GET https://kbin.spritesserver.nl/m/linux@lemmy.ml/t/16322/Security-advise-collection-what-do-you-recommend/active

Response
200 OK
IP
216.73.216.247
Profiled on
Token
6f7f5c

Security

Token

There is no security token.

Firewall

main Name
Security enabled
Stateless

Configuration

Key Value
provider security.user.provider.concrete.app_user_provider
context main
entry_point App\Security\KbinAuthenticator
user_checker App\Security\UserChecker
access_denied_handler (none)
access_denied_url (none)
authenticators 
[
  "two_factor"
  "remember_me"
  "App\Security\KbinAuthenticator"
  "App\Security\FacebookAuthenticator"
  "App\Security\GoogleAuthenticator"
  "App\Security\GithubAuthenticator"
  "App\Security\KeycloakAuthenticator"
]

Listeners

Listener Duration Response 
Symfony\Component\Security\Http\Firewall\ChannelListener {#723
  -map: Symfony\Component\Security\Http\AccessMap {#722 …}
  -logger: Monolog\Logger {#783 …}
  -httpPort: 80
  -httpsPort: 443
}
 0.00 ms (none) 
Symfony\Component\Security\Http\Firewall\ContextListener {#706
  -tokenStorage: Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorage {#1017 …}
  -sessionKey: "_security_main"
  -logger: Monolog\Logger {#783 …}
  -userProviders: Symfony\Component\DependencyInjection\Argument\RewindableGenerator {#705 …}
  -dispatcher: Symfony\Component\EventDispatcher\Debug\TraceableEventDispatcher {#747 …}
  -registered: false
  -trustResolver: Scheb\TwoFactorBundle\Security\Authentication\AuthenticationTrustResolver {#780 …}
  -sessionTrackerEnabler: Symfony\Component\Security\Core\Authentication\Token\Storage\UsageTrackingTokenStorage::enableUsageTracking(): void {#703 …}
}
 2.18 ms (none) 
Symfony\Component\Security\Http\Firewall\AuthenticatorManagerListener {#584
  -authenticatorManager: Symfony\Component\Security\Http\Authentication\AuthenticatorManager {#595 …}
}
 0.00 ms (none) 
Scheb\TwoFactorBundle\Security\Http\Firewall\TwoFactorAccessListener {#582
  -twoFactorFirewallConfig: Scheb\TwoFactorBundle\Security\TwoFactor\TwoFactorFirewallConfig {#842 …}
  -tokenStorage: Symfony\Component\Security\Core\Authentication\Token\Storage\UsageTrackingTokenStorage {#1018 …}
  -twoFactorAccessDecider: Scheb\TwoFactorBundle\Security\Authorization\TwoFactorAccessDecider {#581 …}
}
 0.05 ms (none) 
Symfony\Component\Security\Http\Firewall\AccessListener {#579
  -tokenStorage: Symfony\Component\Security\Core\Authentication\Token\Storage\UsageTrackingTokenStorage {#1018 …}
  -accessDecisionManager: Symfony\Component\Security\Core\Authorization\TraceableAccessDecisionManager {#937 …}
  -map: Symfony\Component\Security\Http\AccessMap {#722 …}
}
 0.00 ms (none) 
Symfony\Component\Security\Http\Firewall\LogoutListener {#786
  -tokenStorage: Symfony\Component\Security\Core\Authentication\Token\Storage\UsageTrackingTokenStorage {#1018 …}
  -options: [
    "csrf_parameter" => "_csrf_token"
    "csrf_token_id" => "logout"
    "logout_path" => "app_logout"
  ]
  -httpUtils: Symfony\Component\Security\Http\HttpUtils {#841 …}
  -csrfTokenManager: Symfony\Component\Security\Csrf\CsrfTokenManager {#1015 …}
  -eventDispatcher: Symfony\Component\EventDispatcher\Debug\TraceableEventDispatcher {#747 …}
}
 0.00 ms (none)

Authenticators

No authenticators have been recorded. Check previous profiles on your authentication endpoint.

Access Decision

affirmative Strategy
# Voter class
1 
"Symfony\Component\Security\Core\Authorization\Voter\AuthenticatedVoter"
2 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
3 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
4 
"Symfony\Component\Security\Core\Authorization\Voter\ExpressionVoter"
5 
"App\Security\Voter\EntryCommentVoter"
6 
"App\Security\Voter\EntryVoter"
7 
"App\Security\Voter\MagazineVoter"
8 
"App\Security\Voter\MessageThreadVoter"
9 
"App\Security\Voter\MessageVoter"
10 
"App\Security\Voter\NotificationVoter"
11 
"App\Security\Voter\OAuth2UserConsentVoter"
12 
"App\Security\Voter\PostCommentVoter"
13 
"App\Security\Voter\PostVoter"
14 
"App\Security\Voter\UserVoter"

