During my studies in cyber security I have found 2 very different approaches to security within Desktop Operating Systems, and recently I have become torn between the 2 approaches.
The first approach is Security through Hardening. From what I have seen, this is when people build on software with tweaks, configurations, additions and such that may increase the security of the Operating System. Examples may be SELinux, Linux-Hardened, Sandboxing, etc. Operating Systems that follow this Philosophy would be: Kicksecure, SecureBlue, Fedora, OpenSUSE, HardenedBSD, etc.
The Second Approach is Security through Minimalism. From what I have seen, this is when people take software and remove unnecessary parts of it, or replace it with more lightweight software in order to reduce attack surface for the purpose of exploit mitigation. Examples may be BusyBox, Microkernels, Doas, OpenRC, etc. Operating Systems that follow this Philosophy would be: Gentoo, Void, Alpine, Chimera, OpenBSD, etc.
This is just a very quick, rushed, short summary of what I am trying to portray and I could talk about this for ages in reality. But as I am looking to end a long period of fun, distro hopping, enjoyment and hobbyism to become more productive, I want to know what the best approach is WITH EXPLANATION AND REASONING to narrow down my options by a wide margin.
Sorry, I didn’t notice u were asking about a distro to choose.
I have experience with secureblue. It has great security and minimalist feel but some limitations due to its immutable design like emulators of android studio but great in any other task I used it for including other stacks of development.
The most secure desktop operating systems I can think of are macOS and Qubes.
In terms of FOSS it would surely be Qubes > Secureblue > Fedora.
Kicksecure has been criticised by the GrapheneOS team. Interestingly they like Whonix though, which is based on Kicksecure. The technical explanations go over my head, but in general I trust their opinion when it comes to security.
Realistically though with good practice, you don’t see too many people in the wild getting malware on a Linux desktop.
Minimalism is probably not the more effective approach vs hardening in the realm of desktop security, as the OS is fundamentally not built from the ground up with security in mind, unlike mobile OS’s.
So I would say hardening is the better approach given that.
The important part is threat modelling and attack surface. Hardening and Minimalism are just approaches to use and balance to minimize attack surface to whatever threat model you use. More layers is generally more code, which is generally more attack surface. So be very intentional with the layers and hardening you add.
Unless you need 3d acceleration or nested virtualization, Qubes-OS is usable. I’ve been using it as my daily driver for years. I have an old machine running linux with libvirt for virtualization and containers. You can run containers in qubes, but its easier offloading that.
Probably some combination of both. A hardened, minimal system that, for instance, does not have unneeded features enabled in the kernel, but makes use of extra features like sandboxing to provide additional protection.
Third factor is usability. For instance, I dislike flatpack because I find it too difficult to configure each application correctly, even with flatseal, and defaults are permissive to ensure they work on a variety of systems. Therefore I will never get the full hypothetical benefit flatpack, while I will still get all the drawbacks.
In general, if one isn’t sure what to do and has decided on Linux, they want Ubuntu or Fedora for their good usability and defaults. Of course individual situations may lead people to have different needs. Secureblue is noteworthy for taking the more locked down approach where you start more minimally (but still with sandboxing etc) and enable what you need. This will give better security for those who find Secureblue to have acceptable usability.
I don’t like Secureblue very much for a desktop, though it can be nice for a server. Some others like using it more than me.
The two approaches you mention are not separate. Secureblue for example “adds” hardening through a new web browser and SELinux policies, and “removes” attack surface (minimalism) like kernel modules and SUID binaries. It’s a false dichotomy and your listed distros don’t fit in either lane cleanly.
Studying cybersecurity you should have been taught the CIA triad for confidentiality, integrity, and availability of data. You should evaluate tools based on how they enforce each against various threats (read: threat modeling). Verified boot for example protects the integrity of the base OS from rootkits etc, but not the confidentiality, because the base OS is not secret. Disk encryption protects the confidentiality of your data from real-world attackers when at rest, but not after unlock when the data is accessible anyway.
