The pursuit of Freedom led me to Linux.
Are you referring to Qubes OS? If so, what do you mean exactly with hardware support?
IIRC, it stops working whenever you disable JavaScript.
I think we’ve probably already spoken on the matter.
That's definitely possible. Unfortunately, I don't recall it 😅.
Indeed, Lemmy has a serious dearth of users interested and using secure distros over the averages.
It's definitely better at this than the platform that starts with an "R" and rhymes with "shit".
Thanks for your efforts; I do not know how to follow users on Lemmy but if I did I’d follow you. Do you have a blog/any other forum you’re more active on?
That's such a compliment. This is definitely one of the nicest things I've read on Lemmy. I really appreciate it.
Unfortunately, I'm only somewhat active on Lemmy. FWIW, consider checking out the following places if you haven't yet:
- dataswamp.org/~solene
- privsec.dev
- tech.michaelaltfield.net/
And, of course, Qubes OS' forums.
Personally, I find it difficult to justify the time to learn Secureblue (especially the immutable part) or NixOS on Qubes because custom DispVMs with curated salt states work so well already. I’m interested in use-cases that will improve my security but I haven’t found any dialogue on this yet. If you do have opinions on this and know where I can look, I would greatly appreciate it!
As I've previously alluded to, I don't have any hands-on experience with Qubes OS yet. So, I don't think I can contribute meaningfully in this discussion. However, IIRC, there are some discussions found on the forums/discussions page for Qubes OS.
Aight. I'm glad to hear that that has been resolved. I'd love to hear about your experiences on secureblue, so consider to report back. Finally, note that as a hardened distro, some things might work differently from what you'd expect. So be prepared to relearn a thing or two 😉.
Currently I got no time to go over this in more length. So apologies*. However, I still want to offer/provide a brief and concise answer. I will (hopefully tomorrow) return at this in more length.
Now i already setup my container & install some packages in it but the shortcut is missing from application launcher (a.k.a start menu), how i can link the shortcut from package inside toolbox to host application launcher ?
Short answer is that Toolbx for a long time (and perhaps still) didn't really support this feature. Sure, you could make it work, but it was a bit hacky. If this is a concern of yours, consider switching over to Distrobox. With distrobox, it's as easy as (while inside the container) distrobox-export --app <name app>
. I will return at this tomorrow with the Toolbx way to do the same. I will also explore how Distrobox fares compared to Toolbx etc.
If i made a file (ex text file) from inside container will it show in Home directory ?
Yes if you've saved it in the Home directory to begin with.
If something crashed inside container will it also crashed my host system ?
Nope.
Why some packages doesn’t work inside container like Wine, Lutris, or Bottles ?
Interesting. I don't recall ever experiencing problems with either Wine or Lutris inside a Toolbx/Distrobox container. I'm also confident that Bottles should work.
Does it’s need special dependencies to make it work ?
This is definitely something that might be at play. Consider reporting the terminal output whenever you try to work with Wine, Lutris and Bottles.
Furthermore, expect some containerized solutions tomorrow for these 😉.
Can packages that modifying system (ex green tunnel, vmware, or QEMU, & hblock ) work fine ?
I'm not familiar with all of them. Though, you may expect troubles. I do recall I had to resort to rpm-ostree
in order to make QEMU work. However, it's a fast moving space, so I wouldn't be surprised if Toolbx/Distrobox-based solutions exist for this. For example, since relatively recently, it has been possible to have a functioning Waydroid within Distrobox. I will also more exhaustively go over this matter tomorrow.
Whonix is an OS exclusively meant to be used within a VM; at least, until Whonix-Host is released. Therefore, I didn't include it as it's not actually competing within the same space; as it can be run on any of the aforementioned systems within a VM. Finally, it's worth noting that by its own documentation, it's desirable to do so with Qubes OS.
Please allow me to link to an earlier comment of mine that goes over this in more length. You may also find it copied-and-pasted down below:
First of all, apologies for delaying this answer.
Disclaimer:
- I'm not an expert. While I try to verify information and only accept it accordingly, I'm still human. Thus, some falsehoods may have slipped through, my memory may have failed me, and/or what's found below could be based on outdated data.
