Secureblue - Atomic Fedora Hardening

Is there a tool for virtualization within secureblue that you’d recommend (such as virt-manager)?

The gnome boxes flatpak is fine for simple cases. Anything more complex and virt-manager becomes necessary.

1 Like

Please do not come here to stir up conflict. I cannot say I have ever witnessed anything but a positive and constructive attitude from @RoyalOughtness, at least on this forum.

2 Likes

Thank you. That post made me sad :confused:

I spend a ton of time providing gratis support because I like helping people. I have a full time job though so naturally I don’t get to all of the questions. And yes, our documentation could use plenty of improvement, and I occasionally have to give stern warnings to users who break the rules (like spreading FUD disguised as a question).

9 Likes

I’m having a problem with all the os flashing tools. I tried Fedora media writer, Pi setup, and other tools to flash an os on Microsd for pinhole, but every app errors out with “Remote host disconnected” or something like that. I can’t find a setting in Flatseal that helps with that :frowning:

Any way to fix it on SecureBlue?

Having a recent look at the secure blue website it seems some things have made good progress. the FAQ is really good, and it looks like a credible project.

I’ve been having a bit of a look at this on my laptop and so far like what I see.

7 Likes

4 posts were split to a new topic: Should I enable Xwayland in Secureblue?

Off Topic

Can one use Kicksecure in Distrobox for example?

@RoyalOughtness thank you for the hard work that you put in this project and for keeping this community updated.

Apologizes if you already addressed this in the messages here or in the documentation but can one entirely remove Chromium from the image and replace with another chromium based browser as the secure browser option? I’m not talking of getting Tor or Firefox, because I read the hardened-malloc limitations in the thread. I’m looking if everything that was done to promote Chromium could be entire lift by the user to another Chromium based browser.

From a privacy point it may have some benefits to adopt Brave over Chromium.

Question to the community:

For those using Secureblue for more than 3 months how is it going?

one entirely remove Chromium from the image

To be clear, we don’t use Fedora’s chromium anymore, and haven’t for some time. We ship our own browser, Trivalent:

I’m looking if everything that was done to promote Chromium could be entire lift by the user to another Chromium based browser.

No, our hardening goes well beyond what you can do with config and policies. Not to mention the built-in adblocking using the same mechanism Vanadium does. Using a different chromium-based browser would likely be a security downgrade.

replace with another chromium based browser

It’s not possible to do so with local overrides, due to an upstream issue (related but not identical issue here)

Your options would be to either just install your browser of preference alongside Trivalent, or build your own custom image with bluebuild. That said, it would be rather strange to implement a security downgrade on what is arguably the widest source of attack surface for average desktop use case: the browser.

From a privacy point it may have some benefits to adopt Brave over Chromium.

Again, we’re not shipping chromium :slightly_smiling_face:

3 Likes

Thank you, I missed completely the migration to the newly created Trivalent.

It doesn’t seem that we are having a lot of coverage on the mainstream social media such as Youtube or even Reddit.

I know that those things are difficult to guess but do you feel that you will keep this project alive for a couple of years?

I recognize your relentless determination, I just checked that you are even adventuring on trying to get KDE fixed to include it in the list of recommended images.

17 posts were split to a new topic: Brave vs Trivalent Security

project

Have a look at the second half of this post

2 Likes

Goodness, this thread was filled with random support requests. Most of these have now been moved to their own topics. A reminder that these threads are for sharing questions and concerns about listing new tools on privacyguides.org, not for getting support from developers. Random/off-topic chatter makes evaluating tools very difficult.

You are all welcome to ask questions about anything privacy-related in Privacy > Questions for general community support (see: how to create a linked topic), but official support channels for tools is usually preferable.

@RoyalOughtness I think this proves you need your own community support forum :stuck_out_tongue:

2 Likes

Thanks for rearranging things. We have a dedicated community support forum on our Discord.

I will decline support related inquiries on PG to prevent further clutter. My apologies for doing so previously, I didn’t realize it was out of scope for these forums.

2 Likes

Thanks. You’re certainly welcome to answer questions in other topics if you’d like (obviously general support from developers is not an expectation for this forum), I just need to keep the Site Development category specifically clean.

3 Likes

So, what exactly blocks this from getting added in the end? The above thread seems to have no conclusions

It appears to have been approved.

1 Like

It has been approved and the conclusion is that it is the most secure you’ll ever get in a Linux Distributions (and only on the linux side of things) therefore making it a worthy recommendation for PG.
we just need a PR and stuff adding it so.

13 Likes