Evaluating these things it will become clear that Linux is generally very lacking in security compared to the alternative options. Secureblue is the least bad option by far, especially the upcoming “sealed” variety. I’ve managed to daily drive it for over a year and would recommend it to intermediate/advanced Linux users. Being off the beaten path, it will require some maintenance, but you can absolutely be productive with it.
That said plenty of people use mainstream distros and are fine. I use Ubuntu for work because that’s all IT allows. It really comes down to your needs.
Yes, MacOS and Qubes would have better security than Linux as a whole.
Your use of the GrapheneOS team (Daniel Micay mainly) as a way to find the most secure Desktop OSes isn’t always a good idea because from what I have seen he hasn’t got a good idea about security in the Linux world. For that matter, he believes Windows is more secure than Linux. This is completely wrong, and even if it was right, the mandatory invasive telemetry automatically destroys that security. Police caught criminals using Vulnerabilities in Windows as well as requesting data from Windows.
The real reason Kicksecure is failing is because recently they have struggled to maintain things and have started deprecating a lot of software in favour of software they don’t need to work on as much.
it also should be noted that they criticised Kicksecure for things that Secureblue also has. Mainly being the GNU Ecosystem, specifically pointing out Glibc, GPG and GCC.
No disrespect to the GrapheneOS team, I just believe that maybe an expert in Linux Security should be sought to instead.
Just wanna say the GrapheneOS team is a credible source regarding Linux security. They’ve upstreamed improvements to the Linux kernel and Daniel Micay specifically was previously an influential Arch Linux maintainer / security researcher.
There really are a lot of ways that Windows is more secure than traditional Linux. Virtualization-based sandboxing, memory integrity, secure boot, even the kernel. The invasive data collection can be a dealbreaker (it is for me) but it comes down to your threat model.
If you have a source for them criticizing Kicksecure specifically for using Glibc, GPG, and GCC, I would like to see that. I know they’ve criticized those things in isolation but Kicksecure has bigger issues than those.
Daniel Micay responded and gave some great suggestions.
A summary of what he said:
Musl should be used as the libc instead of glibc. Glibc is buggy and overly complex. Musl is missing some very minor security features present in glibc (the glibc implementations aren’t good anyway) so we should add the missing security features to musl.
Clang/LLVM should be used as the toolchain so we can enable modern mitigations like CFI.
Systemd is a big problem. They’re hostile towards modern security approaches, adds a huge amount of attack surface / complexity and is developed by incompetent people. PID1 can be tiny and the minimal requirements are like 500 lines of code.
There shouldn’t be anything like apt. It doesn’t fit into a secure OS design. GPG is insecure and shouldn’t be involved in verification.
I mean these are the same thing. Disabling unnecessary components and services is OS hardening 101. Hardening just means improving security, really.
This is not necessarily reducing attack surface unless by lightweight you mean it lacks functionality alternatives provide, but even then you can have a less functional and less secure software than alternatives. hardened_malloc is a more secure memory allocator than alternatives but I would hardly call it lightweight as using it does increase memory overhead, for example. Likewise, Chrome has more features than e.g. Ladybird at the moment but I trust Chrome security over Ladybird’s for now at least because of the now decades of refinement and attention it has gotten compared to something newer.
There is zero conflict between introducing security boundaries and features into software and stripping out unneeded functionality to reduce attack surface so I’m lost as to why you’re “torn”. Make no mistake, both are critical hardening measures anyone seeking to improve the security of a system should implement when practical.
What makes you think that? By all accounts they still use Arch Linux for development even today and it’s unlikely they never contribute to Arch.
Micay also never stopped working on Linux (AOSP is a Linux-based operating system) and has been recognised for contributions to Linux kernel and kernel security by Google and others on numerous occasions.
You’re also going to cause yourself confusion by picking out specific technical examples that he has mentioned for desktop Linux security instead of noting the overall point.