- Additionally, I should note that I'm a huge nerd when it comes to 'immutable' distros. As a result, I'm very much biased towards secureblue, even if Kicksecure were to address all of their 'issues'.
- Furthermore, for the sake of brevity, I've chosen to stick closely to the OOTB experience. At times, I may have diverged with Qubes OS, but Qubes OS is so far ahead of the others that it's in a league of its own.
- Finally, it's important to mention that -ultimately- these three systems are Linux' finest when it comes to security. In a sense, they're all winners, each with its use cases based on hardware specifications, threat models, and priorities. However, if forced to rank them, I would order them as:
Qubes OS >> secureblue >~ Kicksecure
Context: Answering this question puts me in a genuinely conflicted position 😅. I have immense respect for the Kicksecure project, its maintainers and/or developers. Their contributions have been invaluable, inspiring many others to pursue similar goals. Unsurprisingly, some of their work is also found in secureblue. So, to me, it feels unappreciative and/or ungrateful to criticize them beyond what I've already done. However, I will honor your request for the sake of providing a comprehensive and balanced perspective on the project's current state and potential areas for improvement.
Considerations: It's important to approach this critique with nuance. Kicksecure has been around for over a decade, and their initial decisions likely made the most sense when they started. However, the Linux ecosystem has changed dramatically over the last few years, causing some of their choices to age less gracefully. Unfortunately, like most similar projects, there's insufficient manpower to retroactively redo some of their earlier work. Consequently, many current decisions might be made for pragmatic rather than idealistic reasons. Note that the criticisms raised below lean more towards the idealistic side. If resources allowed, I wouldn't be surprised if the team would love to address these issues. Finally, it's worth noting that the project has sound justifications for their decisions. It's simply not all black and white.
With that out of the way, here's my additional criticism along with comparisons to Qubes OS and secureblue:
- Late adoption of beneficial security technologies:
Being tied to Debian, while sensible in 2012, now presents a major handicap. Kicksecure is often late to adopt new technologies beneficial for security, such as PipeWire and Wayland. While well-tested products are preferred for security-sensitive systems, PulseAudio and X11 have significant exploits that are absent from PipeWire and Wayland by design. In this case, preferring the known threat over the unproven one is questionable.
- Qubes OS: Its superior security model makes direct comparisons difficult. However, FWIW, Qubes OS defaults for its VMs to Debian and Fedora. The latter of which is known to push new technologies and adopt them first.
- secureblue: Based on Fedora Atomic, therefore it also receives these new technologies first.
- Lack of progress towards a stateless[1] system:
Stateless systems improve security by reducing the attack surface and making the system more predictable and easier to verify. They minimize persistent changes, impeding malware's ability to maintain a foothold and simplifying system recovery after potential compromises. While this is still relatively unexplored territory, NixOS's impermanence module is a prominent example.
- Qubes OS: There's a community-driven step-by-step guide for achieving this.
- secureblue: Based on Fedora Atomic, which has prioritized combating state since its inception[2]. Its immutable design inherently constrains state compared to traditional distros, with ongoing development promising further improvements.
- Deprecation of hardened_malloc:
This security feature, found in GrapheneOS, was long championed by Kicksecure for Linux on desktop. However, they've recently chosen to deprecate it.
- Qubes OS: Supports VMs with hardened_malloc enabled OOTB, for which Kicksecure used to be a great candidate.
- secureblue: Continues to support hardened_malloc and has innovatively extended its use to flatpaks.
- This paper provides a comprehensive (albeit slightly outdated) exposition on the matter. Note that it covers more than just this topic, so focus on the relevant parts.
- Colin Walters, a key figure behind Fedora CoreOS and Fedora Atomic, has written an excellent blog post discussing 'state'.
What are the main advantages of using this, that make it more secure?
More secure compared to your average distro? Or more secure compared to a specific set of distros? Unless, this is properly specified, this comment could become very unwieldy 😅.
Thanks in advance for specifying!
I daily drive secureblue; or, to be more precise, its bluefin-main-userns-hardened
image.
"Why?", you ask. Because security is my number one priority.
