.
Whatâs the point of having a secure OS if you canât do much with it because it only runs a small number of Apps???
BSDs arenât really meant for desktop usage.
2 Likes