• 0 Posts
  • 26 Comments
Joined 9 days ago
cake
Cake day: February 28th, 2026

help-circle
  • Aight. I’ll give you some more then 😜:

    • Don’t expect real-time protection (à la Windows Defender) on Linux. While decent options do exist[1], the better ones come at a premium.
    • Though, related to the previous point, that’s not necessarily a bad thing. The epitome of secure OSes, GrapheneOS (for mobile) and Qubes OS (for desktop), don’t come pre-installed with one either. And I wouldn’t be surprised if their respective maintainers would justify it by stating that proactive security is simply better than reactive security.
    • FWIW, Lynis is a battle-tested security tool used to audit the system. It doesn’t work on Windows, but does on macOS, Linux and some other systems. It even goes as far as granting a numerical rating that represents how well the system performs on security and notes (point-by-point) what could be improved (and sometimes even how). While I would definitely not argue that it’s the be-all and end-all, the numeral rating definitely makes it easy to compare distros at a glance.

    There’s perhaps more to go through, but I believe we should address the elephant in the room:

    How much hardening did you even apply on your current/previous OS?

    Like, if you’ve built a literal fortress, chances are that you’ll have a hard time finding a suitable distro that provides similar protection OOTB. But, if you’re just your average Joe and you just ran with how it came OOTB and at least didn’t try to actively sabotage/compromise their system, then… chances are that a decent amount of mainstream distros will suit you fine. I kinda hinted at it in my previous comment, but a mainstream distro could be fine if you uphold best practices. So, in that scenario, the query shifts to:

    Are you willing to adopt best practices?

    If you’re unsure whether you’ll manage given your wants/needs out of the system, then that would (again) shift the question. This time we’d have to discuss the activities you engage in and ‘decide’ whether there are any distros out there that can handle those gracefully and responsibly.

    Etc. Etc.


    Warning: as you should be aware by now, and if you haven’t yet, see the security entry on the (excellent) ArchWiki and the (infamous[2]) Linux entry on Madaidan’s Insecurities, this can be a pretty ugly rabbit hole. I hope this doesn’t discourage you, though.

    Finally, consider giving answers to the bold and cursive questions 😉.


    1. Ironically, Microsoft Defender for Endpoint on Linux is one of the best out there. ↩︎

    2. Madaidan used to be a security researcher on Whonix. Whonix is one of Linux’ finest when it comes to privacy and security. Heck, it’s involved in the preferred way to engage on the Tor network. It’s even endorsed by Edward Snowden. So, by their efforts/contributions, Madaidan should have rightfully earned the required credentials and be regarded as somewhat of an authority on the subject matter. However, this article wasn’t well-received. From what I saw, the community was mostly dismissive. Disappointingly so. Which…, unfortunately shows that there’s a lot more circle jerking than what we’d all admit to. Anyhow…, FWIW, there was actually a slice of the community that did take it seriously. I’d characterize them as the security-conscious. Furthermore, note that Madaidan hasn’t updated it for a couple of years now. So some of the writings have clearly become outdated. So, to be clear, the situation isn’t as bleak as they described in their article. ↩︎



  • I’m obviously not an expert. But, from what I can tell, the scene seems quite healthy. And I don’t see a reason why it wouldn’t thrive further. Especially as the Linux market share is in the lift. Anti-cheat shenanigans are a lot more concerning. Though, I’m optimistic that Valve is actively making progress on that front.

    Btw, just as an FYI: I know people that were more interested in software piracy. But I digress…




  • The way you present “immutable distros” make them look like state-of-the-art stateless systems (a la NixOS with the impermanence module).

    As much as I’d wish (so-called) immutable distros were like that, almost none of them actually are[1].

    Fedora Atomic, which may or may not have surpassed NixOS in popularity by now, practically just locks down /usr. That’s cute, but it means that the immutability doesn’t prevent persistence of hardware in most of the filesystem.

    Similarly, I could go over the other popular immutables to point out how their immutability doesn’t do much to combat persistence. But I digress…


    1. It’s basically the aforementioned NixOS. And, even then, only if you’ve set it up like that. Guix System might offer it as well, but I couldn’t verify it the last time I looked into it. ↩︎








  • My priorities:

    • Secure. Unlike popular belief, the fact that the worlds infrastructure basically runs on Linux does not imply that your average Desktop Linux distro enjoys the same level of scrutiny when it comes to its security. Hence, the security-conscious should carefully pick a distro that can handle their threat model. Or, at least harden it to their liking.
    • Stateless. Conventionally, you will be met with a (relatively) minimal system after installation. After which you’re expected to configure it to your liking and go smooth sailing afterwards. Occasionally, you might (un)install stuff and/or modify settings; but nothing out of the ordinary, really. While applying some of these changes might seem trivial, they (kinda) lead your system to accumulate cruft. This cruft might seem innocuous, but it’s exactly why your system seems so fresh after a reinstall. Foregoing this altogether is referred to as going stateless. This is done by declaring a desired state and ‘flushing’ all changes that have not been declared. Many other benefits are associated with this, but I digress…

    The above[1] already dictates the use of NixOS with the impermanence and nix-mineral modules.


    1. So, without even going into release cadence etc. ↩︎