I dismiss other often mentioned hardened systems for the following reasons:
- Qubes OS; my laptop doesn't satisfy its hardware requirements. Otherwise, this would have been my daily driver.
- Kicksecure; primary reason would be how it's dependent on backports for security updates.
- Tails; while excellent for protection against forensics, its security model is far from impressive otherwise. It's not really meant as a daily driver for general use anyways.
- Spectrum OS; heavily inspired by Qubes OS and NixOS, which is a big W. Unfortunately, it's not ready yet.
Nix, the package manager, is distro-agnostic. Add Home Manager on top of it and you're good to go; both packages and dotfiles are dealt with.
If security is a serious concern of yours, perhaps consider NovaCustom's offerings instead. Intel BootGuard is coming to their new models (i.e. the 14 inch V54 the 16 inch V56). Add Dasharo's coreboot, the possibility to disable Intel Management Engine, (soon hardware-based) kill switches, open source EC, ongoing work to get it Qubes OS certified (like how they managed on their NV41) and perhaps even Heads (also like how they did on NV41). We haven't even talked about how they'll soon achieve HSI-3 and their plans to tackle Trenchboot next year.
It's a lot of good stuff. And simply unheard of for vendors that are Linux-first. Heck, if their ongoing work on lvfs
delivers and they manage to put out updates like industry leader (at least in this regard) Dell does[1], they might even be a contender for most secure laptop for general use.
While it may seem as if I've been gushing a lot already, I have not even mentioned how they fare in other important aspects:
- Communication and support is excellent and a lot better than any other Linux-first vendor; including both Star Labs and TUXEDO.
- They're committed to repairability and sustainability. While they definitely can't compete with Framework in this regard, they do offer spare parts (including motherboard, CPU, fans, cmos battery and a lot more) for up to 7 years.
It's a pity that they're underappreciated and underrated for not putting as much money into advertising as they do on delivering an excellent product.
- Dell is very competent in this regard. So, I honestly don't expect NovaCustom to seriously compete with them. However, I'm already content if they can compete with Lenovo at this.
but photoshop/Adobe Creative suite is a must have… how is that on Linux these days?
I could probably summarize your experience as "skill issue".
I don’t understand the hype of immutables, or usability even.
I suppose this article/blogpost by Lennart Poettering should suffice. Though, this article/blogpost by Colin Walters is also cool.
I tried Bazzite today after Nobara nuked itself, and I couldn’t even paste my old Firefox profile since the actual folder apparently sits within the immutable folder structure.
This is simply false as pointed out by others already.
I didn’t even have time to reach the software limitations with how fast I tried the next distro.
You will have a very hard time on Linux with that mindset. And, to be honest, literally any OS you aren't already familiar with.
Still hopping though, because apparently Fedora just nukes itself when you try to install codecs
I wouldn't be surprised if you just searched this through your favorite search engine and settled with whatever random solution you came across instead of relying upon RPM Fusion's documentation on the matter.
and I think I have about every major distro tested by now.
While this could be true, I wonder what prevented you from sticking with any one of them.
Linux is cursed.
It's definitely a lot harder if you've got major skill issues.
Thanks for clarifying!
IMO immutable distros aren’t a best fit for a desktop computer. It can do so much more than gaming and turning it into a dedicated console is a step back if a normal linux distro can do just as well.
I would personally nuance this to: "Current iterations of 'immutable distros' that have evolved from traditional distros haven't matured sufficiently yet to tackle 99.99% of the use cases 'easily'." The exact number on the percentage I don't know. I believe most people that use their PCs as a glorified app launcher should be more than fine. But we start experiencing major difficulties the very moment that (a)kmods are involved; some of which are 'supported'~ish, while others certainly aren't.
But, I simply fail to see why a future iteration would not be able to solve related issues.
Those definitely amount to a major difference. Thanks for clarifying!
Thank you. This does give an idea.
It has been my pleasure.
Follow up question : Is Arch really that good?
Depends entirely on your needs. There is a use case for Arch. However, if you're completely new to Linux, then it's very likely that a 'slower'-moving distro (like (anything based on) Debian (or Ubuntu)) might better suit you.
Wait for Ubuntu Core Desktop to come out.