Access decision log

# Result Attributes Object
1 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
2 DENIED moderate 
App\Entity\Entry {#2400
  +user: Proxies\__CG__\App\Entity\User {#1978 …}
  +magazine: App\Entity\Magazine {#265
    +icon: Proxies\__CG__\App\Entity\Image {#246 …}
    +name: "linux@lemmy.ml"
    +title: "linux"
    +description: """
      From Wikipedia, the free encyclopedia\n
      \n
      Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
      \n
      Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
      \n
      ### Rules\n
      \n
      - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
      - No misinformation\n
      - No NSFW content\n
      - No hate speech, bigotry, etc\n
      \n
      ### Related Communities\n
      \n
      - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
      - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
      - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
      - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
      \n
      Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
      """
    +rules: null
    +subscriptionsCount: 1
    +entryCount: 1406
    +entryCommentCount: 28632
    +postCount: 6
    +postCommentCount: 214
    +isAdult: false
    +customCss: null
    +lastActive: DateTime @1729583542 {#275
      date: 2024-10-22 09:52:22.0 +02:00
    }
    +markedForDeletionAt: null
    +tags: null
    +moderators: Doctrine\ORM\PersistentCollection {#237 …}
    +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
    +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
    +entries: Doctrine\ORM\PersistentCollection {#180 …}
    +posts: Doctrine\ORM\PersistentCollection {#138 …}
    +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
    +bans: Doctrine\ORM\PersistentCollection {#117 …}
    +reports: Doctrine\ORM\PersistentCollection {#103 …}
    +badges: Doctrine\ORM\PersistentCollection {#81 …}
    +logs: Doctrine\ORM\PersistentCollection {#71 …}
    +awards: Doctrine\ORM\PersistentCollection {#1346 …}
    +categories: Doctrine\ORM\PersistentCollection {#1823 …}
    -id: 73
    +apId: "linux@lemmy.ml"
    +apProfileId: "https://lemmy.ml/c/linux"
    +apPublicUrl: "https://lemmy.ml/c/linux"
    +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
    +apInboxUrl: "https://lemmy.ml/inbox"
    +apDomain: "lemmy.ml"
    +apPreferredUsername: "linux"
    +apDiscoverable: true
    +apManuallyApprovesFollowers: null
    +privateKey: null
    +publicKey: null
    +apFetchedAt: DateTime @1729583596 {#269
      date: 2024-10-22 09:53:16.0 +02:00
    }
    +apDeletedAt: null
    +apTimeoutAt: null
    +visibility: "visible             "
    +createdAt: DateTimeImmutable @1698929468 {#271
      date: 2023-11-02 13:51:08.0 +01:00
    }
  }
  +image: null
  +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
  +slug: "Security-advise-collection-what-do-you-recommend"
  +title: "Security advise collection - what do you recommend?"
  +url: null
  +body: """
    I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
    \n
    ### Well known\n
    \n
    #### Dont install random apps from the internet\n
    \n
    This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
    \n
    So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
    \n
    `distrobox-create NAME -i IMAGE-NAME`\n
    \n
    This also goes for\n
    \n
    - Ubuntu PPAs\n
    - Arch AUR\n
    - Opensuse Build service repos\n
    - Fedora COPR\n
    - Random external repos\n
    \n
    Some repos are more or less controlled, so be careful!\n
    \n
    Some “external ones” are trusted, like:\n
    \n
    - Fedora/Derivates: rpmfusion\n
    - Flathub\n
    - Steam Fedora Repo\n
    - Google Chrome Fedora Repo (dont use Chrome lol)\n
    - Open-h264 from Cisco\n
    - …\n
    \n
    [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
    \n
    #### Update, update, update\n
    \n
    Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
    \n
    #### Wayland\n
    \n
    X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
    \n
    - using your Camera\n
    - using your Microphone\n
    - viewing your screen or specific app Windows\n
    - simulating input devices\n
    - watching for keypresses\n
    \n
    Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
    \n
    - XFCE\n
    - LXQt, LXDE\n
    - Budgie\n
    - Mate\n
    - Cinnamon\n
    - …\n
    \n
    Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
    \n
    Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
    \n
    All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
    \n
    ### Less known\n
    \n
    #### Avoid stable Distributions\n
    \n
    Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
    \n
    Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
    \n
    Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
    \n
    #### Use an “immutable” distro\n
    \n
    Immutability is implemented in various ways, there is no standard at all\n
    \n
    - Android, Chromeos\n
    - Fedora Atomic (Silverblue, Kinoite, …)\n
    - Opensuse microOS (now Kalpa, Aeon)\n
    - VanillaOS\n
    - SteamOS\n
    \n
    They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
    \n
    VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
    \n
    Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
    \n
    Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
    \n
    Also, changes to the core system through malware are not possible, at least not directly.\n
    \n
    #### secure directories and dotfiles\n
    \n
    An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
    \n
    [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
    \n
    So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
    \n
    ```\n
    \n
    <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
    </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
    </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
    </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
    </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
    </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
    </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
    </span>\n
    ```\n
    \n
    (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
    \n
    This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
    \n
    Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
    \n
    #### SELinux or Apparmor\n
    \n
    I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
    \n
    #### Sandboxing\n
    \n
    I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
    \n
    It is in early stages though.\n
    \n
    Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
    \n
    For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
    \n
    Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
    \n
    #### Firmware updates &amp; Coreboot\n
    \n
    While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
    \n
    In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
    \n
    My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
    \n
    And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
    \n
    - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
    - System76 for US People\n
    - Starlabs also ships coreboot\n
    - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
    \n
    Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
    \n
    #### Secureboot\n
    \n
    Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
    \n
    Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
    \n
    ---\n
    \n
    What other tips do you know?
    """
  +type: "article"
  +lang: "en"
  +isOc: false
  +hasEmbed: false
  +commentCount: 15
  +favouriteCount: 28
  +score: 0
  +isAdult: false
  +sticky: false
  +lastActive: DateTime @1710702956 {#2414
    date: 2024-03-17 20:15:56.0 +01:00
  }
  +ip: null
  +adaAmount: 0
  +tags: null
  +mentions: null
  +comments: Doctrine\ORM\PersistentCollection {#1688 …}
  +votes: Doctrine\ORM\PersistentCollection {#1966 …}
  +reports: Doctrine\ORM\PersistentCollection {#1965 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
  +badges: Doctrine\ORM\PersistentCollection {#2439 …}
  +children: []
  -id: 16322
  -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
  -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
  +cross: false
  +upVotes: 0
  +downVotes: 0
  +ranking: 1700928097
  +visibility: "visible             "
  +apId: "https://feddit.de/post/6001973"
  +editedAt: DateTimeImmutable @1701462094 {#1793
    date: 2023-12-01 21:21:34.0 +01:00
  }
  +createdAt: DateTimeImmutable @1700841697 {#2402
    date: 2023-11-24 17:01:37.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS DENIED 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
3 DENIED edit 
App\Entity\Entry {#2400
  +user: Proxies\__CG__\App\Entity\User {#1978 …}
  +magazine: App\Entity\Magazine {#265
    +icon: Proxies\__CG__\App\Entity\Image {#246 …}
    +name: "linux@lemmy.ml"
    +title: "linux"
    +description: """
      From Wikipedia, the free encyclopedia\n
      \n
      Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
      \n
      Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
      \n
      ### Rules\n
      \n
      - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
      - No misinformation\n
      - No NSFW content\n
      - No hate speech, bigotry, etc\n
      \n
      ### Related Communities\n
      \n
      - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
      - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
      - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
      - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
      \n
      Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
      """
    +rules: null
    +subscriptionsCount: 1
    +entryCount: 1406
    +entryCommentCount: 28632
    +postCount: 6
    +postCommentCount: 214
    +isAdult: false
    +customCss: null
    +lastActive: DateTime @1729583542 {#275
      date: 2024-10-22 09:52:22.0 +02:00
    }
    +markedForDeletionAt: null
    +tags: null
    +moderators: Doctrine\ORM\PersistentCollection {#237 …}
    +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
    +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
    +entries: Doctrine\ORM\PersistentCollection {#180 …}
    +posts: Doctrine\ORM\PersistentCollection {#138 …}
    +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
    +bans: Doctrine\ORM\PersistentCollection {#117 …}
    +reports: Doctrine\ORM\PersistentCollection {#103 …}
    +badges: Doctrine\ORM\PersistentCollection {#81 …}
    +logs: Doctrine\ORM\PersistentCollection {#71 …}
    +awards: Doctrine\ORM\PersistentCollection {#1346 …}
    +categories: Doctrine\ORM\PersistentCollection {#1823 …}
    -id: 73
    +apId: "linux@lemmy.ml"
    +apProfileId: "https://lemmy.ml/c/linux"
    +apPublicUrl: "https://lemmy.ml/c/linux"
    +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
    +apInboxUrl: "https://lemmy.ml/inbox"
    +apDomain: "lemmy.ml"
    +apPreferredUsername: "linux"
    +apDiscoverable: true
    +apManuallyApprovesFollowers: null
    +privateKey: null
    +publicKey: null
    +apFetchedAt: DateTime @1729583596 {#269
      date: 2024-10-22 09:53:16.0 +02:00
    }
    +apDeletedAt: null
    +apTimeoutAt: null
    +visibility: "visible             "
    +createdAt: DateTimeImmutable @1698929468 {#271
      date: 2023-11-02 13:51:08.0 +01:00
    }
  }
  +image: null
  +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
  +slug: "Security-advise-collection-what-do-you-recommend"
  +title: "Security advise collection - what do you recommend?"
  +url: null
  +body: """
    I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
    \n
    ### Well known\n
    \n
    #### Dont install random apps from the internet\n
    \n
    This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
    \n
    So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
    \n
    `distrobox-create NAME -i IMAGE-NAME`\n
    \n
    This also goes for\n
    \n
    - Ubuntu PPAs\n
    - Arch AUR\n
    - Opensuse Build service repos\n
    - Fedora COPR\n
    - Random external repos\n
    \n
    Some repos are more or less controlled, so be careful!\n
    \n
    Some “external ones” are trusted, like:\n
    \n
    - Fedora/Derivates: rpmfusion\n
    - Flathub\n
    - Steam Fedora Repo\n
    - Google Chrome Fedora Repo (dont use Chrome lol)\n
    - Open-h264 from Cisco\n
    - …\n
    \n
    [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
    \n
    #### Update, update, update\n
    \n
    Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
    \n
    #### Wayland\n
    \n
    X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
    \n
    - using your Camera\n
    - using your Microphone\n
    - viewing your screen or specific app Windows\n
    - simulating input devices\n
    - watching for keypresses\n
    \n
    Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
    \n
    - XFCE\n
    - LXQt, LXDE\n
    - Budgie\n
    - Mate\n
    - Cinnamon\n
    - …\n
    \n
    Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
    \n
    Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
    \n
    All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
    \n
    ### Less known\n
    \n
    #### Avoid stable Distributions\n
    \n
    Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
    \n
    Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
    \n
    Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
    \n
    #### Use an “immutable” distro\n
    \n
    Immutability is implemented in various ways, there is no standard at all\n
    \n
    - Android, Chromeos\n
    - Fedora Atomic (Silverblue, Kinoite, …)\n
    - Opensuse microOS (now Kalpa, Aeon)\n
    - VanillaOS\n
    - SteamOS\n
    \n
    They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
    \n
    VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
    \n
    Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
    \n
    Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
    \n
    Also, changes to the core system through malware are not possible, at least not directly.\n
    \n
    #### secure directories and dotfiles\n
    \n
    An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
    \n
    [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
    \n
    So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
    \n
    ```\n
    \n
    <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
    </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
    </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
    </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
    </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
    </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
    </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
    </span>\n
    ```\n
    \n
    (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
    \n
    This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
    \n
    Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
    \n
    #### SELinux or Apparmor\n
    \n
    I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
    \n
    #### Sandboxing\n
    \n
    I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
    \n
    It is in early stages though.\n
    \n
    Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
    \n
    For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
    \n
    Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
    \n
    #### Firmware updates &amp; Coreboot\n
    \n
    While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
    \n
    In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
    \n
    My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
    \n
    And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
    \n
    - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
    - System76 for US People\n
    - Starlabs also ships coreboot\n
    - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
    \n
    Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
    \n
    #### Secureboot\n
    \n
    Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
    \n
    Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
    \n
    ---\n
    \n
    What other tips do you know?
    """
  +type: "article"
  +lang: "en"
  +isOc: false
  +hasEmbed: false
  +commentCount: 15
  +favouriteCount: 28
  +score: 0
  +isAdult: false
  +sticky: false
  +lastActive: DateTime @1710702956 {#2414
    date: 2024-03-17 20:15:56.0 +01:00
  }
  +ip: null
  +adaAmount: 0
  +tags: null
  +mentions: null
  +comments: Doctrine\ORM\PersistentCollection {#1688 …}
  +votes: Doctrine\ORM\PersistentCollection {#1966 …}
  +reports: Doctrine\ORM\PersistentCollection {#1965 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
  +badges: Doctrine\ORM\PersistentCollection {#2439 …}
  +children: []
  -id: 16322
  -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
  -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
  +cross: false
  +upVotes: 0
  +downVotes: 0
  +ranking: 1700928097
  +visibility: "visible             "
  +apId: "https://feddit.de/post/6001973"
  +editedAt: DateTimeImmutable @1701462094 {#1793
    date: 2023-12-01 21:21:34.0 +01:00
  }
  +createdAt: DateTimeImmutable @1700841697 {#2402
    date: 2023-11-24 17:01:37.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS DENIED 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
4 DENIED moderate 
App\Entity\Entry {#2400
  +user: Proxies\__CG__\App\Entity\User {#1978 …}
  +magazine: App\Entity\Magazine {#265
    +icon: Proxies\__CG__\App\Entity\Image {#246 …}
    +name: "linux@lemmy.ml"
    +title: "linux"
    +description: """
      From Wikipedia, the free encyclopedia\n
      \n
      Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
      \n
      Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
      \n
      ### Rules\n
      \n
      - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
      - No misinformation\n
      - No NSFW content\n
      - No hate speech, bigotry, etc\n
      \n
      ### Related Communities\n
      \n
      - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
      - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
      - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
      - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
      \n
      Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
      """
    +rules: null
    +subscriptionsCount: 1
    +entryCount: 1406
    +entryCommentCount: 28632
    +postCount: 6
    +postCommentCount: 214
    +isAdult: false
    +customCss: null
    +lastActive: DateTime @1729583542 {#275
      date: 2024-10-22 09:52:22.0 +02:00
    }
    +markedForDeletionAt: null
    +tags: null
    +moderators: Doctrine\ORM\PersistentCollection {#237 …}
    +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
    +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
    +entries: Doctrine\ORM\PersistentCollection {#180 …}
    +posts: Doctrine\ORM\PersistentCollection {#138 …}
    +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
    +bans: Doctrine\ORM\PersistentCollection {#117 …}
    +reports: Doctrine\ORM\PersistentCollection {#103 …}
    +badges: Doctrine\ORM\PersistentCollection {#81 …}
    +logs: Doctrine\ORM\PersistentCollection {#71 …}
    +awards: Doctrine\ORM\PersistentCollection {#1346 …}
    +categories: Doctrine\ORM\PersistentCollection {#1823 …}
    -id: 73
    +apId: "linux@lemmy.ml"
    +apProfileId: "https://lemmy.ml/c/linux"
    +apPublicUrl: "https://lemmy.ml/c/linux"
    +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
    +apInboxUrl: "https://lemmy.ml/inbox"
    +apDomain: "lemmy.ml"
    +apPreferredUsername: "linux"
    +apDiscoverable: true
    +apManuallyApprovesFollowers: null
    +privateKey: null
    +publicKey: null
    +apFetchedAt: DateTime @1729583596 {#269
      date: 2024-10-22 09:53:16.0 +02:00
    }
    +apDeletedAt: null
    +apTimeoutAt: null
    +visibility: "visible             "
    +createdAt: DateTimeImmutable @1698929468 {#271
      date: 2023-11-02 13:51:08.0 +01:00
    }
  }
  +image: null
  +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
  +slug: "Security-advise-collection-what-do-you-recommend"
  +title: "Security advise collection - what do you recommend?"
  +url: null
  +body: """
    I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
    \n
    ### Well known\n
    \n
    #### Dont install random apps from the internet\n
    \n
    This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
    \n
    So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
    \n
    `distrobox-create NAME -i IMAGE-NAME`\n
    \n
    This also goes for\n
    \n
    - Ubuntu PPAs\n
    - Arch AUR\n
    - Opensuse Build service repos\n
    - Fedora COPR\n
    - Random external repos\n
    \n
    Some repos are more or less controlled, so be careful!\n
    \n
    Some “external ones” are trusted, like:\n
    \n
    - Fedora/Derivates: rpmfusion\n
    - Flathub\n
    - Steam Fedora Repo\n
    - Google Chrome Fedora Repo (dont use Chrome lol)\n
    - Open-h264 from Cisco\n
    - …\n
    \n
    [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
    \n
    #### Update, update, update\n
    \n
    Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
    \n
    #### Wayland\n
    \n
    X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
    \n
    - using your Camera\n
    - using your Microphone\n
    - viewing your screen or specific app Windows\n
    - simulating input devices\n
    - watching for keypresses\n
    \n
    Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
    \n
    - XFCE\n
    - LXQt, LXDE\n
    - Budgie\n
    - Mate\n
    - Cinnamon\n
    - …\n
    \n
    Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
    \n
    Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
    \n
    All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
    \n
    ### Less known\n
    \n
    #### Avoid stable Distributions\n
    \n
    Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
    \n
    Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
    \n
    Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
    \n
    #### Use an “immutable” distro\n
    \n
    Immutability is implemented in various ways, there is no standard at all\n
    \n
    - Android, Chromeos\n
    - Fedora Atomic (Silverblue, Kinoite, …)\n
    - Opensuse microOS (now Kalpa, Aeon)\n
    - VanillaOS\n
    - SteamOS\n
    \n
    They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
    \n
    VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
    \n
    Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
    \n
    Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
    \n
    Also, changes to the core system through malware are not possible, at least not directly.\n
    \n
    #### secure directories and dotfiles\n
    \n
    An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
    \n
    [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
    \n
    So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
    \n
    ```\n
    \n
    <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
    </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
    </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
    </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
    </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
    </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
    </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
    </span>\n
    ```\n
    \n
    (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
    \n
    This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
    \n
    Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
    \n
    #### SELinux or Apparmor\n
    \n
    I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
    \n
    #### Sandboxing\n
    \n
    I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
    \n
    It is in early stages though.\n
    \n
    Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
    \n
    For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
    \n
    Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
    \n
    #### Firmware updates &amp; Coreboot\n
    \n
    While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
    \n
    In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
    \n
    My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
    \n
    And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
    \n
    - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
    - System76 for US People\n
    - Starlabs also ships coreboot\n
    - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
    \n
    Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
    \n
    #### Secureboot\n
    \n
    Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
    \n
    Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
    \n
    ---\n
    \n
    What other tips do you know?
    """
  +type: "article"
  +lang: "en"
  +isOc: false
  +hasEmbed: false
  +commentCount: 15
  +favouriteCount: 28
  +score: 0
  +isAdult: false
  +sticky: false
  +lastActive: DateTime @1710702956 {#2414
    date: 2024-03-17 20:15:56.0 +01:00
  }
  +ip: null
  +adaAmount: 0
  +tags: null
  +mentions: null
  +comments: Doctrine\ORM\PersistentCollection {#1688 …}
  +votes: Doctrine\ORM\PersistentCollection {#1966 …}
  +reports: Doctrine\ORM\PersistentCollection {#1965 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
  +badges: Doctrine\ORM\PersistentCollection {#2439 …}
  +children: []
  -id: 16322
  -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
  -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
  +cross: false
  +upVotes: 0
  +downVotes: 0
  +ranking: 1700928097
  +visibility: "visible             "
  +apId: "https://feddit.de/post/6001973"
  +editedAt: DateTimeImmutable @1701462094 {#1793
    date: 2023-12-01 21:21:34.0 +01:00
  }
  +createdAt: DateTimeImmutable @1700841697 {#2402
    date: 2023-11-24 17:01:37.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS DENIED 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
5 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
6 DENIED moderate 
App\Entity\EntryComment {#4530
  +user: App\Entity\User {#4478 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: null
  +root: null
  +body: """
    The desktop security model is insecure in general. Phone OSes are much more secure.\n
    \n
    Reasonable desktop OS to use is Qubes, Fedora, MacOS, ChromeOS, or Windows pro/enterprise (hardened)\n
    \n
    Phones are much more secure especially the Pixel 8/pro with MTE immensely reducing remote exploitation. GrapheneOS is the only distro that enables MTE by default and recently implemented it in their Vanadium browser.\n
    \n
    Secure phones (secure elements are important): IPhones and Pixels (GrapheneOS or stock)\n
    \n
    Also yes, Chromium is much more secure on Linux than Gecko based browsers because of its great internal sandboxing and site isolation. Firefox on Windows is catching up though, but still bad on desktop Linux and android.\n
    \n
    This all doesn’t matter if you’re running an EoL device. Make sure your receiving official security and firmware updates.\n
    \n
    that’s about it
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 1
  +score: 0
  +lastActive: DateTime @1710702956 {#4540
    date: 2024-03-17 20:15:56.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
  ]
  +children: Doctrine\ORM\PersistentCollection {#4528 …}
  +nested: Doctrine\ORM\PersistentCollection {#4526 …}
  +votes: Doctrine\ORM\PersistentCollection {#4524 …}
  +reports: Doctrine\ORM\PersistentCollection {#4522 …}
  +favourites: Doctrine\ORM\PersistentCollection {#4490 …}
  +notifications: Doctrine\ORM\PersistentCollection {#4494 …}
  -id: 159318
  -bodyTs: "'8/pro':37 'also':74 'android':110 'bad':105 'base':85 'browser':61,86 'catch':100 'chromeo':24 'chromium':76 'default':53 'desktop':2,16,107 'devic':122 'distro':48 'doesn':113 'element':65 'enabl':50 'eol':121 'especi':34 'exploit':43 'fedora':22 'firefox':96 'firmwar':130 'gecko':84 'general':8 'grapheneo':44,71 'great':90 'harden':28 'immens':40 'implement':56 'import':67 'insecur':6 'intern':91 'iphon':68 'isol':95 'linux':82,108 'maco':23 'make':123 'matter':115 'model':4 'mte':39,51 'much':12,31,78 'offici':127 'os':17 'ose':10 'phone':9,29,63 'pixel':36,70 'pro/enterprise':27 'qube':21 're':118 'reason':15 'receiv':126 'recent':55 'reduc':41 'remot':42 'run':119 'sandbox':92 'secur':3,14,33,62,64,80,128 'site':94 'still':104 'stock':73 'sure':124 'though':102 'updat':131 'use':19 'vanadium':60 'window':26,98 'yes':75"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://monero.town/comment/2578411"
  +editedAt: DateTimeImmutable @1701383000 {#4476
    date: 2023-11-30 23:23:20.0 +01:00
  }
  +createdAt: DateTimeImmutable @1700848562 {#4539
    date: 2023-11-24 18:56:02.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
7 DENIED edit 
App\Entity\EntryComment {#4530
  +user: App\Entity\User {#4478 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: null
  +root: null
  +body: """
    The desktop security model is insecure in general. Phone OSes are much more secure.\n
    \n
    Reasonable desktop OS to use is Qubes, Fedora, MacOS, ChromeOS, or Windows pro/enterprise (hardened)\n
    \n
    Phones are much more secure especially the Pixel 8/pro with MTE immensely reducing remote exploitation. GrapheneOS is the only distro that enables MTE by default and recently implemented it in their Vanadium browser.\n
    \n
    Secure phones (secure elements are important): IPhones and Pixels (GrapheneOS or stock)\n
    \n
    Also yes, Chromium is much more secure on Linux than Gecko based browsers because of its great internal sandboxing and site isolation. Firefox on Windows is catching up though, but still bad on desktop Linux and android.\n
    \n
    This all doesn’t matter if you’re running an EoL device. Make sure your receiving official security and firmware updates.\n
    \n
    that’s about it
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 1
  +score: 0
  +lastActive: DateTime @1710702956 {#4540
    date: 2024-03-17 20:15:56.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
  ]
  +children: Doctrine\ORM\PersistentCollection {#4528 …}
  +nested: Doctrine\ORM\PersistentCollection {#4526 …}
  +votes: Doctrine\ORM\PersistentCollection {#4524 …}
  +reports: Doctrine\ORM\PersistentCollection {#4522 …}
  +favourites: Doctrine\ORM\PersistentCollection {#4490 …}
  +notifications: Doctrine\ORM\PersistentCollection {#4494 …}
  -id: 159318
  -bodyTs: "'8/pro':37 'also':74 'android':110 'bad':105 'base':85 'browser':61,86 'catch':100 'chromeo':24 'chromium':76 'default':53 'desktop':2,16,107 'devic':122 'distro':48 'doesn':113 'element':65 'enabl':50 'eol':121 'especi':34 'exploit':43 'fedora':22 'firefox':96 'firmwar':130 'gecko':84 'general':8 'grapheneo':44,71 'great':90 'harden':28 'immens':40 'implement':56 'import':67 'insecur':6 'intern':91 'iphon':68 'isol':95 'linux':82,108 'maco':23 'make':123 'matter':115 'model':4 'mte':39,51 'much':12,31,78 'offici':127 'os':17 'ose':10 'phone':9,29,63 'pixel':36,70 'pro/enterprise':27 'qube':21 're':118 'reason':15 'receiv':126 'recent':55 'reduc':41 'remot':42 'run':119 'sandbox':92 'secur':3,14,33,62,64,80,128 'site':94 'still':104 'stock':73 'sure':124 'though':102 'updat':131 'use':19 'vanadium':60 'window':26,98 'yes':75"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://monero.town/comment/2578411"
  +editedAt: DateTimeImmutable @1701383000 {#4476
    date: 2023-11-30 23:23:20.0 +01:00
  }
  +createdAt: DateTimeImmutable @1700848562 {#4539
    date: 2023-11-24 18:56:02.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
8 DENIED moderate 
App\Entity\EntryComment {#4530
  +user: App\Entity\User {#4478 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: null
  +root: null
  +body: """
    The desktop security model is insecure in general. Phone OSes are much more secure.\n
    \n
    Reasonable desktop OS to use is Qubes, Fedora, MacOS, ChromeOS, or Windows pro/enterprise (hardened)\n
    \n
    Phones are much more secure especially the Pixel 8/pro with MTE immensely reducing remote exploitation. GrapheneOS is the only distro that enables MTE by default and recently implemented it in their Vanadium browser.\n
    \n
    Secure phones (secure elements are important): IPhones and Pixels (GrapheneOS or stock)\n
    \n
    Also yes, Chromium is much more secure on Linux than Gecko based browsers because of its great internal sandboxing and site isolation. Firefox on Windows is catching up though, but still bad on desktop Linux and android.\n
    \n
    This all doesn’t matter if you’re running an EoL device. Make sure your receiving official security and firmware updates.\n
    \n
    that’s about it
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 1
  +score: 0
  +lastActive: DateTime @1710702956 {#4540
    date: 2024-03-17 20:15:56.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
  ]
  +children: Doctrine\ORM\PersistentCollection {#4528 …}
  +nested: Doctrine\ORM\PersistentCollection {#4526 …}
  +votes: Doctrine\ORM\PersistentCollection {#4524 …}
  +reports: Doctrine\ORM\PersistentCollection {#4522 …}
  +favourites: Doctrine\ORM\PersistentCollection {#4490 …}
  +notifications: Doctrine\ORM\PersistentCollection {#4494 …}
  -id: 159318
  -bodyTs: "'8/pro':37 'also':74 'android':110 'bad':105 'base':85 'browser':61,86 'catch':100 'chromeo':24 'chromium':76 'default':53 'desktop':2,16,107 'devic':122 'distro':48 'doesn':113 'element':65 'enabl':50 'eol':121 'especi':34 'exploit':43 'fedora':22 'firefox':96 'firmwar':130 'gecko':84 'general':8 'grapheneo':44,71 'great':90 'harden':28 'immens':40 'implement':56 'import':67 'insecur':6 'intern':91 'iphon':68 'isol':95 'linux':82,108 'maco':23 'make':123 'matter':115 'model':4 'mte':39,51 'much':12,31,78 'offici':127 'os':17 'ose':10 'phone':9,29,63 'pixel':36,70 'pro/enterprise':27 'qube':21 're':118 'reason':15 'receiv':126 'recent':55 'reduc':41 'remot':42 'run':119 'sandbox':92 'secur':3,14,33,62,64,80,128 'site':94 'still':104 'stock':73 'sure':124 'though':102 'updat':131 'use':19 'vanadium':60 'window':26,98 'yes':75"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://monero.town/comment/2578411"
  +editedAt: DateTimeImmutable @1701383000 {#4476
    date: 2023-11-30 23:23:20.0 +01:00
  }
  +createdAt: DateTimeImmutable @1700848562 {#4539
    date: 2023-11-24 18:56:02.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
9 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
10 DENIED moderate 
App\Entity\EntryComment {#5193
  +user: Proxies\__CG__\App\Entity\User {#1978 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: App\Entity\EntryComment {#4530
    +user: App\Entity\User {#4478 …}
    +entry: App\Entity\Entry {#2400}
    +magazine: App\Entity\Magazine {#265}
    +image: null
    +parent: null
    +root: null
    +body: """
      The desktop security model is insecure in general. Phone OSes are much more secure.\n
      \n
      Reasonable desktop OS to use is Qubes, Fedora, MacOS, ChromeOS, or Windows pro/enterprise (hardened)\n
      \n
      Phones are much more secure especially the Pixel 8/pro with MTE immensely reducing remote exploitation. GrapheneOS is the only distro that enables MTE by default and recently implemented it in their Vanadium browser.\n
      \n
      Secure phones (secure elements are important): IPhones and Pixels (GrapheneOS or stock)\n
      \n
      Also yes, Chromium is much more secure on Linux than Gecko based browsers because of its great internal sandboxing and site isolation. Firefox on Windows is catching up though, but still bad on desktop Linux and android.\n
      \n
      This all doesn’t matter if you’re running an EoL device. Make sure your receiving official security and firmware updates.\n
      \n
      that’s about it
      """
    +lang: "en"
    +isAdult: false
    +favouriteCount: 1
    +score: 0
    +lastActive: DateTime @1710702956 {#4540
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +tags: null
    +mentions: [
      "@Pantherina@feddit.de"
    ]
    +children: Doctrine\ORM\PersistentCollection {#4528 …}
    +nested: Doctrine\ORM\PersistentCollection {#4526 …}
    +votes: Doctrine\ORM\PersistentCollection {#4524 …}
    +reports: Doctrine\ORM\PersistentCollection {#4522 …}
    +favourites: Doctrine\ORM\PersistentCollection {#4490 …}
    +notifications: Doctrine\ORM\PersistentCollection {#4494 …}
    -id: 159318
    -bodyTs: "'8/pro':37 'also':74 'android':110 'bad':105 'base':85 'browser':61,86 'catch':100 'chromeo':24 'chromium':76 'default':53 'desktop':2,16,107 'devic':122 'distro':48 'doesn':113 'element':65 'enabl':50 'eol':121 'especi':34 'exploit':43 'fedora':22 'firefox':96 'firmwar':130 'gecko':84 'general':8 'grapheneo':44,71 'great':90 'harden':28 'immens':40 'implement':56 'import':67 'insecur':6 'intern':91 'iphon':68 'isol':95 'linux':82,108 'maco':23 'make':123 'matter':115 'model':4 'mte':39,51 'much':12,31,78 'offici':127 'os':17 'ose':10 'phone':9,29,63 'pixel':36,70 'pro/enterprise':27 'qube':21 're':118 'reason':15 'receiv':126 'recent':55 'reduc':41 'remot':42 'run':119 'sandbox':92 'secur':3,14,33,62,64,80,128 'site':94 'still':104 'stock':73 'sure':124 'though':102 'updat':131 'use':19 'vanadium':60 'window':26,98 'yes':75"
    +ranking: 0
    +commentCount: 0
    +upVotes: 0
    +downVotes: 0
    +visibility: "visible             "
    +apId: "https://monero.town/comment/2578411"
    +editedAt: DateTimeImmutable @1701383000 {#4476
      date: 2023-11-30 23:23:20.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700848562 {#4539
      date: 2023-11-24 18:56:02.0 +01:00
    }
  }
  +root: App\Entity\EntryComment {#4530}
  +body: """
    The thing is I use Noscript so I guess having random malicious Javascript executed is pretty rare. And Firefox + Arkenfox is so much more private than damn Chromium, even though I keep a Flatpak of Chromium around.\n
    \n
    I understand that the hardened Fedora Ublue version from qoijjj isn’t that far off, maybe removing flatpaks is a bit weird and makes little sense.\n
    \n
    I am pretty sure I wont use Chromium, as Firefox is just working better for me? Everything makes sense, and for sure I wont give Google any Data.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1700857499 {#5191
    date: 2023-11-24 21:24:59.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
    "@Genghis@monero.town"
  ]
  +children: Doctrine\ORM\PersistentCollection {#5194 …}
  +nested: Doctrine\ORM\PersistentCollection {#5196 …}
  +votes: Doctrine\ORM\PersistentCollection {#5198 …}
  +reports: Doctrine\ORM\PersistentCollection {#5200 …}
  +favourites: Doctrine\ORM\PersistentCollection {#5202 …}
  +notifications: Doctrine\ORM\PersistentCollection {#5204 …}
  -id: 159826
  -bodyTs: "'arkenfox':20 'around':37 'better':77 'bit':58 'chromium':28,36,71 'damn':27 'data':91 'even':29 'everyth':80 'execut':14 'far':51 'fedora':43 'firefox':19,73 'flatpak':34,55 'give':88 'googl':89 'guess':9 'harden':42 'isn':48 'javascript':13 'keep':32 'littl':62 'make':61,81 'malici':12 'mayb':53 'much':23 'noscript':6 'pretti':16,66 'privat':25 'qoijjj':47 'random':11 'rare':17 'remov':54 'sens':63,82 'sure':67,85 'thing':2 'though':30 'ublu':44 'understand':39 'use':5,70 'version':45 'weird':59 'wont':69,87 'work':76"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://feddit.de/comment/5116840"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700857499 {#5192
    date: 2023-11-24 21:24:59.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
11 DENIED edit 
App\Entity\EntryComment {#5193
  +user: Proxies\__CG__\App\Entity\User {#1978 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: App\Entity\EntryComment {#4530
    +user: App\Entity\User {#4478 …}
    +entry: App\Entity\Entry {#2400}
    +magazine: App\Entity\Magazine {#265}
    +image: null
    +parent: null
    +root: null
    +body: """
      The desktop security model is insecure in general. Phone OSes are much more secure.\n
      \n
      Reasonable desktop OS to use is Qubes, Fedora, MacOS, ChromeOS, or Windows pro/enterprise (hardened)\n
      \n
      Phones are much more secure especially the Pixel 8/pro with MTE immensely reducing remote exploitation. GrapheneOS is the only distro that enables MTE by default and recently implemented it in their Vanadium browser.\n
      \n
      Secure phones (secure elements are important): IPhones and Pixels (GrapheneOS or stock)\n
      \n
      Also yes, Chromium is much more secure on Linux than Gecko based browsers because of its great internal sandboxing and site isolation. Firefox on Windows is catching up though, but still bad on desktop Linux and android.\n
      \n
      This all doesn’t matter if you’re running an EoL device. Make sure your receiving official security and firmware updates.\n
      \n
      that’s about it
      """
    +lang: "en"
    +isAdult: false
    +favouriteCount: 1
    +score: 0
    +lastActive: DateTime @1710702956 {#4540
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +tags: null
    +mentions: [
      "@Pantherina@feddit.de"
    ]
    +children: Doctrine\ORM\PersistentCollection {#4528 …}
    +nested: Doctrine\ORM\PersistentCollection {#4526 …}
    +votes: Doctrine\ORM\PersistentCollection {#4524 …}
    +reports: Doctrine\ORM\PersistentCollection {#4522 …}
    +favourites: Doctrine\ORM\PersistentCollection {#4490 …}
    +notifications: Doctrine\ORM\PersistentCollection {#4494 …}
    -id: 159318
    -bodyTs: "'8/pro':37 'also':74 'android':110 'bad':105 'base':85 'browser':61,86 'catch':100 'chromeo':24 'chromium':76 'default':53 'desktop':2,16,107 'devic':122 'distro':48 'doesn':113 'element':65 'enabl':50 'eol':121 'especi':34 'exploit':43 'fedora':22 'firefox':96 'firmwar':130 'gecko':84 'general':8 'grapheneo':44,71 'great':90 'harden':28 'immens':40 'implement':56 'import':67 'insecur':6 'intern':91 'iphon':68 'isol':95 'linux':82,108 'maco':23 'make':123 'matter':115 'model':4 'mte':39,51 'much':12,31,78 'offici':127 'os':17 'ose':10 'phone':9,29,63 'pixel':36,70 'pro/enterprise':27 'qube':21 're':118 'reason':15 'receiv':126 'recent':55 'reduc':41 'remot':42 'run':119 'sandbox':92 'secur':3,14,33,62,64,80,128 'site':94 'still':104 'stock':73 'sure':124 'though':102 'updat':131 'use':19 'vanadium':60 'window':26,98 'yes':75"
    +ranking: 0
    +commentCount: 0
    +upVotes: 0
    +downVotes: 0
    +visibility: "visible             "
    +apId: "https://monero.town/comment/2578411"
    +editedAt: DateTimeImmutable @1701383000 {#4476
      date: 2023-11-30 23:23:20.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700848562 {#4539
      date: 2023-11-24 18:56:02.0 +01:00
    }
  }
  +root: App\Entity\EntryComment {#4530}
  +body: """
    The thing is I use Noscript so I guess having random malicious Javascript executed is pretty rare. And Firefox + Arkenfox is so much more private than damn Chromium, even though I keep a Flatpak of Chromium around.\n
    \n
    I understand that the hardened Fedora Ublue version from qoijjj isn’t that far off, maybe removing flatpaks is a bit weird and makes little sense.\n
    \n
    I am pretty sure I wont use Chromium, as Firefox is just working better for me? Everything makes sense, and for sure I wont give Google any Data.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1700857499 {#5191
    date: 2023-11-24 21:24:59.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
    "@Genghis@monero.town"
  ]
  +children: Doctrine\ORM\PersistentCollection {#5194 …}
  +nested: Doctrine\ORM\PersistentCollection {#5196 …}
  +votes: Doctrine\ORM\PersistentCollection {#5198 …}
  +reports: Doctrine\ORM\PersistentCollection {#5200 …}
  +favourites: Doctrine\ORM\PersistentCollection {#5202 …}
  +notifications: Doctrine\ORM\PersistentCollection {#5204 …}
  -id: 159826
  -bodyTs: "'arkenfox':20 'around':37 'better':77 'bit':58 'chromium':28,36,71 'damn':27 'data':91 'even':29 'everyth':80 'execut':14 'far':51 'fedora':43 'firefox':19,73 'flatpak':34,55 'give':88 'googl':89 'guess':9 'harden':42 'isn':48 'javascript':13 'keep':32 'littl':62 'make':61,81 'malici':12 'mayb':53 'much':23 'noscript':6 'pretti':16,66 'privat':25 'qoijjj':47 'random':11 'rare':17 'remov':54 'sens':63,82 'sure':67,85 'thing':2 'though':30 'ublu':44 'understand':39 'use':5,70 'version':45 'weird':59 'wont':69,87 'work':76"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://feddit.de/comment/5116840"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700857499 {#5192
    date: 2023-11-24 21:24:59.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
12 DENIED moderate 
App\Entity\EntryComment {#5193
  +user: Proxies\__CG__\App\Entity\User {#1978 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: App\Entity\EntryComment {#4530
    +user: App\Entity\User {#4478 …}
    +entry: App\Entity\Entry {#2400}
    +magazine: App\Entity\Magazine {#265}
    +image: null
    +parent: null
    +root: null
    +body: """
      The desktop security model is insecure in general. Phone OSes are much more secure.\n
      \n
