Which OS for private secure internet browsing PC?

[sha123]

@username0990

As far as I can see in the Linux world, there is not a consensus on how browsers should be installed on a system

Native packages and Snaps are fine. Flatpaks not. Flatpaks block the namespace+chroot/pivot_root sandbox layer.

@username0990

Firefox and Brave browsers have official flatpak packages.

Brave recommends against using their own Flatpak version:

We currently recommend that users who are able to use our official package repositories do so instead of using the Flatpak.

@username0990

SELinux does not contain policies restricting user applications. Tor and Mullvad browsers are also recommended to be installed directly from the source archive, so they will also have unrestricted access to sensitive files etc. on the system.

Modern browsers have a multi-process architecture, with sandboxing around the important processes, for example renderer sandboxes, gpu sandbox, extension sandbox and so on. This way you can make these sandboxes much more tailored and thus stricter than you would be able to do around the browser as whole.

@username0990

So how can immutable -and traditional- distributions be secure to use browsers?

Install them not as a flatpak. That’s independent of distros and doable on immutable ones, too.