It’s a steering wheel driver.
Could you perhaps be more precise? Is it a specific one? Or are there a multitude of steering wheel drivers that satisfy your needs?
And virtualbox.
Do you specifically need VirtualBox? Or would Qemu/KVM satisfy your needs?
IIRC VirtualBox requires kernel mods. Therefore, you would have to create your own images 😅 in which said kernel mod is included. FWIW, both uBlue's templates and BlueBuild do a wonderful job at streamlining this process.
Or..., as alluded before, you don't necessarily need VirtualBox. But, instead, Qemu/KVM perfectly satisfy your needs. Then, you can just run ujust setup-virtualization
. After which you reboot, and you would be good to go.
Linux Distros Evolution over time - July 2024 Snapshot
Linux Distros Evolution over time - July 2024 Snapshot
Linux Distros Evolution over time - July 2024 Snapshot
Sell us on your favorite exotic/niche distro
The Linux ecosystem is vast and diverse, offering a multitude of distributions to suit every need and preference. With hundreds of distros to choose from, it’s a pity that most are rarely mentioned while the popular ones are constantly being regurgitated.
This thread aims to celebrate this diversity and shine a light on smaller projects with passionate developers. I invite you to pitch your favorite underappreciated distro and share your experiences with those lesser-known Linux distributions that deserve more attention.
While there are no strict rules or banlists, I encourage you to focus on truly niche or exotic distributions rather than the more commonly discussed ones. Consider touching upon what makes your chosen distro unique:
- What features or philosophies set it apart?
- Why do you favor it over other distros, including the popular ones? (Beyond “It just works.”)
- In what situations would you recommend it to others?
Whether it’s a specialized distro for a particular use case or a general-purpose OS with a unique twist, let’s explore the road less traveled in the Linux landscape. Your insights could introduce fellow enthusiasts to their next favorite distribution!
Sell us on your favorite exotic/niche distro
The Linux ecosystem is vast and diverse, offering a multitude of distributions to suit every need and preference. With hundreds of distros to choose from, it’s a pity that most are rarely mentioned while the popular ones are constantly being regurgitated.
This thread aims to celebrate this diversity and shine a light on smaller projects with passionate developers. I invite you to pitch your favorite underappreciated distro and share your experiences with those lesser-known Linux distributions that deserve more attention.
While there are no strict rules or banlists, I encourage you to focus on truly niche or exotic distributions rather than the more commonly discussed ones. Consider touching upon what makes your chosen distro unique:
- What features or philosophies set it apart?
- Why do you favor it over other distros, including the popular ones? (Beyond “It just works.”)
- In what situations would you recommend it to others?
Whether it’s a specialized distro for a particular use case or a general-purpose OS with a unique twist, let’s explore the road less traveled in the Linux landscape. Your insights could introduce fellow enthusiasts to their next favorite distribution!
Sell us on your favorite exotic/niche distro
The Linux ecosystem is vast and diverse, offering a multitude of distributions to suit every need and preference. With hundreds of distros to choose from, it's a pity that most are rarely mentioned while the popular ones are constantly being regurgitated.
This thread aims to celebrate this diversity and shine a light on smaller projects with passionate developers. I invite you to pitch your favorite underappreciated distro and share your experiences with those lesser-known Linux distributions that deserve more attention.
While there are no strict rules or banlists, I encourage you to focus on truly niche or exotic distributions rather than the more commonly discussed ones. Consider touching upon what makes your chosen distro unique:
- What features or philosophies set it apart?
- Why do you favor it over other distros, including the popular ones? (Beyond "It just works.")
- In what situations would you recommend it to others?
Whether it's a specialized distro for a particular use case or a general-purpose OS with a unique twist, let's explore the road less traveled in the Linux landscape. Your insights could introduce fellow enthusiasts to their next favorite distribution!
The leaked April 2024 documents, obtained and verified by 404 Media, show Cellebrite could not unlock a large chunk of modern iPhones.