      Reasonable desktop OS to use is Qubes, Fedora, MacOS, ChromeOS, or Windows pro/enterprise (hardened)\n
      \n
      Phones are much more secure especially the Pixel 8/pro with MTE immensely reducing remote exploitation. GrapheneOS is the only distro that enables MTE by default and recently implemented it in their Vanadium browser.\n
      \n
      Secure phones (secure elements are important): IPhones and Pixels (GrapheneOS or stock)\n
      \n
      Also yes, Chromium is much more secure on Linux than Gecko based browsers because of its great internal sandboxing and site isolation. Firefox on Windows is catching up though, but still bad on desktop Linux and android.\n
      \n
      This all doesn’t matter if you’re running an EoL device. Make sure your receiving official security and firmware updates.\n
      \n
      that’s about it
      """
    +lang: "en"
    +isAdult: false
    +favouriteCount: 1
    +score: 0
    +lastActive: DateTime @1710702956 {#4540
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +tags: null
    +mentions: [
      "@Pantherina@feddit.de"
    ]
    +children: Doctrine\ORM\PersistentCollection {#4528 …}
    +nested: Doctrine\ORM\PersistentCollection {#4526 …}
    +votes: Doctrine\ORM\PersistentCollection {#4524 …}
    +reports: Doctrine\ORM\PersistentCollection {#4522 …}
    +favourites: Doctrine\ORM\PersistentCollection {#4490 …}
    +notifications: Doctrine\ORM\PersistentCollection {#4494 …}
    -id: 159318
    -bodyTs: "'8/pro':37 'also':74 'android':110 'bad':105 'base':85 'browser':61,86 'catch':100 'chromeo':24 'chromium':76 'default':53 'desktop':2,16,107 'devic':122 'distro':48 'doesn':113 'element':65 'enabl':50 'eol':121 'especi':34 'exploit':43 'fedora':22 'firefox':96 'firmwar':130 'gecko':84 'general':8 'grapheneo':44,71 'great':90 'harden':28 'immens':40 'implement':56 'import':67 'insecur':6 'intern':91 'iphon':68 'isol':95 'linux':82,108 'maco':23 'make':123 'matter':115 'model':4 'mte':39,51 'much':12,31,78 'offici':127 'os':17 'ose':10 'phone':9,29,63 'pixel':36,70 'pro/enterprise':27 'qube':21 're':118 'reason':15 'receiv':126 'recent':55 'reduc':41 'remot':42 'run':119 'sandbox':92 'secur':3,14,33,62,64,80,128 'site':94 'still':104 'stock':73 'sure':124 'though':102 'updat':131 'use':19 'vanadium':60 'window':26,98 'yes':75"
    +ranking: 0
    +commentCount: 0
    +upVotes: 0
    +downVotes: 0
    +visibility: "visible             "
    +apId: "https://monero.town/comment/2578411"
    +editedAt: DateTimeImmutable @1701383000 {#4476
      date: 2023-11-30 23:23:20.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700848562 {#4539
      date: 2023-11-24 18:56:02.0 +01:00
    }
  }
  +root: App\Entity\EntryComment {#4530}
  +body: """
    The thing is I use Noscript so I guess having random malicious Javascript executed is pretty rare. And Firefox + Arkenfox is so much more private than damn Chromium, even though I keep a Flatpak of Chromium around.\n
    \n
    I understand that the hardened Fedora Ublue version from qoijjj isn’t that far off, maybe removing flatpaks is a bit weird and makes little sense.\n
    \n
    I am pretty sure I wont use Chromium, as Firefox is just working better for me? Everything makes sense, and for sure I wont give Google any Data.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1700857499 {#5191
    date: 2023-11-24 21:24:59.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
    "@Genghis@monero.town"
  ]
  +children: Doctrine\ORM\PersistentCollection {#5194 …}
  +nested: Doctrine\ORM\PersistentCollection {#5196 …}
  +votes: Doctrine\ORM\PersistentCollection {#5198 …}
  +reports: Doctrine\ORM\PersistentCollection {#5200 …}
  +favourites: Doctrine\ORM\PersistentCollection {#5202 …}
  +notifications: Doctrine\ORM\PersistentCollection {#5204 …}
  -id: 159826
  -bodyTs: "'arkenfox':20 'around':37 'better':77 'bit':58 'chromium':28,36,71 'damn':27 'data':91 'even':29 'everyth':80 'execut':14 'far':51 'fedora':43 'firefox':19,73 'flatpak':34,55 'give':88 'googl':89 'guess':9 'harden':42 'isn':48 'javascript':13 'keep':32 'littl':62 'make':61,81 'malici':12 'mayb':53 'much':23 'noscript':6 'pretti':16,66 'privat':25 'qoijjj':47 'random':11 'rare':17 'remov':54 'sens':63,82 'sure':67,85 'thing':2 'though':30 'ublu':44 'understand':39 'use':5,70 'version':45 'weird':59 'wont':69,87 'work':76"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://feddit.de/comment/5116840"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700857499 {#5192
    date: 2023-11-24 21:24:59.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
13 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
14 DENIED moderate 
App\Entity\EntryComment {#5208
  +user: Proxies\__CG__\App\Entity\User {#5209 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: App\Entity\EntryComment {#4530
    +user: App\Entity\User {#4478 …}
    +entry: App\Entity\Entry {#2400}
    +magazine: App\Entity\Magazine {#265}
    +image: null
    +parent: null
    +root: null
    +body: """
      The desktop security model is insecure in general. Phone OSes are much more secure.\n
      \n
      Reasonable desktop OS to use is Qubes, Fedora, MacOS, ChromeOS, or Windows pro/enterprise (hardened)\n
      \n
      Phones are much more secure especially the Pixel 8/pro with MTE immensely reducing remote exploitation. GrapheneOS is the only distro that enables MTE by default and recently implemented it in their Vanadium browser.\n
      \n
      Secure phones (secure elements are important): IPhones and Pixels (GrapheneOS or stock)\n
      \n
      Also yes, Chromium is much more secure on Linux than Gecko based browsers because of its great internal sandboxing and site isolation. Firefox on Windows is catching up though, but still bad on desktop Linux and android.\n
      \n
      This all doesn’t matter if you’re running an EoL device. Make sure your receiving official security and firmware updates.\n
      \n
      that’s about it
      """
    +lang: "en"
    +isAdult: false
    +favouriteCount: 1
    +score: 0
    +lastActive: DateTime @1710702956 {#4540
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +tags: null
    +mentions: [
      "@Pantherina@feddit.de"
    ]
    +children: Doctrine\ORM\PersistentCollection {#4528 …}
    +nested: Doctrine\ORM\PersistentCollection {#4526 …}
    +votes: Doctrine\ORM\PersistentCollection {#4524 …}
    +reports: Doctrine\ORM\PersistentCollection {#4522 …}
    +favourites: Doctrine\ORM\PersistentCollection {#4490 …}
    +notifications: Doctrine\ORM\PersistentCollection {#4494 …}
    -id: 159318
    -bodyTs: "'8/pro':37 'also':74 'android':110 'bad':105 'base':85 'browser':61,86 'catch':100 'chromeo':24 'chromium':76 'default':53 'desktop':2,16,107 'devic':122 'distro':48 'doesn':113 'element':65 'enabl':50 'eol':121 'especi':34 'exploit':43 'fedora':22 'firefox':96 'firmwar':130 'gecko':84 'general':8 'grapheneo':44,71 'great':90 'harden':28 'immens':40 'implement':56 'import':67 'insecur':6 'intern':91 'iphon':68 'isol':95 'linux':82,108 'maco':23 'make':123 'matter':115 'model':4 'mte':39,51 'much':12,31,78 'offici':127 'os':17 'ose':10 'phone':9,29,63 'pixel':36,70 'pro/enterprise':27 'qube':21 're':118 'reason':15 'receiv':126 'recent':55 'reduc':41 'remot':42 'run':119 'sandbox':92 'secur':3,14,33,62,64,80,128 'site':94 'still':104 'stock':73 'sure':124 'though':102 'updat':131 'use':19 'vanadium':60 'window':26,98 'yes':75"
    +ranking: 0
    +commentCount: 0
    +upVotes: 0
    +downVotes: 0
    +visibility: "visible             "
    +apId: "https://monero.town/comment/2578411"
    +editedAt: DateTimeImmutable @1701383000 {#4476
      date: 2023-11-30 23:23:20.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700848562 {#4539
      date: 2023-11-24 18:56:02.0 +01:00
    }
  }
  +root: App\Entity\EntryComment {#4530}
  +body: """
    The base assumption here is you trust corporations such as IBM, Google, MS, and only consider security threats from minor individual actors.\n
    \n
    There is no secure way to run any gecko/chrome based app if you don't trust google.\n
    \n
    @Genghis@monero.town @Pantherina@feddit.de
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1700849352 {#5206
    date: 2023-11-24 19:09:12.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
    "@Genghis@monero.town"
  ]
  +children: Doctrine\ORM\PersistentCollection {#5210 …}
  +nested: Doctrine\ORM\PersistentCollection {#5212 …}
  +votes: Doctrine\ORM\PersistentCollection {#5214 …}
  +reports: Doctrine\ORM\PersistentCollection {#5216 …}
  +favourites: Doctrine\ORM\PersistentCollection {#5218 …}
  +notifications: Doctrine\ORM\PersistentCollection {#5220 …}
  -id: 272418
  -bodyTs: "'actor':22 'app':33 'assumpt':3 'base':2,32 'consid':16 'corpor':8 'gecko/chrome':31 'genghis@monero.town':40 'googl':12,39 'ibm':11 'individu':21 'minor':20 'ms':13 'pantherina@feddit.de':41 'run':29 'secur':17,26 'threat':18 'trust':7,38 'way':27"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://kafeneio.social/users/yianiris/statuses/111466863164902192"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700849352 {#5207
    date: 2023-11-24 19:09:12.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
15 DENIED edit 
App\Entity\EntryComment {#5208
  +user: Proxies\__CG__\App\Entity\User {#5209 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: App\Entity\EntryComment {#4530
    +user: App\Entity\User {#4478 …}
    +entry: App\Entity\Entry {#2400}
    +magazine: App\Entity\Magazine {#265}
    +image: null
    +parent: null
    +root: null
    +body: """
      The desktop security model is insecure in general. Phone OSes are much more secure.\n
      \n
      Reasonable desktop OS to use is Qubes, Fedora, MacOS, ChromeOS, or Windows pro/enterprise (hardened)\n
      \n
      Phones are much more secure especially the Pixel 8/pro with MTE immensely reducing remote exploitation. GrapheneOS is the only distro that enables MTE by default and recently implemented it in their Vanadium browser.\n
      \n
      Secure phones (secure elements are important): IPhones and Pixels (GrapheneOS or stock)\n
      \n
      Also yes, Chromium is much more secure on Linux than Gecko based browsers because of its great internal sandboxing and site isolation. Firefox on Windows is catching up though, but still bad on desktop Linux and android.\n
      \n
      This all doesn’t matter if you’re running an EoL device. Make sure your receiving official security and firmware updates.\n
      \n
      that’s about it
      """
    +lang: "en"
    +isAdult: false
    +favouriteCount: 1
    +score: 0
    +lastActive: DateTime @1710702956 {#4540
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +tags: null
    +mentions: [
      "@Pantherina@feddit.de"
    ]
    +children: Doctrine\ORM\PersistentCollection {#4528 …}
    +nested: Doctrine\ORM\PersistentCollection {#4526 …}
    +votes: Doctrine\ORM\PersistentCollection {#4524 …}
    +reports: Doctrine\ORM\PersistentCollection {#4522 …}
    +favourites: Doctrine\ORM\PersistentCollection {#4490 …}
    +notifications: Doctrine\ORM\PersistentCollection {#4494 …}
    -id: 159318
    -bodyTs: "'8/pro':37 'also':74 'android':110 'bad':105 'base':85 'browser':61,86 'catch':100 'chromeo':24 'chromium':76 'default':53 'desktop':2,16,107 'devic':122 'distro':48 'doesn':113 'element':65 'enabl':50 'eol':121 'especi':34 'exploit':43 'fedora':22 'firefox':96 'firmwar':130 'gecko':84 'general':8 'grapheneo':44,71 'great':90 'harden':28 'immens':40 'implement':56 'import':67 'insecur':6 'intern':91 'iphon':68 'isol':95 'linux':82,108 'maco':23 'make':123 'matter':115 'model':4 'mte':39,51 'much':12,31,78 'offici':127 'os':17 'ose':10 'phone':9,29,63 'pixel':36,70 'pro/enterprise':27 'qube':21 're':118 'reason':15 'receiv':126 'recent':55 'reduc':41 'remot':42 'run':119 'sandbox':92 'secur':3,14,33,62,64,80,128 'site':94 'still':104 'stock':73 'sure':124 'though':102 'updat':131 'use':19 'vanadium':60 'window':26,98 'yes':75"
    +ranking: 0
    +commentCount: 0
    +upVotes: 0
    +downVotes: 0
    +visibility: "visible             "
    +apId: "https://monero.town/comment/2578411"
    +editedAt: DateTimeImmutable @1701383000 {#4476
      date: 2023-11-30 23:23:20.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700848562 {#4539
      date: 2023-11-24 18:56:02.0 +01:00
    }
  }
  +root: App\Entity\EntryComment {#4530}
  +body: """
    The base assumption here is you trust corporations such as IBM, Google, MS, and only consider security threats from minor individual actors.\n
    \n
    There is no secure way to run any gecko/chrome based app if you don't trust google.\n
    \n
    @Genghis@monero.town @Pantherina@feddit.de
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1700849352 {#5206
    date: 2023-11-24 19:09:12.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
    "@Genghis@monero.town"
  ]
  +children: Doctrine\ORM\PersistentCollection {#5210 …}
  +nested: Doctrine\ORM\PersistentCollection {#5212 …}
  +votes: Doctrine\ORM\PersistentCollection {#5214 …}
  +reports: Doctrine\ORM\PersistentCollection {#5216 …}
  +favourites: Doctrine\ORM\PersistentCollection {#5218 …}
  +notifications: Doctrine\ORM\PersistentCollection {#5220 …}
  -id: 272418
  -bodyTs: "'actor':22 'app':33 'assumpt':3 'base':2,32 'consid':16 'corpor':8 'gecko/chrome':31 'genghis@monero.town':40 'googl':12,39 'ibm':11 'individu':21 'minor':20 'ms':13 'pantherina@feddit.de':41 'run':29 'secur':17,26 'threat':18 'trust':7,38 'way':27"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://kafeneio.social/users/yianiris/statuses/111466863164902192"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700849352 {#5207
    date: 2023-11-24 19:09:12.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
16 DENIED moderate 
App\Entity\EntryComment {#5208
  +user: Proxies\__CG__\App\Entity\User {#5209 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: App\Entity\EntryComment {#4530
    +user: App\Entity\User {#4478 …}
    +entry: App\Entity\Entry {#2400}
    +magazine: App\Entity\Magazine {#265}
    +image: null
    +parent: null
    +root: null
    +body: """
      The desktop security model is insecure in general. Phone OSes are much more secure.\n
      \n
      Reasonable desktop OS to use is Qubes, Fedora, MacOS, ChromeOS, or Windows pro/enterprise (hardened)\n
      \n
      Phones are much more secure especially the Pixel 8/pro with MTE immensely reducing remote exploitation. GrapheneOS is the only distro that enables MTE by default and recently implemented it in their Vanadium browser.\n
      \n
      Secure phones (secure elements are important): IPhones and Pixels (GrapheneOS or stock)\n
      \n
      Also yes, Chromium is much more secure on Linux than Gecko based browsers because of its great internal sandboxing and site isolation. Firefox on Windows is catching up though, but still bad on desktop Linux and android.\n
      \n
      This all doesn’t matter if you’re running an EoL device. Make sure your receiving official security and firmware updates.\n
      \n
      that’s about it
      """
    +lang: "en"
    +isAdult: false
    +favouriteCount: 1
    +score: 0
    +lastActive: DateTime @1710702956 {#4540
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +tags: null
    +mentions: [
      "@Pantherina@feddit.de"
    ]
    +children: Doctrine\ORM\PersistentCollection {#4528 …}
    +nested: Doctrine\ORM\PersistentCollection {#4526 …}
    +votes: Doctrine\ORM\PersistentCollection {#4524 …}
    +reports: Doctrine\ORM\PersistentCollection {#4522 …}
    +favourites: Doctrine\ORM\PersistentCollection {#4490 …}
    +notifications: Doctrine\ORM\PersistentCollection {#4494 …}
    -id: 159318
    -bodyTs: "'8/pro':37 'also':74 'android':110 'bad':105 'base':85 'browser':61,86 'catch':100 'chromeo':24 'chromium':76 'default':53 'desktop':2,16,107 'devic':122 'distro':48 'doesn':113 'element':65 'enabl':50 'eol':121 'especi':34 'exploit':43 'fedora':22 'firefox':96 'firmwar':130 'gecko':84 'general':8 'grapheneo':44,71 'great':90 'harden':28 'immens':40 'implement':56 'import':67 'insecur':6 'intern':91 'iphon':68 'isol':95 'linux':82,108 'maco':23 'make':123 'matter':115 'model':4 'mte':39,51 'much':12,31,78 'offici':127 'os':17 'ose':10 'phone':9,29,63 'pixel':36,70 'pro/enterprise':27 'qube':21 're':118 'reason':15 'receiv':126 'recent':55 'reduc':41 'remot':42 'run':119 'sandbox':92 'secur':3,14,33,62,64,80,128 'site':94 'still':104 'stock':73 'sure':124 'though':102 'updat':131 'use':19 'vanadium':60 'window':26,98 'yes':75"
    +ranking: 0
    +commentCount: 0
    +upVotes: 0
    +downVotes: 0
    +visibility: "visible             "
    +apId: "https://monero.town/comment/2578411"
    +editedAt: DateTimeImmutable @1701383000 {#4476
      date: 2023-11-30 23:23:20.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700848562 {#4539
      date: 2023-11-24 18:56:02.0 +01:00
    }
  }
  +root: App\Entity\EntryComment {#4530}
  +body: """
    The base assumption here is you trust corporations such as IBM, Google, MS, and only consider security threats from minor individual actors.\n
    \n
    There is no secure way to run any gecko/chrome based app if you don't trust google.\n
    \n
    @Genghis@monero.town @Pantherina@feddit.de
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1700849352 {#5206
    date: 2023-11-24 19:09:12.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
    "@Genghis@monero.town"
  ]
  +children: Doctrine\ORM\PersistentCollection {#5210 …}
  +nested: Doctrine\ORM\PersistentCollection {#5212 …}
  +votes: Doctrine\ORM\PersistentCollection {#5214 …}
  +reports: Doctrine\ORM\PersistentCollection {#5216 …}
  +favourites: Doctrine\ORM\PersistentCollection {#5218 …}
  +notifications: Doctrine\ORM\PersistentCollection {#5220 …}
  -id: 272418
  -bodyTs: "'actor':22 'app':33 'assumpt':3 'base':2,32 'consid':16 'corpor':8 'gecko/chrome':31 'genghis@monero.town':40 'googl':12,39 'ibm':11 'individu':21 'minor':20 'ms':13 'pantherina@feddit.de':41 'run':29 'secur':17,26 'threat':18 'trust':7,38 'way':27"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://kafeneio.social/users/yianiris/statuses/111466863164902192"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700849352 {#5207
    date: 2023-11-24 19:09:12.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
17 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
18 DENIED moderate 
App\Entity\EntryComment {#4566
  +user: App\Entity\User {#4550 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: null
  +root: null
  +body: "Stable not being secure is not correct. if you take a Stable LTS OS it has a guaranteed support cycle for patching security issues. Stable does not mean no updates, you will still get daily/weekly package updates for bug fixes and enhancements, as well as kernel fixes. In the case of a kernel up revision on rolling release fixing a major flaw, you also have to realize new software means new bugs and new vulnerabilities ( that are yet unknown ) Also if you worry about CVE stuff try SUSE or OpenSUSE’s zypper it has various command parameters to search and list patches, suggested security patches and will show a full list of what patches are available for your system, which ones are critical, recommended, not needed, etc with CVE numbers."
  +lang: "en"
  +isAdult: false
  +favouriteCount: 5
  +score: 0
  +lastActive: DateTime @1701484087 {#4574
    date: 2023-12-02 03:28:07.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
  ]
  +children: Doctrine\ORM\PersistentCollection {#4567 …}
  +nested: Doctrine\ORM\PersistentCollection {#4558 …}
  +votes: Doctrine\ORM\PersistentCollection {#4561 …}
  +reports: Doctrine\ORM\PersistentCollection {#4556 …}
  +favourites: Doctrine\ORM\PersistentCollection {#4554 …}
  +notifications: Doctrine\ORM\PersistentCollection {#4552 …}
  -id: 161518
  -bodyTs: "'also':64,80 'avail':116 'bug':39,72 'case':50 'command':96 'correct':7 'critic':123 'cve':85,129 'cycl':20 'daily/weekly':35 'enhanc':42 'etc':127 'fix':40,47,59 'flaw':62 'full':110 'get':34 'guarante':18 'issu':24 'kernel':46,53 'list':101,111 'lts':13 'major':61 'mean':28,70 'need':126 'new':68,71,74 'number':130 'one':121 'opensus':90 'os':14 'packag':36 'paramet':97 'patch':22,102,105,114 'realiz':67 'recommend':124 'releas':58 'revis':55 'roll':57 'search':99 'secur':4,23,104 'show':108 'softwar':69 'stabl':1,12,25 'still':33 'stuff':86 'suggest':103 'support':19 'suse':88 'system':119 'take':10 'tri':87 'unknown':79 'updat':30,37 'various':95 'vulner':75 'well':44 'worri':83 'yet':78 'zypper':92"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.ca/comment/5161035"
  +editedAt: DateTimeImmutable @1701455382 {#4572
    date: 2023-12-01 19:29:42.0 +01:00
  }
  +createdAt: DateTimeImmutable @1700896173 {#4573
    date: 2023-11-25 08:09:33.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
19 DENIED edit 
App\Entity\EntryComment {#4566
  +user: App\Entity\User {#4550 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: null
  +root: null
  +body: "Stable not being secure is not correct. if you take a Stable LTS OS it has a guaranteed support cycle for patching security issues. Stable does not mean no updates, you will still get daily/weekly package updates for bug fixes and enhancements, as well as kernel fixes. In the case of a kernel up revision on rolling release fixing a major flaw, you also have to realize new software means new bugs and new vulnerabilities ( that are yet unknown ) Also if you worry about CVE stuff try SUSE or OpenSUSE’s zypper it has various command parameters to search and list patches, suggested security patches and will show a full list of what patches are available for your system, which ones are critical, recommended, not needed, etc with CVE numbers."
  +lang: "en"
  +isAdult: false
  +favouriteCount: 5
  +score: 0
  +lastActive: DateTime @1701484087 {#4574
    date: 2023-12-02 03:28:07.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
  ]
  +children: Doctrine\ORM\PersistentCollection {#4567 …}
  +nested: Doctrine\ORM\PersistentCollection {#4558 …}
  +votes: Doctrine\ORM\PersistentCollection {#4561 …}
  +reports: Doctrine\ORM\PersistentCollection {#4556 …}
  +favourites: Doctrine\ORM\PersistentCollection {#4554 …}
  +notifications: Doctrine\ORM\PersistentCollection {#4552 …}
  -id: 161518
