Security comparison - GNOME and KDE Plasma

Questions
21
1 Like
22

XFCE and LXQt also secure privileged Wayland protocols.

2 Likes
23

GMOME is the only recommended DE used in Secureblue, as itā€™s the only Wayland DE that has locked down specific application sharing of things like the clipboard and screenshots I believe.

EDIT: seems like KDE Plasma version 6.5. is secure now, and that Sway is making strides too.

24
1 Like
25

GNOME and KDE are otherwise the only options. KDE is completely and forever memory unsafe (asked the Devs, never leaving Qt or even allowing Slint into core KDE apps), and GNOME is simply far behind.

@anonymous261, what are they referring to? The fact that they use C++?

26

I think they are referring to that, although currently, both GNOME and KDE are not mostly written in the safest languages. Additionally, by the time GNOME could make progress on that front, COSMIC may already be out.

27

A user of F42 Workstation hereā€¦

@SkewedZeppelin While Brace is not something I would use personally, I did learn of some noteworthy settings from the repo. I also ended up uninstalling sushi and yelp after reading this topic, so thanks for all the info.

Some things Iā€™d like to add:

  • Apparently, disable-microphone does nothing right now. Likely wouldnā€™t hurt to keep it disabled, though.

  • Consider adding org.gnome.calculator refresh-interval 0 to prevent GNOME Calculator from periodically fetching exchange rates, which it does by default. (Anyone remember Subgraph OS?)

  • The org.gnome.desktop.lockdown section also may be of interest.

2 Likes
28

I want to like KeePassXC, but itā€™s stuck with Qt5 for the foreseeable future, and has yet to transition to Wayland properly.

For what itā€™s worth, KeePassXC is officially available on Flathub. But at least on GNOME, thereā€™s this:

1 Like
29

For those who have installed Gnome Calculator as a Flatpak, the command is slightly different:

flatpak run --command=gsettings org.gnome.Calculator set org.gnome.calculator refresh-interval 0

1 Like
30

Alternatively, one could disable network access for Flatpak apps globally with flatpak override --unshare=network, and then grant this permission to apps on a case-by-case basis (e.g., flatpak override -u --share=network org.mozilla.firefox).

See also:

3 Likes
31

@anonymous261, as in, memory-safe? If so, at least thereā€™s a very informal roadmap to improve this on KDEā€™s side:

Thereā€™s also a very significant debate about it over at their Discourse instance:

1 Like
32

I guess this is not the case any more with KDE Plasma version 6.5.

3 Likes