![Leaked Docs Show What Phones Cellebrite Can (and Can’t) Unlock](https://lemmy.ml/pictrs/image/20598e85-a68a-4af3-90c0-71946a85a819.jpeg?format=webp&thumbnail=256)
> ##### Leaked Docs Show What Phones Cellebrite Can (and Can’t) Unlock > > The leaked April 2024 documents, obtained and verified by 404 Media, show Cellebrite could not unlock a large chunk of modern iPhones. > > Cellebrite, the well-known mobile forensics company, was unable to unlock a sizable chunk of modern iPhones available on the market as of April 2024, according to leaked documents verified by 404 Media. > > The documents, which also show what various Android handsets and operating system versions Cellebrite can access, provide granular insight into the very recent state of mobile forensic technology. Mobile forensics companies typically do not release details on what specific models their tools can or cannot penetrate, instead using vague terms in marketing materials. The documents obtained by 404 Media, which are given to customers but not published publicly, show how fluid and fast moving the success, or failure, of mobile forensic tools can be, and highlights the constant cat and mouse game between hardware and operating manufacturers like Apple and Google, and the hacking companies looking for vulnerabilities to exploit. > > Analysis of the documents also comes after the FBI announced it had successfully gained access to the mobile phone used by Thomas Matthew Crooks, the suspected shooter in the attempted assassination of former President Donald Trump. The FBI has not released details on what brand of phone Crooks used, and it has not said how it was able to unlock his phone. > > The documents are titled “Cellebrite iOS Support Matrix” and “Cellebrite Android Support Matrix” respectively. An anonymous source recently sent the full PDFs to 404 Media, who said they obtained them from a Cellebrite customer. GrapheneOS, a privacy and security focused Android-based operating system, previously published screenshots of the same documents online in May, but the material did not receive wider attention beyond the mobile forensics community. > > For all locked iPhones able to run 17.4 or newer, the Cellebrite document says “In Research,” meaning they cannot necessarily be unlocked with Cellebrite’s tools. For previous iterations of iOS 17, stretching from 17.1 to 17.3.1, Cellebrite says it does support the iPhone XR and iPhone 11 series. Specifically, the document says Cellebrite recently added support to those models for its Supersonic BF [brute force] capability, which claims to gain access to phones quickly. But for the iPhone 12 and up running those operating systems, Cellebrite says support is “Coming soon.” > > > A SECTION OF THE IOS DOCUMENT. IMAGE: 404 MEDIA. > > The iPhone 11 was released in 2019. The iPhone 12 was launched the following year. In other words, Cellebrite was only able to unlock iPhones running the penultimate version of iOS that were released nearly five years ago. > > The most recent version of iOS in April 2024 was 17.4.1, which was released in March 2024. Apple then released 17.5.1 in May. According to Apple’s own publicly released data from June, the vast majority of iPhone users have upgraded to iOS 17, with the operating system being installed on 77 percent of all iPhones, and 87 percent of iPhones introduced in the last four years. The data does not break what percentage of those users are on each iteration of iOS 17, though. > > Cellebrite offers a variety of mobile forensics tools. That includes the UFED, a hardware device that can extract data from a physically connected mobile phone. The UFED is a common sight in police departments across the country and world, and is sometimes used outside of law enforcement too. Cellebrite also sells Cellebrite Premium, a service that either gives the client’s UFED more capabilities, is handled in Cellebrite’s own cloud, or comes as an “offline turnkey solution,” according to a video on Cellebrite’s website. > > That video says that Cellebrite Premium is capable of obtaining the passcode for “nearly all of today’s mobile devices, including the latest iOS and Android versions.” > > That claim does not appear to be reflected in the leaked documents, which show that, as of April, Cellebrite could not access from locked iOS phones running 17.4. > > The second document shows that Cellebrite does not have blanket coverage of locked Android devices either, although it covers most of those listed. Cellebrite cannot, for example, brute force a Google Pixel 6, 7, or 8 that has been turned off to get the users’ data, according to the document. The most recent version of Android at the time of the Cellebrite documents was Android 14, released October 2023. The Pixel 6 was released in 2021. > > > A SECTION OF THE ANDROID DOCUMENT. IMAGE: 404 MEDIA. > > Cellebrite confirmed the authenticity of the documents in an emailed statement to 404 Media. “Similar to any other software company, the documents are designed to help our customers understand Cellebrite’s