  -bodyTs: "'also':64,80 'avail':116 'bug':39,72 'case':50 'command':96 'correct':7 'critic':123 'cve':85,129 'cycl':20 'daily/weekly':35 'enhanc':42 'etc':127 'fix':40,47,59 'flaw':62 'full':110 'get':34 'guarante':18 'issu':24 'kernel':46,53 'list':101,111 'lts':13 'major':61 'mean':28,70 'need':126 'new':68,71,74 'number':130 'one':121 'opensus':90 'os':14 'packag':36 'paramet':97 'patch':22,102,105,114 'realiz':67 'recommend':124 'releas':58 'revis':55 'roll':57 'search':99 'secur':4,23,104 'show':108 'softwar':69 'stabl':1,12,25 'still':33 'stuff':86 'suggest':103 'support':19 'suse':88 'system':119 'take':10 'tri':87 'unknown':79 'updat':30,37 'various':95 'vulner':75 'well':44 'worri':83 'yet':78 'zypper':92"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.ca/comment/5161035"
  +editedAt: DateTimeImmutable @1701455382 {#4572
    date: 2023-12-01 19:29:42.0 +01:00
  }
  +createdAt: DateTimeImmutable @1700896173 {#4573
    date: 2023-11-25 08:09:33.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
20 DENIED moderate 
App\Entity\EntryComment {#4566
  +user: App\Entity\User {#4550 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: null
  +root: null
  +body: "Stable not being secure is not correct. if you take a Stable LTS OS it has a guaranteed support cycle for patching security issues. Stable does not mean no updates, you will still get daily/weekly package updates for bug fixes and enhancements, as well as kernel fixes. In the case of a kernel up revision on rolling release fixing a major flaw, you also have to realize new software means new bugs and new vulnerabilities ( that are yet unknown ) Also if you worry about CVE stuff try SUSE or OpenSUSE’s zypper it has various command parameters to search and list patches, suggested security patches and will show a full list of what patches are available for your system, which ones are critical, recommended, not needed, etc with CVE numbers."
  +lang: "en"
  +isAdult: false
  +favouriteCount: 5
  +score: 0
  +lastActive: DateTime @1701484087 {#4574
    date: 2023-12-02 03:28:07.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
  ]
  +children: Doctrine\ORM\PersistentCollection {#4567 …}
  +nested: Doctrine\ORM\PersistentCollection {#4558 …}
  +votes: Doctrine\ORM\PersistentCollection {#4561 …}
  +reports: Doctrine\ORM\PersistentCollection {#4556 …}
  +favourites: Doctrine\ORM\PersistentCollection {#4554 …}
  +notifications: Doctrine\ORM\PersistentCollection {#4552 …}
  -id: 161518
  -bodyTs: "'also':64,80 'avail':116 'bug':39,72 'case':50 'command':96 'correct':7 'critic':123 'cve':85,129 'cycl':20 'daily/weekly':35 'enhanc':42 'etc':127 'fix':40,47,59 'flaw':62 'full':110 'get':34 'guarante':18 'issu':24 'kernel':46,53 'list':101,111 'lts':13 'major':61 'mean':28,70 'need':126 'new':68,71,74 'number':130 'one':121 'opensus':90 'os':14 'packag':36 'paramet':97 'patch':22,102,105,114 'realiz':67 'recommend':124 'releas':58 'revis':55 'roll':57 'search':99 'secur':4,23,104 'show':108 'softwar':69 'stabl':1,12,25 'still':33 'stuff':86 'suggest':103 'support':19 'suse':88 'system':119 'take':10 'tri':87 'unknown':79 'updat':30,37 'various':95 'vulner':75 'well':44 'worri':83 'yet':78 'zypper':92"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.ca/comment/5161035"
  +editedAt: DateTimeImmutable @1701455382 {#4572
    date: 2023-12-01 19:29:42.0 +01:00
  }
  +createdAt: DateTimeImmutable @1700896173 {#4573
    date: 2023-11-25 08:09:33.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
21 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
22 DENIED moderate 
App\Entity\EntryComment {#5239
  +user: Proxies\__CG__\App\Entity\User {#1978 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: App\Entity\EntryComment {#4566
    +user: App\Entity\User {#4550 …}
    +entry: App\Entity\Entry {#2400}
    +magazine: App\Entity\Magazine {#265}
    +image: null
    +parent: null
    +root: null
    +body: "Stable not being secure is not correct. if you take a Stable LTS OS it has a guaranteed support cycle for patching security issues. Stable does not mean no updates, you will still get daily/weekly package updates for bug fixes and enhancements, as well as kernel fixes. In the case of a kernel up revision on rolling release fixing a major flaw, you also have to realize new software means new bugs and new vulnerabilities ( that are yet unknown ) Also if you worry about CVE stuff try SUSE or OpenSUSE’s zypper it has various command parameters to search and list patches, suggested security patches and will show a full list of what patches are available for your system, which ones are critical, recommended, not needed, etc with CVE numbers."
    +lang: "en"
    +isAdult: false
    +favouriteCount: 5
    +score: 0
    +lastActive: DateTime @1701484087 {#4574
      date: 2023-12-02 03:28:07.0 +01:00
    }
    +ip: null
    +tags: null
    +mentions: [
      "@Pantherina@feddit.de"
    ]
    +children: Doctrine\ORM\PersistentCollection {#4567 …}
    +nested: Doctrine\ORM\PersistentCollection {#4558 …}
    +votes: Doctrine\ORM\PersistentCollection {#4561 …}
    +reports: Doctrine\ORM\PersistentCollection {#4556 …}
    +favourites: Doctrine\ORM\PersistentCollection {#4554 …}
    +notifications: Doctrine\ORM\PersistentCollection {#4552 …}
    -id: 161518
    -bodyTs: "'also':64,80 'avail':116 'bug':39,72 'case':50 'command':96 'correct':7 'critic':123 'cve':85,129 'cycl':20 'daily/weekly':35 'enhanc':42 'etc':127 'fix':40,47,59 'flaw':62 'full':110 'get':34 'guarante':18 'issu':24 'kernel':46,53 'list':101,111 'lts':13 'major':61 'mean':28,70 'need':126 'new':68,71,74 'number':130 'one':121 'opensus':90 'os':14 'packag':36 'paramet':97 'patch':22,102,105,114 'realiz':67 'recommend':124 'releas':58 'revis':55 'roll':57 'search':99 'secur':4,23,104 'show':108 'softwar':69 'stabl':1,12,25 'still':33 'stuff':86 'suggest':103 'support':19 'suse':88 'system':119 'take':10 'tri':87 'unknown':79 'updat':30,37 'various':95 'vulner':75 'well':44 'worri':83 'yet':78 'zypper':92"
    +ranking: 0
    +commentCount: 0
    +upVotes: 0
    +downVotes: 0
    +visibility: "visible             "
    +apId: "https://lemmy.ca/comment/5161035"
    +editedAt: DateTimeImmutable @1701455382 {#4572
      date: 2023-12-01 19:29:42.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700896173 {#4573
      date: 2023-11-25 08:09:33.0 +01:00
    }
  }
  +root: App\Entity\EntryComment {#4566}
  +body: "Good point about “no new security issues”. But new issues mostly also mean zero days so this is very less likely that old bugs that didnt get a CVE. But I dont know the details, what bugs Debian backports always, I just assume its not all."
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1700915617 {#5237
    date: 2023-11-25 13:33:37.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
    "@BCsven@lemmy.ca"
  ]
  +children: Doctrine\ORM\PersistentCollection {#5240 …}
  +nested: Doctrine\ORM\PersistentCollection {#5242 …}
  +votes: Doctrine\ORM\PersistentCollection {#5244 …}
  +reports: Doctrine\ORM\PersistentCollection {#5246 …}
  +favourites: Doctrine\ORM\PersistentCollection {#5248 …}
  +notifications: Doctrine\ORM\PersistentCollection {#5250 …}
  -id: 162221
  -bodyTs: "'also':12 'alway':40 'assum':43 'backport':39 'bug':24,37 'cve':29 'day':15 'debian':38 'detail':35 'didnt':26 'dont':32 'get':27 'good':1 'issu':7,10 'know':33 'less':20 'like':21 'mean':13 'most':11 'new':5,9 'old':23 'point':2 'secur':6 'zero':14"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://feddit.de/comment/5136075"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700915617 {#5238
    date: 2023-11-25 13:33:37.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
23 DENIED edit 
App\Entity\EntryComment {#5239
  +user: Proxies\__CG__\App\Entity\User {#1978 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: App\Entity\EntryComment {#4566
    +user: App\Entity\User {#4550 …}
    +entry: App\Entity\Entry {#2400}
    +magazine: App\Entity\Magazine {#265}
    +image: null
    +parent: null
    +root: null
    +body: "Stable not being secure is not correct. if you take a Stable LTS OS it has a guaranteed support cycle for patching security issues. Stable does not mean no updates, you will still get daily/weekly package updates for bug fixes and enhancements, as well as kernel fixes. In the case of a kernel up revision on rolling release fixing a major flaw, you also have to realize new software means new bugs and new vulnerabilities ( that are yet unknown ) Also if you worry about CVE stuff try SUSE or OpenSUSE’s zypper it has various command parameters to search and list patches, suggested security patches and will show a full list of what patches are available for your system, which ones are critical, recommended, not needed, etc with CVE numbers."
    +lang: "en"
    +isAdult: false
    +favouriteCount: 5
    +score: 0
    +lastActive: DateTime @1701484087 {#4574
      date: 2023-12-02 03:28:07.0 +01:00
    }
    +ip: null
    +tags: null
    +mentions: [
      "@Pantherina@feddit.de"
    ]
    +children: Doctrine\ORM\PersistentCollection {#4567 …}
    +nested: Doctrine\ORM\PersistentCollection {#4558 …}
    +votes: Doctrine\ORM\PersistentCollection {#4561 …}
    +reports: Doctrine\ORM\PersistentCollection {#4556 …}
    +favourites: Doctrine\ORM\PersistentCollection {#4554 …}
    +notifications: Doctrine\ORM\PersistentCollection {#4552 …}
    -id: 161518
    -bodyTs: "'also':64,80 'avail':116 'bug':39,72 'case':50 'command':96 'correct':7 'critic':123 'cve':85,129 'cycl':20 'daily/weekly':35 'enhanc':42 'etc':127 'fix':40,47,59 'flaw':62 'full':110 'get':34 'guarante':18 'issu':24 'kernel':46,53 'list':101,111 'lts':13 'major':61 'mean':28,70 'need':126 'new':68,71,74 'number':130 'one':121 'opensus':90 'os':14 'packag':36 'paramet':97 'patch':22,102,105,114 'realiz':67 'recommend':124 'releas':58 'revis':55 'roll':57 'search':99 'secur':4,23,104 'show':108 'softwar':69 'stabl':1,12,25 'still':33 'stuff':86 'suggest':103 'support':19 'suse':88 'system':119 'take':10 'tri':87 'unknown':79 'updat':30,37 'various':95 'vulner':75 'well':44 'worri':83 'yet':78 'zypper':92"
    +ranking: 0
    +commentCount: 0
    +upVotes: 0
    +downVotes: 0
    +visibility: "visible             "
    +apId: "https://lemmy.ca/comment/5161035"
    +editedAt: DateTimeImmutable @1701455382 {#4572
      date: 2023-12-01 19:29:42.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700896173 {#4573
      date: 2023-11-25 08:09:33.0 +01:00
    }
  }
  +root: App\Entity\EntryComment {#4566}
  +body: "Good point about “no new security issues”. But new issues mostly also mean zero days so this is very less likely that old bugs that didnt get a CVE. But I dont know the details, what bugs Debian backports always, I just assume its not all."
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1700915617 {#5237
    date: 2023-11-25 13:33:37.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
    "@BCsven@lemmy.ca"
  ]
  +children: Doctrine\ORM\PersistentCollection {#5240 …}
  +nested: Doctrine\ORM\PersistentCollection {#5242 …}
  +votes: Doctrine\ORM\PersistentCollection {#5244 …}
  +reports: Doctrine\ORM\PersistentCollection {#5246 …}
  +favourites: Doctrine\ORM\PersistentCollection {#5248 …}
  +notifications: Doctrine\ORM\PersistentCollection {#5250 …}
  -id: 162221
  -bodyTs: "'also':12 'alway':40 'assum':43 'backport':39 'bug':24,37 'cve':29 'day':15 'debian':38 'detail':35 'didnt':26 'dont':32 'get':27 'good':1 'issu':7,10 'know':33 'less':20 'like':21 'mean':13 'most':11 'new':5,9 'old':23 'point':2 'secur':6 'zero':14"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://feddit.de/comment/5136075"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700915617 {#5238
    date: 2023-11-25 13:33:37.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
24 DENIED moderate 
App\Entity\EntryComment {#5239
  +user: Proxies\__CG__\App\Entity\User {#1978 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: App\Entity\EntryComment {#4566
    +user: App\Entity\User {#4550 …}
    +entry: App\Entity\Entry {#2400}
    +magazine: App\Entity\Magazine {#265}
    +image: null
    +parent: null
    +root: null
    +body: "Stable not being secure is not correct. if you take a Stable LTS OS it has a guaranteed support cycle for patching security issues. Stable does not mean no updates, you will still get daily/weekly package updates for bug fixes and enhancements, as well as kernel fixes. In the case of a kernel up revision on rolling release fixing a major flaw, you also have to realize new software means new bugs and new vulnerabilities ( that are yet unknown ) Also if you worry about CVE stuff try SUSE or OpenSUSE’s zypper it has various command parameters to search and list patches, suggested security patches and will show a full list of what patches are available for your system, which ones are critical, recommended, not needed, etc with CVE numbers."
    +lang: "en"
    +isAdult: false
    +favouriteCount: 5
    +score: 0
    +lastActive: DateTime @1701484087 {#4574
      date: 2023-12-02 03:28:07.0 +01:00
    }
    +ip: null
    +tags: null
    +mentions: [
      "@Pantherina@feddit.de"
    ]
    +children: Doctrine\ORM\PersistentCollection {#4567 …}
    +nested: Doctrine\ORM\PersistentCollection {#4558 …}
    +votes: Doctrine\ORM\PersistentCollection {#4561 …}
    +reports: Doctrine\ORM\PersistentCollection {#4556 …}
    +favourites: Doctrine\ORM\PersistentCollection {#4554 …}
    +notifications: Doctrine\ORM\PersistentCollection {#4552 …}
    -id: 161518
    -bodyTs: "'also':64,80 'avail':116 'bug':39,72 'case':50 'command':96 'correct':7 'critic':123 'cve':85,129 'cycl':20 'daily/weekly':35 'enhanc':42 'etc':127 'fix':40,47,59 'flaw':62 'full':110 'get':34 'guarante':18 'issu':24 'kernel':46,53 'list':101,111 'lts':13 'major':61 'mean':28,70 'need':126 'new':68,71,74 'number':130 'one':121 'opensus':90 'os':14 'packag':36 'paramet':97 'patch':22,102,105,114 'realiz':67 'recommend':124 'releas':58 'revis':55 'roll':57 'search':99 'secur':4,23,104 'show':108 'softwar':69 'stabl':1,12,25 'still':33 'stuff':86 'suggest':103 'support':19 'suse':88 'system':119 'take':10 'tri':87 'unknown':79 'updat':30,37 'various':95 'vulner':75 'well':44 'worri':83 'yet':78 'zypper':92"
    +ranking: 0
    +commentCount: 0
    +upVotes: 0
    +downVotes: 0
    +visibility: "visible             "
    +apId: "https://lemmy.ca/comment/5161035"
    +editedAt: DateTimeImmutable @1701455382 {#4572
      date: 2023-12-01 19:29:42.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700896173 {#4573
      date: 2023-11-25 08:09:33.0 +01:00
    }
  }
  +root: App\Entity\EntryComment {#4566}
  +body: "Good point about “no new security issues”. But new issues mostly also mean zero days so this is very less likely that old bugs that didnt get a CVE. But I dont know the details, what bugs Debian backports always, I just assume its not all."
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1700915617 {#5237
    date: 2023-11-25 13:33:37.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
    "@BCsven@lemmy.ca"
  ]
  +children: Doctrine\ORM\PersistentCollection {#5240 …}
  +nested: Doctrine\ORM\PersistentCollection {#5242 …}
  +votes: Doctrine\ORM\PersistentCollection {#5244 …}
  +reports: Doctrine\ORM\PersistentCollection {#5246 …}
  +favourites: Doctrine\ORM\PersistentCollection {#5248 …}
  +notifications: Doctrine\ORM\PersistentCollection {#5250 …}
  -id: 162221
  -bodyTs: "'also':12 'alway':40 'assum':43 'backport':39 'bug':24,37 'cve':29 'day':15 'debian':38 'detail':35 'didnt':26 'dont':32 'get':27 'good':1 'issu':7,10 'know':33 'less':20 'like':21 'mean':13 'most':11 'new':5,9 'old':23 'point':2 'secur':6 'zero':14"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://feddit.de/comment/5136075"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700915617 {#5238
    date: 2023-11-25 13:33:37.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
25 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
26 DENIED moderate 
App\Entity\EntryComment {#4650
  +user: App\Entity\User {#4663 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: null
  +root: null
  +body: """
    As @BCsven@lemmy.ca mentioned, the talk about stable distributions is not right at all.\n
    \n
    Also, the commands you gave in “secure directories and dotfiles” are not doing anything. `sudo chmod 755 ~/.bashrc` doesn’t change the ownership of the file: it’s still owned by you. So setting the permissions 755 just makes it writeable by…you. You will still be able to modify it without sudo.\n
    \n
    If you want to make your dotfile require root access to change, you would need to augment the `chmod` with a `sudo chown root ~/.bashrc`
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 5
  +score: 0
  +lastActive: DateTime @1701461493 {#4645
    date: 2023-12-01 21:11:33.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@BCsven@lemmy.ca"
    "@Pantherina@feddit.de"
  ]
  +children: Doctrine\ORM\PersistentCollection {#4651 …}
  +nested: Doctrine\ORM\PersistentCollection {#4653 …}
  +votes: Doctrine\ORM\PersistentCollection {#4655 …}
  +reports: Doctrine\ORM\PersistentCollection {#4657 …}
  +favourites: Doctrine\ORM\PersistentCollection {#4659 …}
  +notifications: Doctrine\ORM\PersistentCollection {#4661 …}
  -id: 161649
  -bodyTs: "'/.bashrc':31,91 '755':30,50 'abl':61 'access':76 'also':14 'anyth':27 'augment':83 'bcsven@lemmy.ca':2 'chang':34,78 'chmod':29,85 'chown':89 'command':16 'directori':21 'distribut':8 'doesn':32 'dotfil':23,73 'file':39 'gave':18 'make':52,71 'mention':3 'modifi':63 'need':81 'own':43 'ownership':36 'permiss':49 'requir':74 'right':11 'root':75,90 'secur':20 'set':47 'stabl':7 'still':42,59 'sudo':28,66,88 'talk':5 'want':69 'without':65 'would':80 'writeabl':54"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.one/comment/4992642"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700898730 {#4646
    date: 2023-11-25 08:52:10.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
27 DENIED edit 
App\Entity\EntryComment {#4650
  +user: App\Entity\User {#4663 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: null
  +root: null
  +body: """
    As @BCsven@lemmy.ca mentioned, the talk about stable distributions is not right at all.\n
    \n
    Also, the commands you gave in “secure directories and dotfiles” are not doing anything. `sudo chmod 755 ~/.bashrc` doesn’t change the ownership of the file: it’s still owned by you. So setting the permissions 755 just makes it writeable by…you. You will still be able to modify it without sudo.\n
    \n
    If you want to make your dotfile require root access to change, you would need to augment the `chmod` with a `sudo chown root ~/.bashrc`
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 5
  +score: 0
  +lastActive: DateTime @1701461493 {#4645
    date: 2023-12-01 21:11:33.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@BCsven@lemmy.ca"
    "@Pantherina@feddit.de"
  ]
  +children: Doctrine\ORM\PersistentCollection {#4651 …}
  +nested: Doctrine\ORM\PersistentCollection {#4653 …}
  +votes: Doctrine\ORM\PersistentCollection {#4655 …}
  +reports: Doctrine\ORM\PersistentCollection {#4657 …}
  +favourites: Doctrine\ORM\PersistentCollection {#4659 …}
  +notifications: Doctrine\ORM\PersistentCollection {#4661 …}
  -id: 161649
  -bodyTs: "'/.bashrc':31,91 '755':30,50 'abl':61 'access':76 'also':14 'anyth':27 'augment':83 'bcsven@lemmy.ca':2 'chang':34,78 'chmod':29,85 'chown':89 'command':16 'directori':21 'distribut':8 'doesn':32 'dotfil':23,73 'file':39 'gave':18 'make':52,71 'mention':3 'modifi':63 'need':81 'own':43 'ownership':36 'permiss':49 'requir':74 'right':11 'root':75,90 'secur':20 'set':47 'stabl':7 'still':42,59 'sudo':28,66,88 'talk':5 'want':69 'without':65 'would':80 'writeabl':54"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.one/comment/4992642"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700898730 {#4646
    date: 2023-11-25 08:52:10.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
28 DENIED moderate 
App\Entity\EntryComment {#4650
  +user: App\Entity\User {#4663 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: null
  +root: null
  +body: """
    As @BCsven@lemmy.ca mentioned, the talk about stable distributions is not right at all.\n
    \n
    Also, the commands you gave in “secure directories and dotfiles” are not doing anything. `sudo chmod 755 ~/.bashrc` doesn’t change the ownership of the file: it’s still owned by you. So setting the permissions 755 just makes it writeable by…you. You will still be able to modify it without sudo.\n
    \n
    If you want to make your dotfile require root access to change, you would need to augment the `chmod` with a `sudo chown root ~/.bashrc`
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 5
  +score: 0
  +lastActive: DateTime @1701461493 {#4645
    date: 2023-12-01 21:11:33.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@BCsven@lemmy.ca"
    "@Pantherina@feddit.de"
  ]
  +children: Doctrine\ORM\PersistentCollection {#4651 …}
  +nested: Doctrine\ORM\PersistentCollection {#4653 …}
  +votes: Doctrine\ORM\PersistentCollection {#4655 …}
  +reports: Doctrine\ORM\PersistentCollection {#4657 …}
  +favourites: Doctrine\ORM\PersistentCollection {#4659 …}
  +notifications: Doctrine\ORM\PersistentCollection {#4661 …}
  -id: 161649
  -bodyTs: "'/.bashrc':31,91 '755':30,50 'abl':61 'access':76 'also':14 'anyth':27 'augment':83 'bcsven@lemmy.ca':2 'chang':34,78 'chmod':29,85 'chown':89 'command':16 'directori':21 'distribut':8 'doesn':32 'dotfil':23,73 'file':39 'gave':18 'make':52,71 'mention':3 'modifi':63 'need':81 'own':43 'ownership':36 'permiss':49 'requir':74 'right':11 'root':75,90 'secur':20 'set':47 'stabl':7 'still':42,59 'sudo':28,66,88 'talk':5 'want':69 'without':65 'would':80 'writeabl':54"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.one/comment/4992642"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700898730 {#4646
    date: 2023-11-25 08:52:10.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
29 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
30 DENIED moderate 
App\Entity\EntryComment {#5254
  +user: Proxies\__CG__\App\Entity\User {#1978 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: App\Entity\EntryComment {#4650
    +user: App\Entity\User {#4663 …}
    +entry: App\Entity\Entry {#2400}
    +magazine: App\Entity\Magazine {#265}
    +image: null
    +parent: null
    +root: null
    +body: """
      As @BCsven@lemmy.ca mentioned, the talk about stable distributions is not right at all.\n
      \n
      Also, the commands you gave in “secure directories and dotfiles” are not doing anything. `sudo chmod 755 ~/.bashrc` doesn’t change the ownership of the file: it’s still owned by you. So setting the permissions 755 just makes it writeable by…you. You will still be able to modify it without sudo.\n
      \n
      If you want to make your dotfile require root access to change, you would need to augment the `chmod` with a `sudo chown root ~/.bashrc`