technology capabilities as they conduct ethical, legally sanctioned investigations—bound by the confines of a search warrant or an owner’s consent to search. The reason we do not openly advertise our updates is so that bad actors are not privy to information that could further their criminal activity,” Victor Ryan Cooper, senior director of corporate communications and content at Cellebrite, wrote. > > “Cellebrite does not sell to countries sanctioned by the U.S., EU, UK or Israeli governments or those on the Financial Action Task Force (FATF) blacklist. We only work with and pursue customers who we believe will act lawfully and not in a manner incompatible with privacy rights or human rights,” the email added. In 2021 Al Jazeera and Haaretz reported that a paramilitary force in Bangladesh was trained to use Cellebrite’s technology. > > Cellebrite is not the only mobile forensics company targeting iOS devices. Grayshift makes a product called the GrayKey, which originally was focused on iOS devices before expanding to Android phones too. It is not clear what the GrayKey’s current capabilities are. Magnet Forensics, which merged with Grayshift in 2023, did not immediately respond to a request for comment. > > Cellebrite’s Android-focused document also explicitly mentions GrapheneOS in two tables. As well as being an operating system that the privacy-conscious might use, 404 Media has spoken to multiple people in the underground industry selling secure phones to drug traffickers who said some of their clients have moved to using GrapheneOS in recent years. > > Daniel Micay, founder of GrapheneOS, told 404 Media that GrapheneOS joined a Discord server whose members include law enforcement officials and which is dedicated to discussions around mobile forensics. “We joined and they approved us, with our official GrapheneOS account, but it seems some cops got really mad and got a mod to ban us even though we didn't post anything off topic or do anything bad,” Micay said. > > There is intense secrecy around the community of mobile forensics experts that discuss the latest unlocking tricks and shortcomings with their peers. In 2018 at Motherboard, I reported that law enforcement officials were trying to hide their emails about phone unlocking tools. At the time, I was receiving leaks of emails and documents from inside mobile forensics groups. In an attempt to obtain more information, I sent public records requests for more emails. > > “Just a heads up, my department received two public records request[s] from a Joseph Cox at Motherboard.com requesting 2 years of my emails,” a law enforcement official wrote in one email to other members. I learned of this through a subsequent leak of that email. (404 Media continues to receive leaks, including a recent set of screenshots from a mobile forensics Discord group). > > Google did not respond to a request for comment. Apple declined to comment.
>##### Linux Myths > A compilation of linux myths and misconceptions, busted and explained
>##### Purpose > To catalog and provide useful responses to common linux misconceptions and myths. To serve as a useful reference for new and old users alike.
---
I'm not affiliated with the website or its creator(s).
>##### Linux Myths > A compilation of linux myths and misconceptions, busted and explained
>##### Purpose > To catalog and provide useful responses to common linux misconceptions and myths. To serve as a useful reference for new and old users alike.
---
I'm not affiliated with the website or its creator(s).
>##### Linux Myths > A compilation of linux myths and misconceptions, busted and explained
>##### Purpose > To catalog and provide useful responses to common linux misconceptions and myths. To serve as a useful reference for new and old users alike.
---
I'm not affiliated with the website or its creator(s).
Is NixOS at the advent of an implosion? | Community inquiry on recent drama
NixOS' influence and importance at pushing Linux forward into the (previously) unexplored landscape of configuring your complete system through a single config file is undeniable. It's been a wild ride, but it was well worth it.
And although it has only been relatively recently that it has lost its niche status, the recent influx of so-called 'immutable' distros springing up like mushrooms is undeniably linked to and inspired by NixOS.
However, unfortunately, while this should have been very exciting times for what's yet to come, the recent drama surrounding the project has definitely tarnished how the project is perceived.
NixOS' ideas will definitely live on regardless. But how do you envision NixOS' own future? Any ETA's for when this drama will end? Which lessons have we learned (so far) from this drama? Are there any winners as a result of this drama? Could something like this happen to any distro?
---
In case you're out of the loop. Though, there's a lot that has transpired since but which hasn't been rigorously documented at a single place; like how 4 out of 5 NixOS board members have quit over the last 2 months or so.