      """
    +lang: "en"
    +isAdult: false
    +favouriteCount: 5
    +score: 0
    +lastActive: DateTime @1701461493 {#4645
      date: 2023-12-01 21:11:33.0 +01:00
    }
    +ip: null
    +tags: null
    +mentions: [
      "@BCsven@lemmy.ca"
      "@Pantherina@feddit.de"
    ]
    +children: Doctrine\ORM\PersistentCollection {#4651 …}
    +nested: Doctrine\ORM\PersistentCollection {#4653 …}
    +votes: Doctrine\ORM\PersistentCollection {#4655 …}
    +reports: Doctrine\ORM\PersistentCollection {#4657 …}
    +favourites: Doctrine\ORM\PersistentCollection {#4659 …}
    +notifications: Doctrine\ORM\PersistentCollection {#4661 …}
    -id: 161649
    -bodyTs: "'/.bashrc':31,91 '755':30,50 'abl':61 'access':76 'also':14 'anyth':27 'augment':83 'bcsven@lemmy.ca':2 'chang':34,78 'chmod':29,85 'chown':89 'command':16 'directori':21 'distribut':8 'doesn':32 'dotfil':23,73 'file':39 'gave':18 'make':52,71 'mention':3 'modifi':63 'need':81 'own':43 'ownership':36 'permiss':49 'requir':74 'right':11 'root':75,90 'secur':20 'set':47 'stabl':7 'still':42,59 'sudo':28,66,88 'talk':5 'want':69 'without':65 'would':80 'writeabl':54"
    +ranking: 0
    +commentCount: 0
    +upVotes: 0
    +downVotes: 0
    +visibility: "visible             "
    +apId: "https://lemmy.one/comment/4992642"
    +editedAt: null
    +createdAt: DateTimeImmutable @1700898730 {#4646
      date: 2023-11-25 08:52:10.0 +01:00
    }
  }
  +root: App\Entity\EntryComment {#4650}
  +body: "Thanks yes I forgot to mention that."
  +lang: "en"
  +isAdult: false
  +favouriteCount: 2
  +score: 0
  +lastActive: DateTime @1700901174 {#5252
    date: 2023-11-25 09:32:54.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@BCsven@lemmy.ca"
    "@Pantherina@feddit.de"
    "@duncesplayed@lemmy.one"
  ]
  +children: Doctrine\ORM\PersistentCollection {#5255 …}
  +nested: Doctrine\ORM\PersistentCollection {#5257 …}
  +votes: Doctrine\ORM\PersistentCollection {#5259 …}
  +reports: Doctrine\ORM\PersistentCollection {#5261 …}
  +favourites: Doctrine\ORM\PersistentCollection {#5263 …}
  +notifications: Doctrine\ORM\PersistentCollection {#5265 …}
  -id: 161733
  -bodyTs: "'forgot':4 'mention':6 'thank':1 'yes':2"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://feddit.de/comment/5132613"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700901174 {#5253
    date: 2023-11-25 09:32:54.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
31 DENIED edit 
App\Entity\EntryComment {#5254
  +user: Proxies\__CG__\App\Entity\User {#1978 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: App\Entity\EntryComment {#4650
    +user: App\Entity\User {#4663 …}
    +entry: App\Entity\Entry {#2400}
    +magazine: App\Entity\Magazine {#265}
    +image: null
    +parent: null
    +root: null
    +body: """
      As @BCsven@lemmy.ca mentioned, the talk about stable distributions is not right at all.\n
      \n
      Also, the commands you gave in “secure directories and dotfiles” are not doing anything. `sudo chmod 755 ~/.bashrc` doesn’t change the ownership of the file: it’s still owned by you. So setting the permissions 755 just makes it writeable by…you. You will still be able to modify it without sudo.\n
      \n
      If you want to make your dotfile require root access to change, you would need to augment the `chmod` with a `sudo chown root ~/.bashrc`
      """
    +lang: "en"
    +isAdult: false
    +favouriteCount: 5
    +score: 0
    +lastActive: DateTime @1701461493 {#4645
      date: 2023-12-01 21:11:33.0 +01:00
    }
    +ip: null
    +tags: null
    +mentions: [
      "@BCsven@lemmy.ca"
      "@Pantherina@feddit.de"
    ]
    +children: Doctrine\ORM\PersistentCollection {#4651 …}
    +nested: Doctrine\ORM\PersistentCollection {#4653 …}
    +votes: Doctrine\ORM\PersistentCollection {#4655 …}
    +reports: Doctrine\ORM\PersistentCollection {#4657 …}
    +favourites: Doctrine\ORM\PersistentCollection {#4659 …}
    +notifications: Doctrine\ORM\PersistentCollection {#4661 …}
    -id: 161649
    -bodyTs: "'/.bashrc':31,91 '755':30,50 'abl':61 'access':76 'also':14 'anyth':27 'augment':83 'bcsven@lemmy.ca':2 'chang':34,78 'chmod':29,85 'chown':89 'command':16 'directori':21 'distribut':8 'doesn':32 'dotfil':23,73 'file':39 'gave':18 'make':52,71 'mention':3 'modifi':63 'need':81 'own':43 'ownership':36 'permiss':49 'requir':74 'right':11 'root':75,90 'secur':20 'set':47 'stabl':7 'still':42,59 'sudo':28,66,88 'talk':5 'want':69 'without':65 'would':80 'writeabl':54"
    +ranking: 0
    +commentCount: 0
    +upVotes: 0
    +downVotes: 0
    +visibility: "visible             "
    +apId: "https://lemmy.one/comment/4992642"
    +editedAt: null
    +createdAt: DateTimeImmutable @1700898730 {#4646
      date: 2023-11-25 08:52:10.0 +01:00
    }
  }
  +root: App\Entity\EntryComment {#4650}
  +body: "Thanks yes I forgot to mention that."
  +lang: "en"
  +isAdult: false
  +favouriteCount: 2
  +score: 0
  +lastActive: DateTime @1700901174 {#5252
    date: 2023-11-25 09:32:54.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@BCsven@lemmy.ca"
    "@Pantherina@feddit.de"
    "@duncesplayed@lemmy.one"
  ]
  +children: Doctrine\ORM\PersistentCollection {#5255 …}
  +nested: Doctrine\ORM\PersistentCollection {#5257 …}
  +votes: Doctrine\ORM\PersistentCollection {#5259 …}
  +reports: Doctrine\ORM\PersistentCollection {#5261 …}
  +favourites: Doctrine\ORM\PersistentCollection {#5263 …}
  +notifications: Doctrine\ORM\PersistentCollection {#5265 …}
  -id: 161733
  -bodyTs: "'forgot':4 'mention':6 'thank':1 'yes':2"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://feddit.de/comment/5132613"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700901174 {#5253
    date: 2023-11-25 09:32:54.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
32 DENIED moderate 
App\Entity\EntryComment {#5254
  +user: Proxies\__CG__\App\Entity\User {#1978 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: App\Entity\EntryComment {#4650
    +user: App\Entity\User {#4663 …}
    +entry: App\Entity\Entry {#2400}
    +magazine: App\Entity\Magazine {#265}
    +image: null
    +parent: null
    +root: null
    +body: """
      As @BCsven@lemmy.ca mentioned, the talk about stable distributions is not right at all.\n
      \n
      Also, the commands you gave in “secure directories and dotfiles” are not doing anything. `sudo chmod 755 ~/.bashrc` doesn’t change the ownership of the file: it’s still owned by you. So setting the permissions 755 just makes it writeable by…you. You will still be able to modify it without sudo.\n
      \n
      If you want to make your dotfile require root access to change, you would need to augment the `chmod` with a `sudo chown root ~/.bashrc`
      """
    +lang: "en"
    +isAdult: false
    +favouriteCount: 5
    +score: 0
    +lastActive: DateTime @1701461493 {#4645
      date: 2023-12-01 21:11:33.0 +01:00
    }
    +ip: null
    +tags: null
    +mentions: [
      "@BCsven@lemmy.ca"
      "@Pantherina@feddit.de"
    ]
    +children: Doctrine\ORM\PersistentCollection {#4651 …}
    +nested: Doctrine\ORM\PersistentCollection {#4653 …}
    +votes: Doctrine\ORM\PersistentCollection {#4655 …}
    +reports: Doctrine\ORM\PersistentCollection {#4657 …}
    +favourites: Doctrine\ORM\PersistentCollection {#4659 …}
    +notifications: Doctrine\ORM\PersistentCollection {#4661 …}
    -id: 161649
    -bodyTs: "'/.bashrc':31,91 '755':30,50 'abl':61 'access':76 'also':14 'anyth':27 'augment':83 'bcsven@lemmy.ca':2 'chang':34,78 'chmod':29,85 'chown':89 'command':16 'directori':21 'distribut':8 'doesn':32 'dotfil':23,73 'file':39 'gave':18 'make':52,71 'mention':3 'modifi':63 'need':81 'own':43 'ownership':36 'permiss':49 'requir':74 'right':11 'root':75,90 'secur':20 'set':47 'stabl':7 'still':42,59 'sudo':28,66,88 'talk':5 'want':69 'without':65 'would':80 'writeabl':54"
    +ranking: 0
    +commentCount: 0
    +upVotes: 0
    +downVotes: 0
    +visibility: "visible             "
    +apId: "https://lemmy.one/comment/4992642"
    +editedAt: null
    +createdAt: DateTimeImmutable @1700898730 {#4646
      date: 2023-11-25 08:52:10.0 +01:00
    }
  }
  +root: App\Entity\EntryComment {#4650}
  +body: "Thanks yes I forgot to mention that."
  +lang: "en"
  +isAdult: false
  +favouriteCount: 2
  +score: 0
  +lastActive: DateTime @1700901174 {#5252
    date: 2023-11-25 09:32:54.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@BCsven@lemmy.ca"
    "@Pantherina@feddit.de"
    "@duncesplayed@lemmy.one"
  ]
  +children: Doctrine\ORM\PersistentCollection {#5255 …}
  +nested: Doctrine\ORM\PersistentCollection {#5257 …}
  +votes: Doctrine\ORM\PersistentCollection {#5259 …}
  +reports: Doctrine\ORM\PersistentCollection {#5261 …}
  +favourites: Doctrine\ORM\PersistentCollection {#5263 …}
  +notifications: Doctrine\ORM\PersistentCollection {#5265 …}
  -id: 161733
  -bodyTs: "'forgot':4 'mention':6 'thank':1 'yes':2"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://feddit.de/comment/5132613"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700901174 {#5253
    date: 2023-11-25 09:32:54.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
33 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
34 DENIED moderate 
App\Entity\EntryComment {#4723
  +user: App\Entity\User {#4736 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: null
  +root: null
  +body: """
    Don't bother "securing" directories like that. The meaningful permission bit is the write permission on the directory holding the file. `cat ~/.bashrc > ~/.bashrc.new; put-malware-in ~/.bashrc.new; rm -f ~/.bashrc; mv ~/.bashrc.new ~/.bashrc` or the like will still work if you have write permissions to `/home/username` at all. Marking the file immutable with `chattr +i` as root might be slightly more effective, but realistically still not enough in a lot of cases as the parent directory can still be renamed. Not to mention you've only found some of the low-hanging fruit; your text editor most likely also has a few ways to accomplish arbitrary code execution in its config/scripting/plugin files but it absolutely doesn't stop there.\n
    \n
    Don't bother buying old systems because they can have free firmware. Ever since Spectre, CPU vulnerabilities have made old machines completely unsuitable for high-security purposes time and time again. Not all mitigations are equally effective and with mitigations on, performance takes a massive hit on those 10 year old machines. If you can get a reasonably new system with free firmware, that's good, though.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 9
  +score: 0
  +lastActive: DateTime @1701395722 {#4718
    date: 2023-12-01 02:55:22.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
  ]
  +children: Doctrine\ORM\PersistentCollection {#4724 …}
  +nested: Doctrine\ORM\PersistentCollection {#4726 …}
  +votes: Doctrine\ORM\PersistentCollection {#4728 …}
  +reports: Doctrine\ORM\PersistentCollection {#4730 …}
  +favourites: Doctrine\ORM\PersistentCollection {#4732 …}
  +notifications: Doctrine\ORM\PersistentCollection {#4734 …}
  -id: 159144
  -bodyTs: "'/.bashrc':23,32,35 '/.bashrc.new':24,29,34 '/home/username':48 '10':172 'absolut':118 'accomplish':108 'also':102 'arbitrari':109 'bit':11 'bother':3,125 'buy':126 'case':74 'cat':22 'chattr':56 'code':110 'complet':144 'config/scripting/plugin':114 'cpu':138 'directori':5,18,78 'doesn':119 'editor':99 'effect':64,160 'enough':69 'equal':159 'ever':135 'execut':111 'f':31 'file':21,53,115 'firmwar':134,186 'found':89 'free':133,185 'fruit':96 'get':179 'good':189 'hang':95 'high':148 'high-secur':147 'hit':169 'hold':19 'immut':54 'like':6,38,101 'lot':72 'low':94 'low-hang':93 'machin':143,175 'made':141 'malwar':27 'mark':51 'massiv':168 'meaning':9 'mention':85 'might':60 'mitig':157,163 'mv':33 'new':182 'old':127,142,174 'parent':77 'perform':165 'permiss':10,15,46 'purpos':150 'put':26 'put-malware-in':25 'realist':66 'reason':181 'renam':82 'rm':30 'root':59 'secur':4,149 'sinc':136 'slight':62 'spectr':137 'still':40,67,80 'stop':121 'system':128,183 'take':166 'text':98 'though':190 'time':151,153 'unsuit':145 've':87 'vulner':139 'way':106 'work':41 'write':14,45 'year':173"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://kbin.social/m/linux@lemmy.ml/t/652878/-/comment/3752219"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700845023 {#4719
    date: 2023-11-24 17:57:03.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
35 DENIED edit 
App\Entity\EntryComment {#4723
  +user: App\Entity\User {#4736 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: null
  +root: null
  +body: """
    Don't bother "securing" directories like that. The meaningful permission bit is the write permission on the directory holding the file. `cat ~/.bashrc > ~/.bashrc.new; put-malware-in ~/.bashrc.new; rm -f ~/.bashrc; mv ~/.bashrc.new ~/.bashrc` or the like will still work if you have write permissions to `/home/username` at all. Marking the file immutable with `chattr +i` as root might be slightly more effective, but realistically still not enough in a lot of cases as the parent directory can still be renamed. Not to mention you've only found some of the low-hanging fruit; your text editor most likely also has a few ways to accomplish arbitrary code execution in its config/scripting/plugin files but it absolutely doesn't stop there.\n
    \n
    Don't bother buying old systems because they can have free firmware. Ever since Spectre, CPU vulnerabilities have made old machines completely unsuitable for high-security purposes time and time again. Not all mitigations are equally effective and with mitigations on, performance takes a massive hit on those 10 year old machines. If you can get a reasonably new system with free firmware, that's good, though.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 9
  +score: 0
  +lastActive: DateTime @1701395722 {#4718
    date: 2023-12-01 02:55:22.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
  ]
  +children: Doctrine\ORM\PersistentCollection {#4724 …}
  +nested: Doctrine\ORM\PersistentCollection {#4726 …}
  +votes: Doctrine\ORM\PersistentCollection {#4728 …}
  +reports: Doctrine\ORM\PersistentCollection {#4730 …}
  +favourites: Doctrine\ORM\PersistentCollection {#4732 …}
  +notifications: Doctrine\ORM\PersistentCollection {#4734 …}
  -id: 159144
  -bodyTs: "'/.bashrc':23,32,35 '/.bashrc.new':24,29,34 '/home/username':48 '10':172 'absolut':118 'accomplish':108 'also':102 'arbitrari':109 'bit':11 'bother':3,125 'buy':126 'case':74 'cat':22 'chattr':56 'code':110 'complet':144 'config/scripting/plugin':114 'cpu':138 'directori':5,18,78 'doesn':119 'editor':99 'effect':64,160 'enough':69 'equal':159 'ever':135 'execut':111 'f':31 'file':21,53,115 'firmwar':134,186 'found':89 'free':133,185 'fruit':96 'get':179 'good':189 'hang':95 'high':148 'high-secur':147 'hit':169 'hold':19 'immut':54 'like':6,38,101 'lot':72 'low':94 'low-hang':93 'machin':143,175 'made':141 'malwar':27 'mark':51 'massiv':168 'meaning':9 'mention':85 'might':60 'mitig':157,163 'mv':33 'new':182 'old':127,142,174 'parent':77 'perform':165 'permiss':10,15,46 'purpos':150 'put':26 'put-malware-in':25 'realist':66 'reason':181 'renam':82 'rm':30 'root':59 'secur':4,149 'sinc':136 'slight':62 'spectr':137 'still':40,67,80 'stop':121 'system':128,183 'take':166 'text':98 'though':190 'time':151,153 'unsuit':145 've':87 'vulner':139 'way':106 'work':41 'write':14,45 'year':173"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://kbin.social/m/linux@lemmy.ml/t/652878/-/comment/3752219"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700845023 {#4719
    date: 2023-11-24 17:57:03.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
36 DENIED moderate 
App\Entity\EntryComment {#4723
  +user: App\Entity\User {#4736 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: null
  +root: null
  +body: """
    Don't bother "securing" directories like that. The meaningful permission bit is the write permission on the directory holding the file. `cat ~/.bashrc > ~/.bashrc.new; put-malware-in ~/.bashrc.new; rm -f ~/.bashrc; mv ~/.bashrc.new ~/.bashrc` or the like will still work if you have write permissions to `/home/username` at all. Marking the file immutable with `chattr +i` as root might be slightly more effective, but realistically still not enough in a lot of cases as the parent directory can still be renamed. Not to mention you've only found some of the low-hanging fruit; your text editor most likely also has a few ways to accomplish arbitrary code execution in its config/scripting/plugin files but it absolutely doesn't stop there.\n
    \n
    Don't bother buying old systems because they can have free firmware. Ever since Spectre, CPU vulnerabilities have made old machines completely unsuitable for high-security purposes time and time again. Not all mitigations are equally effective and with mitigations on, performance takes a massive hit on those 10 year old machines. If you can get a reasonably new system with free firmware, that's good, though.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 9
  +score: 0
  +lastActive: DateTime @1701395722 {#4718
    date: 2023-12-01 02:55:22.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
  ]
  +children: Doctrine\ORM\PersistentCollection {#4724 …}
  +nested: Doctrine\ORM\PersistentCollection {#4726 …}
  +votes: Doctrine\ORM\PersistentCollection {#4728 …}
  +reports: Doctrine\ORM\PersistentCollection {#4730 …}
  +favourites: Doctrine\ORM\PersistentCollection {#4732 …}
  +notifications: Doctrine\ORM\PersistentCollection {#4734 …}
  -id: 159144
  -bodyTs: "'/.bashrc':23,32,35 '/.bashrc.new':24,29,34 '/home/username':48 '10':172 'absolut':118 'accomplish':108 'also':102 'arbitrari':109 'bit':11 'bother':3,125 'buy':126 'case':74 'cat':22 'chattr':56 'code':110 'complet':144 'config/scripting/plugin':114 'cpu':138 'directori':5,18,78 'doesn':119 'editor':99 'effect':64,160 'enough':69 'equal':159 'ever':135 'execut':111 'f':31 'file':21,53,115 'firmwar':134,186 'found':89 'free':133,185 'fruit':96 'get':179 'good':189 'hang':95 'high':148 'high-secur':147 'hit':169 'hold':19 'immut':54 'like':6,38,101 'lot':72 'low':94 'low-hang':93 'machin':143,175 'made':141 'malwar':27 'mark':51 'massiv':168 'meaning':9 'mention':85 'might':60 'mitig':157,163 'mv':33 'new':182 'old':127,142,174 'parent':77 'perform':165 'permiss':10,15,46 'purpos':150 'put':26 'put-malware-in':25 'realist':66 'reason':181 'renam':82 'rm':30 'root':59 'secur':4,149 'sinc':136 'slight':62 'spectr':137 'still':40,67,80 'stop':121 'system':128,183 'take':166 'text':98 'though':190 'time':151,153 'unsuit':145 've':87 'vulner':139 'way':106 'work':41 'write':14,45 'year':173"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://kbin.social/m/linux@lemmy.ml/t/652878/-/comment/3752219"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700845023 {#4719
    date: 2023-11-24 17:57:03.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
37 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
38 DENIED moderate 
App\Entity\EntryComment {#5175
  +user: Proxies\__CG__\App\Entity\User {#1978 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: App\Entity\EntryComment {#4723
    +user: App\Entity\User {#4736 …}
    +entry: App\Entity\Entry {#2400}
    +magazine: App\Entity\Magazine {#265}
    +image: null
    +parent: null
    +root: null
    +body: """
      Don't bother "securing" directories like that. The meaningful permission bit is the write permission on the directory holding the file. `cat ~/.bashrc > ~/.bashrc.new; put-malware-in ~/.bashrc.new; rm -f ~/.bashrc; mv ~/.bashrc.new ~/.bashrc` or the like will still work if you have write permissions to `/home/username` at all. Marking the file immutable with `chattr +i` as root might be slightly more effective, but realistically still not enough in a lot of cases as the parent directory can still be renamed. Not to mention you've only found some of the low-hanging fruit; your text editor most likely also has a few ways to accomplish arbitrary code execution in its config/scripting/plugin files but it absolutely doesn't stop there.\n
      \n
      Don't bother buying old systems because they can have free firmware. Ever since Spectre, CPU vulnerabilities have made old machines completely unsuitable for high-security purposes time and time again. Not all mitigations are equally effective and with mitigations on, performance takes a massive hit on those 10 year old machines. If you can get a reasonably new system with free firmware, that's good, though.
      """
    +lang: "en"
    +isAdult: false
    +favouriteCount: 9
    +score: 0
    +lastActive: DateTime @1701395722 {#4718
      date: 2023-12-01 02:55:22.0 +01:00
    }
    +ip: null
    +tags: null
    +mentions: [
      "@Pantherina@feddit.de"
    ]
    +children: Doctrine\ORM\PersistentCollection {#4724 …}
    +nested: Doctrine\ORM\PersistentCollection {#4726 …}
    +votes: Doctrine\ORM\PersistentCollection {#4728 …}
    +reports: Doctrine\ORM\PersistentCollection {#4730 …}
    +favourites: Doctrine\ORM\PersistentCollection {#4732 …}
    +notifications: Doctrine\ORM\PersistentCollection {#4734 …}
    -id: 159144
    -bodyTs: "'/.bashrc':23,32,35 '/.bashrc.new':24,29,34 '/home/username':48 '10':172 'absolut':118 'accomplish':108 'also':102 'arbitrari':109 'bit':11 'bother':3,125 'buy':126 'case':74 'cat':22 'chattr':56 'code':110 'complet':144 'config/scripting/plugin':114 'cpu':138 'directori':5,18,78 'doesn':119 'editor':99 'effect':64,160 'enough':69 'equal':159 'ever':135 'execut':111 'f':31 'file':21,53,115 'firmwar':134,186 'found':89 'free':133,185 'fruit':96 'get':179 'good':189 'hang':95 'high':148 'high-secur':147 'hit':169 'hold':19 'immut':54 'like':6,38,101 'lot':72 'low':94 'low-hang':93 'machin':143,175 'made':141 'malwar':27 'mark':51 'massiv':168 'meaning':9 'mention':85 'might':60 'mitig':157,163 'mv':33 'new':182 'old':127,142,174 'parent':77 'perform':165 'permiss':10,15,46 'purpos':150 'put':26 'put-malware-in':25 'realist':66 'reason':181 'renam':82 'rm':30 'root':59 'secur':4,149 'sinc':136 'slight':62 'spectr':137 'still':40,67,80 'stop':121 'system':128,183 'take':166 'text':98 'though':190 'time':151,153 'unsuit':145 've':87 'vulner':139 'way':106 'work':41 'write':14,45 'year':173"
    +ranking: 0
    +commentCount: 0
    +upVotes: 0
    +downVotes: 0
    +visibility: "visible             "
    +apId: "https://kbin.social/m/linux@lemmy.ml/t/652878/-/comment/3752219"
    +editedAt: null
    +createdAt: DateTimeImmutable @1700845023 {#4719
      date: 2023-11-24 17:57:03.0 +01:00
    }
  }
  +root: App\Entity\EntryComment {#4723}
  +body: """
    Thats important… are you sure you can delete files without write permission? Couldnt this be avoided? Because if you cant delete or write to a file, it is basically immutable right?\n
    \n
    Chown sudo is still missing so currently its useless. But how do you do that without a root account?\n
    \n
    Yeah, spectre is really bad…
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1700856928 {#5182
    date: 2023-11-24 21:15:28.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
    "@chameleon@kbin.social"
  ]
  +children: Doctrine\ORM\PersistentCollection {#5169 …}
  +nested: Doctrine\ORM\PersistentCollection {#5173 …}
  +votes: Doctrine\ORM\PersistentCollection {#5171 …}
  +reports: Doctrine\ORM\PersistentCollection {#5185 …}
  +favourites: Doctrine\ORM\PersistentCollection {#5187 …}
  +notifications: Doctrine\ORM\PersistentCollection {#5189 …}
  -id: 159789
  -bodyTs: "'account':50 'avoid':16 'bad':55 'basic':29 'cant':20 'chown':32 'couldnt':13 'current':38 'delet':8,21 'file':9,26 'immut':30 'import':2 'miss':36 'permiss':12 'realli':54 'right':31 'root':49 'spectr':52 'still':35 'sudo':33 'sure':5 'that':1 'useless':40 'without':10,47 'write':11,23 'yeah':51"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://feddit.de/comment/5116505"
  +editedAt: DateTimeImmutable @1701395739 {#5179
    date: 2023-12-01 02:55:39.0 +01:00
  }
  +createdAt: DateTimeImmutable @1700856928 {#5181
    date: 2023-11-24 21:15:28.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
39 DENIED edit 
App\Entity\EntryComment {#5175
  +user: Proxies\__CG__\App\Entity\User {#1978 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: App\Entity\EntryComment {#4723
    +user: App\Entity\User {#4736 …}
    +entry: App\Entity\Entry {#2400}
    +magazine: App\Entity\Magazine {#265}
    +image: null
    +parent: null
    +root: null
    +body: """
      Don't bother "securing" directories like that. The meaningful permission bit is the write permission on the directory holding the file. `cat ~/.bashrc > ~/.bashrc.new; put-malware-in ~/.bashrc.new; rm -f ~/.bashrc; mv ~/.bashrc.new ~/.bashrc` or the like will still work if you have write permissions to `/home/username` at all. Marking the file immutable with `chattr +i` as root might be slightly more effective, but realistically still not enough in a lot of cases as the parent directory can still be renamed. Not to mention you've only found some of the low-hanging fruit; your text editor most likely also has a few ways to accomplish arbitrary code execution in its config/scripting/plugin files but it absolutely doesn't stop there.\n
      \n
      Don't bother buying old systems because they can have free firmware. Ever since Spectre, CPU vulnerabilities have made old machines completely unsuitable for high-security purposes time and time again. Not all mitigations are equally effective and with mitigations on, performance takes a massive hit on those 10 year old machines. If you can get a reasonably new system with free firmware, that's good, though.
      """
    +lang: "en"
    +isAdult: false
    +favouriteCount: 9
    +score: 0
    +lastActive: DateTime @1701395722 {#4718
      date: 2023-12-01 02:55:22.0 +01:00
    }
    +ip: null
    +tags: null
    +mentions: [
      "@Pantherina@feddit.de"
    ]
    +children: Doctrine\ORM\PersistentCollection {#4724 …}
    +nested: Doctrine\ORM\PersistentCollection {#4726 …}
    +votes: Doctrine\ORM\PersistentCollection {#4728 …}
    +reports: Doctrine\ORM\PersistentCollection {#4730 …}
    +favourites: Doctrine\ORM\PersistentCollection {#4732 …}
    +notifications: Doctrine\ORM\PersistentCollection {#4734 …}
    -id: 159144
    -bodyTs: "'/.bashrc':23,32,35 '/.bashrc.new':24,29,34 '/home/username':48 '10':172 'absolut':118 'accomplish':108 'also':102 'arbitrari':109 'bit':11 'bother':3,125 'buy':126 'case':74 'cat':22 'chattr':56 'code':110 'complet':144 'config/scripting/plugin':114 'cpu':138 'directori':5,18,78 'doesn':119 'editor':99 'effect':64,160 'enough':69 'equal':159 'ever':135 'execut':111 'f':31 'file':21,53,115 'firmwar':134,186 'found':89 'free':133,185 'fruit':96 'get':179 'good':189 'hang':95 'high':148 'high-secur':147 'hit':169 'hold':19 'immut':54 'like':6,38,101 'lot':72 'low':94 'low-hang':93 'machin':143,175 'made':141 'malwar':27 'mark':51 'massiv':168 'meaning':9 'mention':85 'might':60 'mitig':157,163 'mv':33 'new':182 'old':127,142,174 'parent':77 'perform':165 'permiss':10,15,46 'purpos':150 'put':26 'put-malware-in':25 'realist':66 'reason':181 'renam':82 'rm':30 'root':59 'secur':4,149 'sinc':136 'slight':62 'spectr':137 'still':40,67,80 'stop':121 'system':128,183 'take':166 'text':98 'though':190 'time':151,153 'unsuit':145 've':87 'vulner':139 'way':106 'work':41 'write':14,45 'year':173"
    +ranking: 0
    +commentCount: 0
    +upVotes: 0
    +downVotes: 0
    +visibility: "visible             "
    +apId: "https://kbin.social/m/linux@lemmy.ml/t/652878/-/comment/3752219"
    +editedAt: null
    +createdAt: DateTimeImmutable @1700845023 {#4719
      date: 2023-11-24 17:57:03.0 +01:00
    }
  }
  +root: App\Entity\EntryComment {#4723}
  +body: """
    Thats important… are you sure you can delete files without write permission? Couldnt this be avoided? Because if you cant delete or write to a file, it is basically immutable right?\n
    \n
    Chown sudo is still missing so currently its useless. But how do you do that without a root account?\n
    \n
    Yeah, spectre is really bad…
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1700856928 {#5182
    date: 2023-11-24 21:15:28.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
    "@chameleon@kbin.social"
  ]
  +children: Doctrine\ORM\PersistentCollection {#5169 …}
  +nested: Doctrine\ORM\PersistentCollection {#5173 …}
  +votes: Doctrine\ORM\PersistentCollection {#5171 …}
  +reports: Doctrine\ORM\PersistentCollection {#5185 …}
  +favourites: Doctrine\ORM\PersistentCollection {#5187 …}
  +notifications: Doctrine\ORM\PersistentCollection {#5189 …}
  -id: 159789
  -bodyTs: "'account':50 'avoid':16 'bad':55 'basic':29 'cant':20 'chown':32 'couldnt':13 'current':38 'delet':8,21 'file':9,26 'immut':30 'import':2 'miss':36 'permiss':12 'realli':54 'right':31 'root':49 'spectr':52 'still':35 'sudo':33 'sure':5 'that':1 'useless':40 'without':10,47 'write':11,23 'yeah':51"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://feddit.de/comment/5116505"
  +editedAt: DateTimeImmutable @1701395739 {#5179
    date: 2023-12-01 02:55:39.0 +01:00
  }
  +createdAt: DateTimeImmutable @1700856928 {#5181
    date: 2023-11-24 21:15:28.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
40 DENIED moderate 
App\Entity\EntryComment {#5175
  +user: Proxies\__CG__\App\Entity\User {#1978 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: App\Entity\EntryComment {#4723
    +user: App\Entity\User {#4736 …}
    +entry: App\Entity\Entry {#2400}
    +magazine: App\Entity\Magazine {#265}
    +image: null
    +parent: null
    +root: null
    +body: """
      Don't bother "securing" directories like that. The meaningful permission bit is the write permission on the directory holding the file. `cat ~/.bashrc > ~/.bashrc.new; put-malware-in ~/.bashrc.new; rm -f ~/.bashrc; mv ~/.bashrc.new ~/.bashrc` or the like will still work if you have write permissions to `/home/username` at all. Marking the file immutable with `chattr +i` as root might be slightly more effective, but realistically still not enough in a lot of cases as the parent directory can still be renamed. Not to mention you've only found some of the low-hanging fruit; your text editor most likely also has a few ways to accomplish arbitrary code execution in its config/scripting/plugin files but it absolutely doesn't stop there.\n
      \n
      Don't bother buying old systems because they can have free firmware. Ever since Spectre, CPU vulnerabilities have made old machines completely unsuitable for high-security purposes time and time again. Not all mitigations are equally effective and with mitigations on, performance takes a massive hit on those 10 year old machines. If you can get a reasonably new system with free firmware, that's good, though.
      """
    +lang: "en"
    +isAdult: false
    +favouriteCount: 9
    +score: 0
    +lastActive: DateTime @1701395722 {#4718
      date: 2023-12-01 02:55:22.0 +01:00
    }
    +ip: null
    +tags: null
    +mentions: [
      "@Pantherina@feddit.de"
    ]
    +children: Doctrine\ORM\PersistentCollection {#4724 …}
    +nested: Doctrine\ORM\PersistentCollection {#4726 …}
    +votes: Doctrine\ORM\PersistentCollection {#4728 …}
    +reports: Doctrine\ORM\PersistentCollection {#4730 …}
    +favourites: Doctrine\ORM\PersistentCollection {#4732 …}
    +notifications: Doctrine\ORM\PersistentCollection {#4734 …}
    -id: 159144
    -bodyTs: "'/.bashrc':23,32,35 '/.bashrc.new':24,29,34 '/home/username':48 '10':172 'absolut':118 'accomplish':108 'also':102 'arbitrari':109 'bit':11 'bother':3,125 'buy':126 'case':74 'cat':22 'chattr':56 'code':110 'complet':144 'config/scripting/plugin':114 'cpu':138 'directori':5,18,78 'doesn':119 'editor':99 'effect':64,160 'enough':69 'equal':159 'ever':135 'execut':111 'f':31 'file':21,53,115 'firmwar':134,186 'found':89 'free':133,185 'fruit':96 'get':179 'good':189 'hang':95 'high':148 'high-secur':147 'hit':169 'hold':19 'immut':54 'like':6,38,101 'lot':72 'low':94 'low-hang':93 'machin':143,175 'made':141 'malwar':27 'mark':51 'massiv':168 'meaning':9 'mention':85 'might':60 'mitig':157,163 'mv':33 'new':182 'old':127,142,174 'parent':77 'perform':165 'permiss':10,15,46 'purpos':150 'put':26 'put-malware-in':25 'realist':66 'reason':181 'renam':82 'rm':30 'root':59 'secur':4,149 'sinc':136 'slight':62 'spectr':137 'still':40,67,80 'stop':121 'system':128,183 'take':166 'text':98 'though':190 'time':151,153 'unsuit':145 've':87 'vulner':139 'way':106 'work':41 'write':14,45 'year':173"
    +ranking: 0
    +commentCount: 0
    +upVotes: 0
    +downVotes: 0
    +visibility: "visible             "
    +apId: "https://kbin.social/m/linux@lemmy.ml/t/652878/-/comment/3752219"
    +editedAt: null
    +createdAt: DateTimeImmutable @1700845023 {#4719
      date: 2023-11-24 17:57:03.0 +01:00
    }
  }
  +root: App\Entity\EntryComment {#4723}
  +body: """
    Thats important… are you sure you can delete files without write permission? Couldnt this be avoided? Because if you cant delete or write to a file, it is basically immutable right?\n
    \n
    Chown sudo is still missing so currently its useless. But how do you do that without a root account?\n
    \n
    Yeah, spectre is really bad…
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1700856928 {#5182
    date: 2023-11-24 21:15:28.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
    "@chameleon@kbin.social"
  ]
  +children: Doctrine\ORM\PersistentCollection {#5169 …}
  +nested: Doctrine\ORM\PersistentCollection {#5173 …}
  +votes: Doctrine\ORM\PersistentCollection {#5171 …}
  +reports: Doctrine\ORM\PersistentCollection {#5185 …}
  +favourites: Doctrine\ORM\PersistentCollection {#5187 …}
  +notifications: Doctrine\ORM\PersistentCollection {#5189 …}
  -id: 159789
  -bodyTs: "'account':50 'avoid':16 'bad':55 'basic':29 'cant':20 'chown':32 'couldnt':13 'current':38 'delet':8,21 'file':9,26 'immut':30 'import':2 'miss':36 'permiss':12 'realli':54 'right':31 'root':49 'spectr':52 'still':35 'sudo':33 'sure':5 'that':1 'useless':40 'without':10,47 'write':11,23 'yeah':51"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://feddit.de/comment/5116505"
  +editedAt: DateTimeImmutable @1701395739 {#5179
    date: 2023-12-01 02:55:39.0 +01:00
  }
  +createdAt: DateTimeImmutable @1700856928 {#5181
    date: 2023-11-24 21:15:28.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
41 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
42 DENIED moderate 
App\Entity\EntryComment {#4797
  +user: App\Entity\User {#4810 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: null
  +root: null
  +body: "In general, the articles found on [privsec.dev](https://privsec.dev/) are excellent reads and provide both guidance and motivation. With their article on [Desktop Linux Hardening](https://privsec.dev/posts/linux/desktop-linux-hardening/) being my personal favorite."
  +lang: "en"
  +isAdult: false
  +favouriteCount: 2
  +score: 0
  +lastActive: DateTime @1701395338 {#4792
    date: 2023-12-01 02:48:58.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
  ]
  +children: Doctrine\ORM\PersistentCollection {#4798 …}
  +nested: Doctrine\ORM\PersistentCollection {#4800 …}
  +votes: Doctrine\ORM\PersistentCollection {#4802 …}
  +reports: Doctrine\ORM\PersistentCollection {#4804 …}
  +favourites: Doctrine\ORM\PersistentCollection {#4806 …}
  +notifications: Doctrine\ORM\PersistentCollection {#4808 …}
  -id: 159396
  -bodyTs: "'/)':10 '/posts/linux/desktop-linux-hardening/)':29 'articl':4,22 'desktop':24 'excel':12 'favorit':33 'found':5 'general':2 'guidanc':17 'harden':26 'linux':25 'motiv':19 'person':32 'privsec.dev':7,9,28 'privsec.dev/)':8 'privsec.dev/posts/linux/desktop-linux-hardening/)':27 'provid':15 'read':13"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.today/comment/3599849"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700849610 {#4793
    date: 2023-11-24 19:13:30.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
43 DENIED edit 
App\Entity\EntryComment {#4797
  +user: App\Entity\User {#4810 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: null
  +root: null
  +body: "In general, the articles found on [privsec.dev](https://privsec.dev/) are excellent reads and provide both guidance and motivation. With their article on [Desktop Linux Hardening](https://privsec.dev/posts/linux/desktop-linux-hardening/) being my personal favorite."
  +lang: "en"
  +isAdult: false
  +favouriteCount: 2
  +score: 0
  +lastActive: DateTime @1701395338 {#4792
    date: 2023-12-01 02:48:58.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
  ]
  +children: Doctrine\ORM\PersistentCollection {#4798 …}
  +nested: Doctrine\ORM\PersistentCollection {#4800 …}
  +votes: Doctrine\ORM\PersistentCollection {#4802 …}
  +reports: Doctrine\ORM\PersistentCollection {#4804 …}
  +favourites: Doctrine\ORM\PersistentCollection {#4806 …}
  +notifications: Doctrine\ORM\PersistentCollection {#4808 …}
  -id: 159396
  -bodyTs: "'/)':10 '/posts/linux/desktop-linux-hardening/)':29 'articl':4,22 'desktop':24 'excel':12 'favorit':33 'found':5 'general':2 'guidanc':17 'harden':26 'linux':25 'motiv':19 'person':32 'privsec.dev':7,9,28 'privsec.dev/)':8 'privsec.dev/posts/linux/desktop-linux-hardening/)':27 'provid':15 'read':13"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.today/comment/3599849"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700849610 {#4793
    date: 2023-11-24 19:13:30.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
44 DENIED moderate 
App\Entity\EntryComment {#4797
  +user: App\Entity\User {#4810 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: null
  +root: null
  +body: "In general, the articles found on [privsec.dev](https://privsec.dev/) are excellent reads and provide both guidance and motivation. With their article on [Desktop Linux Hardening](https://privsec.dev/posts/linux/desktop-linux-hardening/) being my personal favorite."
  +lang: "en"
  +isAdult: false
  +favouriteCount: 2
  +score: 0
  +lastActive: DateTime @1701395338 {#4792
    date: 2023-12-01 02:48:58.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
  ]
  +children: Doctrine\ORM\PersistentCollection {#4798 …}
  +nested: Doctrine\ORM\PersistentCollection {#4800 …}
  +votes: Doctrine\ORM\PersistentCollection {#4802 …}
  +reports: Doctrine\ORM\PersistentCollection {#4804 …}
  +favourites: Doctrine\ORM\PersistentCollection {#4806 …}
  +notifications: Doctrine\ORM\PersistentCollection {#4808 …}
  -id: 159396
  -bodyTs: "'/)':10 '/posts/linux/desktop-linux-hardening/)':29 'articl':4,22 'desktop':24 'excel':12 'favorit':33 'found':5 'general':2 'guidanc':17 'harden':26 'linux':25 'motiv':19 'person':32 'privsec.dev':7,9,28 'privsec.dev/)':8 'privsec.dev/posts/linux/desktop-linux-hardening/)':27 'provid':15 'read':13"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.today/comment/3599849"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700849610 {#4793
    date: 2023-11-24 19:13:30.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
45 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
46 DENIED moderate 
App\Entity\EntryComment {#5224
  +user: Proxies\__CG__\App\Entity\User {#1978 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: App\Entity\EntryComment {#4797
    +user: App\Entity\User {#4810 …}
    +entry: App\Entity\Entry {#2400}
    +magazine: App\Entity\Magazine {#265}
    +image: null
    +parent: null
    +root: null
    +body: "In general, the articles found on [privsec.dev](https://privsec.dev/) are excellent reads and provide both guidance and motivation. With their article on [Desktop Linux Hardening](https://privsec.dev/posts/linux/desktop-linux-hardening/) being my personal favorite."
    +lang: "en"
    +isAdult: false
    +favouriteCount: 2
    +score: 0
    +lastActive: DateTime @1701395338 {#4792
      date: 2023-12-01 02:48:58.0 +01:00
    }
    +ip: null
    +tags: null
    +mentions: [
      "@Pantherina@feddit.de"
    ]
    +children: Doctrine\ORM\PersistentCollection {#4798 …}
    +nested: Doctrine\ORM\PersistentCollection {#4800 …}
    +votes: Doctrine\ORM\PersistentCollection {#4802 …}
    +reports: Doctrine\ORM\PersistentCollection {#4804 …}
    +favourites: Doctrine\ORM\PersistentCollection {#4806 …}
    +notifications: Doctrine\ORM\PersistentCollection {#4808 …}
    -id: 159396
    -bodyTs: "'/)':10 '/posts/linux/desktop-linux-hardening/)':29 'articl':4,22 'desktop':24 'excel':12 'favorit':33 'found':5 'general':2 'guidanc':17 'harden':26 'linux':25 'motiv':19 'person':32 'privsec.dev':7,9,28 'privsec.dev/)':8 'privsec.dev/posts/linux/desktop-linux-hardening/)':27 'provid':15 'read':13"
    +ranking: 0
    +commentCount: 0
    +upVotes: 0
    +downVotes: 0
    +visibility: "visible             "
    +apId: "https://lemmy.today/comment/3599849"
    +editedAt: null
    +createdAt: DateTimeImmutable @1700849610 {#4793
      date: 2023-11-24 19:13:30.0 +01:00
    }
  }
  +root: App\Entity\EntryComment {#4797}
  +body: "Careful with MAC randomization in your local Wifi. DHCP goes brrrr"
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1700856644 {#5222
    date: 2023-11-24 21:10:44.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
    "@throwaway2@lemmy.today"
  ]
  +children: Doctrine\ORM\PersistentCollection {#5225 …}
  +nested: Doctrine\ORM\PersistentCollection {#5227 …}
  +votes: Doctrine\ORM\PersistentCollection {#5229 …}
  +reports: Doctrine\ORM\PersistentCollection {#5231 …}
  +favourites: Doctrine\ORM\PersistentCollection {#5233 …}
  +notifications: Doctrine\ORM\PersistentCollection {#5235 …}
  -id: 159779
  -bodyTs: "'brrrr':11 'care':1 'dhcp':9 'goe':10 'local':7 'mac':3 'random':4 'wifi':8"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://feddit.de/comment/5116345"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700856644 {#5223
    date: 2023-11-24 21:10:44.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
47 DENIED edit 
App\Entity\EntryComment {#5224
  +user: Proxies\__CG__\App\Entity\User {#1978 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: App\Entity\EntryComment {#4797
    +user: App\Entity\User {#4810 …}
    +entry: App\Entity\Entry {#2400}
    +magazine: App\Entity\Magazine {#265}
    +image: null
    +parent: null
    +root: null
    +body: "In general, the articles found on [privsec.dev](https://privsec.dev/) are excellent reads and provide both guidance and motivation. With their article on [Desktop Linux Hardening](https://privsec.dev/posts/linux/desktop-linux-hardening/) being my personal favorite."
    +lang: "en"
    +isAdult: false
    +favouriteCount: 2
    +score: 0
    +lastActive: DateTime @1701395338 {#4792
      date: 2023-12-01 02:48:58.0 +01:00
    }
    +ip: null
    +tags: null
    +mentions: [
      "@Pantherina@feddit.de"
    ]
    +children: Doctrine\ORM\PersistentCollection {#4798 …}
    +nested: Doctrine\ORM\PersistentCollection {#4800 …}
    +votes: Doctrine\ORM\PersistentCollection {#4802 …}
    +reports: Doctrine\ORM\PersistentCollection {#4804 …}
    +favourites: Doctrine\ORM\PersistentCollection {#4806 …}
    +notifications: Doctrine\ORM\PersistentCollection {#4808 …}
    -id: 159396
    -bodyTs: "'/)':10 '/posts/linux/desktop-linux-hardening/)':29 'articl':4,22 'desktop':24 'excel':12 'favorit':33 'found':5 'general':2 'guidanc':17 'harden':26 'linux':25 'motiv':19 'person':32 'privsec.dev':7,9,28 'privsec.dev/)':8 'privsec.dev/posts/linux/desktop-linux-hardening/)':27 'provid':15 'read':13"
    +ranking: 0
    +commentCount: 0
    +upVotes: 0
    +downVotes: 0
    +visibility: "visible             "
    +apId: "https://lemmy.today/comment/3599849"
    +editedAt: null
    +createdAt: DateTimeImmutable @1700849610 {#4793
      date: 2023-11-24 19:13:30.0 +01:00
    }
  }
  +root: App\Entity\EntryComment {#4797}
  +body: "Careful with MAC randomization in your local Wifi. DHCP goes brrrr"
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1700856644 {#5222
    date: 2023-11-24 21:10:44.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
    "@throwaway2@lemmy.today"
  ]
  +children: Doctrine\ORM\PersistentCollection {#5225 …}
  +nested: Doctrine\ORM\PersistentCollection {#5227 …}
  +votes: Doctrine\ORM\PersistentCollection {#5229 …}
  +reports: Doctrine\ORM\PersistentCollection {#5231 …}
  +favourites: Doctrine\ORM\PersistentCollection {#5233 …}
  +notifications: Doctrine\ORM\PersistentCollection {#5235 …}
  -id: 159779
  -bodyTs: "'brrrr':11 'care':1 'dhcp':9 'goe':10 'local':7 'mac':3 'random':4 'wifi':8"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://feddit.de/comment/5116345"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700856644 {#5223
    date: 2023-11-24 21:10:44.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
48 DENIED moderate 
App\Entity\EntryComment {#5224
  +user: Proxies\__CG__\App\Entity\User {#1978 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: App\Entity\EntryComment {#4797
    +user: App\Entity\User {#4810 …}
    +entry: App\Entity\Entry {#2400}
    +magazine: App\Entity\Magazine {#265}
    +image: null
    +parent: null
    +root: null
    +body: "In general, the articles found on [privsec.dev](https://privsec.dev/) are excellent reads and provide both guidance and motivation. With their article on [Desktop Linux Hardening](https://privsec.dev/posts/linux/desktop-linux-hardening/) being my personal favorite."
    +lang: "en"
    +isAdult: false
    +favouriteCount: 2
    +score: 0
    +lastActive: DateTime @1701395338 {#4792
      date: 2023-12-01 02:48:58.0 +01:00
    }
    +ip: null
    +tags: null
    +mentions: [
      "@Pantherina@feddit.de"
    ]
    +children: Doctrine\ORM\PersistentCollection {#4798 …}
    +nested: Doctrine\ORM\PersistentCollection {#4800 …}
    +votes: Doctrine\ORM\PersistentCollection {#4802 …}
    +reports: Doctrine\ORM\PersistentCollection {#4804 …}
    +favourites: Doctrine\ORM\PersistentCollection {#4806 …}
    +notifications: Doctrine\ORM\PersistentCollection {#4808 …}
    -id: 159396
    -bodyTs: "'/)':10 '/posts/linux/desktop-linux-hardening/)':29 'articl':4,22 'desktop':24 'excel':12 'favorit':33 'found':5 'general':2 'guidanc':17 'harden':26 'linux':25 'motiv':19 'person':32 'privsec.dev':7,9,28 'privsec.dev/)':8 'privsec.dev/posts/linux/desktop-linux-hardening/)':27 'provid':15 'read':13"
    +ranking: 0
    +commentCount: 0
    +upVotes: 0
    +downVotes: 0
    +visibility: "visible             "
    +apId: "https://lemmy.today/comment/3599849"
    +editedAt: null
    +createdAt: DateTimeImmutable @1700849610 {#4793
      date: 2023-11-24 19:13:30.0 +01:00
    }
  }
  +root: App\Entity\EntryComment {#4797}
  +body: "Careful with MAC randomization in your local Wifi. DHCP goes brrrr"
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1700856644 {#5222
    date: 2023-11-24 21:10:44.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
    "@throwaway2@lemmy.today"
  ]
  +children: Doctrine\ORM\PersistentCollection {#5225 …}
  +nested: Doctrine\ORM\PersistentCollection {#5227 …}
  +votes: Doctrine\ORM\PersistentCollection {#5229 …}
  +reports: Doctrine\ORM\PersistentCollection {#5231 …}
  +favourites: Doctrine\ORM\PersistentCollection {#5233 …}
  +notifications: Doctrine\ORM\PersistentCollection {#5235 …}
  -id: 159779
  -bodyTs: "'brrrr':11 'care':1 'dhcp':9 'goe':10 'local':7 'mac':3 'random':4 'wifi':8"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://feddit.de/comment/5116345"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700856644 {#5223
    date: 2023-11-24 21:10:44.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
49 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
50 DENIED moderate 
App\Entity\EntryComment {#4871
  +user: App\Entity\User {#4884 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: null
  +root: null
  +body: """
    Not a single mention of secure boot? Weird.\n
    \n
    I would say you are already secure enough if you are using software from official/trusted repositories and updating them on a regular basis.\n
    \n
    That said, if you want extra security. Drop all software that cannot run on Wayland and go even further by isolating all desktop applications with the Flatpak sandbox. This is made extremely easy with Flatseal. Maximum points if you setup secure boot.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 2
  +score: 0
  +lastActive: DateTime @1700898063 {#4865
    date: 2023-11-25 08:41:03.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
  ]
  +children: Doctrine\ORM\PersistentCollection {#4872 …}
  +nested: Doctrine\ORM\PersistentCollection {#4874 …}
  +votes: Doctrine\ORM\PersistentCollection {#4876 …}
  +reports: Doctrine\ORM\PersistentCollection {#4878 …}
  +favourites: Doctrine\ORM\PersistentCollection {#4880 …}
  +notifications: Doctrine\ORM\PersistentCollection {#4882 …}
  -id: 161623
  -bodyTs: "'alreadi':14 'applic':55 'basi':31 'boot':7,73 'cannot':43 'desktop':54 'drop':39 'easi':64 'enough':16 'even':49 'extra':37 'extrem':63 'flatpak':58 'flatseal':66 'go':48 'isol':52 'made':62 'maximum':67 'mention':4 'official/trusted':23 'point':68 'regular':30 'repositori':24 'run':44 'said':33 'sandbox':59 'say':11 'secur':6,15,38,72 'setup':71 'singl':3 'softwar':21,41 'updat':26 'use':20 'want':36 'wayland':46 'weird':8 'would':10"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.ml/comment/6103636"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700898063 {#4866
    date: 2023-11-25 08:41:03.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
51 DENIED edit 
App\Entity\EntryComment {#4871
  +user: App\Entity\User {#4884 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: null
  +root: null
  +body: """
    Not a single mention of secure boot? Weird.\n
    \n
    I would say you are already secure enough if you are using software from official/trusted repositories and updating them on a regular basis.\n
    \n
    That said, if you want extra security. Drop all software that cannot run on Wayland and go even further by isolating all desktop applications with the Flatpak sandbox. This is made extremely easy with Flatseal. Maximum points if you setup secure boot.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 2
  +score: 0
  +lastActive: DateTime @1700898063 {#4865
    date: 2023-11-25 08:41:03.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
  ]
  +children: Doctrine\ORM\PersistentCollection {#4872 …}
  +nested: Doctrine\ORM\PersistentCollection {#4874 …}
  +votes: Doctrine\ORM\PersistentCollection {#4876 …}
  +reports: Doctrine\ORM\PersistentCollection {#4878 …}
  +favourites: Doctrine\ORM\PersistentCollection {#4880 …}
  +notifications: Doctrine\ORM\PersistentCollection {#4882 …}
  -id: 161623
  -bodyTs: "'alreadi':14 'applic':55 'basi':31 'boot':7,73 'cannot':43 'desktop':54 'drop':39 'easi':64 'enough':16 'even':49 'extra':37 'extrem':63 'flatpak':58 'flatseal':66 'go':48 'isol':52 'made':62 'maximum':67 'mention':4 'official/trusted':23 'point':68 'regular':30 'repositori':24 'run':44 'said':33 'sandbox':59 'say':11 'secur':6,15,38,72 'setup':71 'singl':3 'softwar':21,41 'updat':26 'use':20 'want':36 'wayland':46 'weird':8 'would':10"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.ml/comment/6103636"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700898063 {#4866
    date: 2023-11-25 08:41:03.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
52 DENIED moderate 
App\Entity\EntryComment {#4871
  +user: App\Entity\User {#4884 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: null
  +root: null
  +body: """
    Not a single mention of secure boot? Weird.\n
    \n
    I would say you are already secure enough if you are using software from official/trusted repositories and updating them on a regular basis.\n
    \n
    That said, if you want extra security. Drop all software that cannot run on Wayland and go even further by isolating all desktop applications with the Flatpak sandbox. This is made extremely easy with Flatseal. Maximum points if you setup secure boot.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 2
  +score: 0
  +lastActive: DateTime @1700898063 {#4865
    date: 2023-11-25 08:41:03.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
  ]
  +children: Doctrine\ORM\PersistentCollection {#4872 …}
  +nested: Doctrine\ORM\PersistentCollection {#4874 …}
  +votes: Doctrine\ORM\PersistentCollection {#4876 …}
  +reports: Doctrine\ORM\PersistentCollection {#4878 …}
  +favourites: Doctrine\ORM\PersistentCollection {#4880 …}
  +notifications: Doctrine\ORM\PersistentCollection {#4882 …}
  -id: 161623
  -bodyTs: "'alreadi':14 'applic':55 'basi':31 'boot':7,73 'cannot':43 'desktop':54 'drop':39 'easi':64 'enough':16 'even':49 'extra':37 'extrem':63 'flatpak':58 'flatseal':66 'go':48 'isol':52 'made':62 'maximum':67 'mention':4 'official/trusted':23 'point':68 'regular':30 'repositori':24 'run':44 'said':33 'sandbox':59 'say':11 'secur':6,15,38,72 'setup':71 'singl':3 'softwar':21,41 'updat':26 'use':20 'want':36 'wayland':46 'weird':8 'would':10"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.ml/comment/6103636"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700898063 {#4866
    date: 2023-11-25 08:41:03.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
53 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
54 DENIED moderate 
App\Entity\EntryComment {#4945
  +user: App\Entity\User {#4958 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: null
  +root: null
  +body: """
    I don’t agree with avoiding stable distros. In the case of Debian for example stable gets priority on security patches. Just subscribe to the security mailing list and have auto updates on.\n
    \n
    Also download any disto or bleeding edge container and scan it and you’ll have vulnerabilities in some library. The ecosystem is always moving. The question is how exposed are you.\n
    \n
    Use a firewall, secure your browser and whitelist sites you trust to run JS. Stick to repos. Scan downloaded files via virus total or open In a vm. Dont install what you dont need.\n
    \n
    You are far more likely to get compromised in a site breach than to get hacked. The browser is the main attack vector that you need to secure.\n
    \n
    Also dont run servers if you dont know what you are doing. Use a non networked VM to practice.\n
    \n
    Dont blindly paste commands and be sure to read the source before you compile and run some random program.\n
    \n
    Watch out for rogue containers and libraries .
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 9
  +score: 0
  +lastActive: DateTime @1700851663 {#4939
    date: 2023-11-24 19:47:43.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
  ]
  +children: Doctrine\ORM\PersistentCollection {#4946 …}
  +nested: Doctrine\ORM\PersistentCollection {#4948 …}
  +votes: Doctrine\ORM\PersistentCollection {#4950 …}
  +reports: Doctrine\ORM\PersistentCollection {#4952 …}
  +favourites: Doctrine\ORM\PersistentCollection {#4954 …}
  +notifications: Doctrine\ORM\PersistentCollection {#4956 …}
  -id: 159508
  -bodyTs: "'agre':4 'also':34,127 'alway':56 'attack':120 'auto':31 'avoid':6 'bleed':39 'blind':147 'breach':110 'browser':70,116 'case':11 'command':149 'compil':159 'compromis':106 'contain':41,169 'debian':13 'disto':37 'distro':8 'dont':93,97,128,133,146 'download':35,83 'ecosystem':54 'edg':40 'exampl':15 'expos':62 'far':101 'file':84 'firewal':67 'get':17,105,113 'hack':114 'instal':94 'js':78 'know':134 'librari':52,171 'like':103 'list':28 'll':47 'mail':27 'main':119 'move':57 'need':98,124 'network':142 'non':141 'open':89 'past':148 'patch':21 'practic':145 'prioriti':18 'program':164 'question':59 'random':163 'read':154 'repo':81 'rogu':168 'run':77,129,161 'scan':43,82 'secur':20,26,68,126 'server':130 'site':73,109 'sourc':156 'stabl':7,16 'stick':79 'subscrib':23 'sure':152 'total':87 'trust':75 'updat':32 'use':65,139 'vector':121 'via':85 'virus':86 'vm':92,143 'vulner':49 'watch':165 'whitelist':72"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/5554988"
  +editedAt: DateTimeImmutable @1701403267 {#4940
    date: 2023-12-01 05:01:07.0 +01:00
  }
  +createdAt: DateTimeImmutable @1700851663 {#4941
    date: 2023-11-24 19:47:43.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
55 DENIED edit 
App\Entity\EntryComment {#4945
  +user: App\Entity\User {#4958 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: null
  +root: null
  +body: """
    I don’t agree with avoiding stable distros. In the case of Debian for example stable gets priority on security patches. Just subscribe to the security mailing list and have auto updates on.\n
    \n
    Also download any disto or bleeding edge container and scan it and you’ll have vulnerabilities in some library. The ecosystem is always moving. The question is how exposed are you.\n
    \n
    Use a firewall, secure your browser and whitelist sites you trust to run JS. Stick to repos. Scan downloaded files via virus total or open In a vm. Dont install what you dont need.\n
    \n
    You are far more likely to get compromised in a site breach than to get hacked. The browser is the main attack vector that you need to secure.\n
    \n
    Also dont run servers if you dont know what you are doing. Use a non networked VM to practice.\n
    \n
    Dont blindly paste commands and be sure to read the source before you compile and run some random program.\n
    \n
    Watch out for rogue containers and libraries .
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 9
  +score: 0
  +lastActive: DateTime @1700851663 {#4939
    date: 2023-11-24 19:47:43.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
  ]
  +children: Doctrine\ORM\PersistentCollection {#4946 …}
  +nested: Doctrine\ORM\PersistentCollection {#4948 …}
  +votes: Doctrine\ORM\PersistentCollection {#4950 …}
  +reports: Doctrine\ORM\PersistentCollection {#4952 …}
  +favourites: Doctrine\ORM\PersistentCollection {#4954 …}
  +notifications: Doctrine\ORM\PersistentCollection {#4956 …}
  -id: 159508
  -bodyTs: "'agre':4 'also':34,127 'alway':56 'attack':120 'auto':31 'avoid':6 'bleed':39 'blind':147 'breach':110 'browser':70,116 'case':11 'command':149 'compil':159 'compromis':106 'contain':41,169 'debian':13 'disto':37 'distro':8 'dont':93,97,128,133,146 'download':35,83 'ecosystem':54 'edg':40 'exampl':15 'expos':62 'far':101 'file':84 'firewal':67 'get':17,105,113 'hack':114 'instal':94 'js':78 'know':134 'librari':52,171 'like':103 'list':28 'll':47 'mail':27 'main':119 'move':57 'need':98,124 'network':142 'non':141 'open':89 'past':148 'patch':21 'practic':145 'prioriti':18 'program':164 'question':59 'random':163 'read':154 'repo':81 'rogu':168 'run':77,129,161 'scan':43,82 'secur':20,26,68,126 'server':130 'site':73,109 'sourc':156 'stabl':7,16 'stick':79 'subscrib':23 'sure':152 'total':87 'trust':75 'updat':32 'use':65,139 'vector':121 'via':85 'virus':86 'vm':92,143 'vulner':49 'watch':165 'whitelist':72"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/5554988"
  +editedAt: DateTimeImmutable @1701403267 {#4940
    date: 2023-12-01 05:01:07.0 +01:00
  }
  +createdAt: DateTimeImmutable @1700851663 {#4941
    date: 2023-11-24 19:47:43.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
56 DENIED moderate 
App\Entity\EntryComment {#4945
  +user: App\Entity\User {#4958 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: null
  +root: null
  +body: """
    I don’t agree with avoiding stable distros. In the case of Debian for example stable gets priority on security patches. Just subscribe to the security mailing list and have auto updates on.\n
    \n
    Also download any disto or bleeding edge container and scan it and you’ll have vulnerabilities in some library. The ecosystem is always moving. The question is how exposed are you.\n
    \n
    Use a firewall, secure your browser and whitelist sites you trust to run JS. Stick to repos. Scan downloaded files via virus total or open In a vm. Dont install what you dont need.\n
    \n
    You are far more likely to get compromised in a site breach than to get hacked. The browser is the main attack vector that you need to secure.\n
    \n
    Also dont run servers if you dont know what you are doing. Use a non networked VM to practice.\n
    \n
    Dont blindly paste commands and be sure to read the source before you compile and run some random program.\n
    \n
    Watch out for rogue containers and libraries .
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 9
  +score: 0
  +lastActive: DateTime @1700851663 {#4939
    date: 2023-11-24 19:47:43.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
  ]
  +children: Doctrine\ORM\PersistentCollection {#4946 …}
  +nested: Doctrine\ORM\PersistentCollection {#4948 …}
  +votes: Doctrine\ORM\PersistentCollection {#4950 …}
  +reports: Doctrine\ORM\PersistentCollection {#4952 …}
  +favourites: Doctrine\ORM\PersistentCollection {#4954 …}
  +notifications: Doctrine\ORM\PersistentCollection {#4956 …}
  -id: 159508
  -bodyTs: "'agre':4 'also':34,127 'alway':56 'attack':120 'auto':31 'avoid':6 'bleed':39 'blind':147 'breach':110 'browser':70,116 'case':11 'command':149 'compil':159 'compromis':106 'contain':41,169 'debian':13 'disto':37 'distro':8 'dont':93,97,128,133,146 'download':35,83 'ecosystem':54 'edg':40 'exampl':15 'expos':62 'far':101 'file':84 'firewal':67 'get':17,105,113 'hack':114 'instal':94 'js':78 'know':134 'librari':52,171 'like':103 'list':28 'll':47 'mail':27 'main':119 'move':57 'need':98,124 'network':142 'non':141 'open':89 'past':148 'patch':21 'practic':145 'prioriti':18 'program':164 'question':59 'random':163 'read':154 'repo':81 'rogu':168 'run':77,129,161 'scan':43,82 'secur':20,26,68,126 'server':130 'site':73,109 'sourc':156 'stabl':7,16 'stick':79 'subscrib':23 'sure':152 'total':87 'trust':75 'updat':32 'use':65,139 'vector':121 'via':85 'virus':86 'vm':92,143 'vulner':49 'watch':165 'whitelist':72"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/5554988"
  +editedAt: DateTimeImmutable @1701403267 {#4940
    date: 2023-12-01 05:01:07.0 +01:00
  }
  +createdAt: DateTimeImmutable @1700851663 {#4941
    date: 2023-11-24 19:47:43.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
57 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
58 DENIED moderate 
App\Entity\EntryComment {#5019
  +user: App\Entity\User {#5032 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: null
  +root: null
  +body: "Great List. I’m not to much into security so I can’t add anything"
  +lang: "en"
  +isAdult: false
  +favouriteCount: 1
  +score: 0
  +lastActive: DateTime @1700844713 {#5014
    date: 2023-11-24 17:51:53.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
  ]
  +children: Doctrine\ORM\PersistentCollection {#5020 …}
  +nested: Doctrine\ORM\PersistentCollection {#5022 …}
  +votes: Doctrine\ORM\PersistentCollection {#5024 …}
  +reports: Doctrine\ORM\PersistentCollection {#5026 …}
  +favourites: Doctrine\ORM\PersistentCollection {#5028 …}
  +notifications: Doctrine\ORM\PersistentCollection {#5030 …}
  -id: 159119
  -bodyTs: "'add':14 'anyth':15 'great':1 'list':2 'm':4 'much':7 'secur':9"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://feddit.de/comment/5110654"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700844713 {#5015
    date: 2023-11-24 17:51:53.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
59 DENIED edit 
App\Entity\EntryComment {#5019
  +user: App\Entity\User {#5032 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: null
  +root: null
  +body: "Great List. I’m not to much into security so I can’t add anything"
  +lang: "en"
  +isAdult: false
  +favouriteCount: 1
  +score: 0
  +lastActive: DateTime @1700844713 {#5014
    date: 2023-11-24 17:51:53.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
  ]
  +children: Doctrine\ORM\PersistentCollection {#5020 …}
  +nested: Doctrine\ORM\PersistentCollection {#5022 …}
  +votes: Doctrine\ORM\PersistentCollection {#5024 …}
  +reports: Doctrine\ORM\PersistentCollection {#5026 …}
  +favourites: Doctrine\ORM\PersistentCollection {#5028 …}
  +notifications: Doctrine\ORM\PersistentCollection {#5030 …}
  -id: 159119
  -bodyTs: "'add':14 'anyth':15 'great':1 'list':2 'm':4 'much':7 'secur':9"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://feddit.de/comment/5110654"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700844713 {#5015
    date: 2023-11-24 17:51:53.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
60 DENIED moderate 
App\Entity\EntryComment {#5019
  +user: App\Entity\User {#5032 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: null
  +root: null
  +body: "Great List. I’m not to much into security so I can’t add anything"
  +lang: "en"
  +isAdult: false
  +favouriteCount: 1
  +score: 0
  +lastActive: DateTime @1700844713 {#5014
    date: 2023-11-24 17:51:53.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
  ]
  +children: Doctrine\ORM\PersistentCollection {#5020 …}
  +nested: Doctrine\ORM\PersistentCollection {#5022 …}
  +votes: Doctrine\ORM\PersistentCollection {#5024 …}
  +reports: Doctrine\ORM\PersistentCollection {#5026 …}
  +favourites: Doctrine\ORM\PersistentCollection {#5028 …}
  +notifications: Doctrine\ORM\PersistentCollection {#5030 …}
  -id: 159119
  -bodyTs: "'add':14 'anyth':15 'great':1 'list':2 'm':4 'much':7 'secur':9"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://feddit.de/comment/5110654"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700844713 {#5015
    date: 2023-11-24 17:51:53.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
61 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
62 DENIED moderate 
App\Entity\EntryComment {#5092
  +user: App\Entity\User {#5105 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: null
  +root: null
  +body: "Eh, I don’t have anything “complex” to add, other than buying a raspberry pi and using it as a DNS sinkhole/recursive dns under docker/ipvlan network, and then “hiding” it behind a macvlan connection + ufw. Been doing this over several years and never had any problems with it. You can even use it as a music player of sorts by configuring a hotkey to bring up mpv with a playlist, and another one to close it. Oh, and even as a “live stream player 24/7” if you are into it."
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1700842891 {#5087
    date: 2023-11-24 17:21:31.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
  ]
  +children: Doctrine\ORM\PersistentCollection {#5093 …}
  +nested: Doctrine\ORM\PersistentCollection {#5095 …}
  +votes: Doctrine\ORM\PersistentCollection {#5097 …}
  +reports: Doctrine\ORM\PersistentCollection {#5099 …}
  +favourites: Doctrine\ORM\PersistentCollection {#5101 …}
  +notifications: Doctrine\ORM\PersistentCollection {#5103 …}
  -id: 159030
  -bodyTs: "'24/7':85 'add':9 'anoth':72 'anyth':6 'behind':31 'bring':65 'buy':12 'close':75 'complex':7 'configur':61 'connect':34 'dns':21,23 'docker/ipvlan':25 'eh':1 'even':51,79 'hide':29 'hotkey':63 'live':82 'macvlan':33 'mpv':67 'music':56 'network':26 'never':43 'oh':77 'one':73 'pi':15 'player':57,84 'playlist':70 'problem':46 'raspberri':14 'sever':40 'sinkhole/recursive':22 'sort':59 'stream':83 'ufw':35 'use':17,52 'year':41"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/5552128"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700842891 {#5088
    date: 2023-11-24 17:21:31.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
63 DENIED edit 
App\Entity\EntryComment {#5092
  +user: App\Entity\User {#5105 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: null
  +root: null
  +body: "Eh, I don’t have anything “complex” to add, other than buying a raspberry pi and using it as a DNS sinkhole/recursive dns under docker/ipvlan network, and then “hiding” it behind a macvlan connection + ufw. Been doing this over several years and never had any problems with it. You can even use it as a music player of sorts by configuring a hotkey to bring up mpv with a playlist, and another one to close it. Oh, and even as a “live stream player 24/7” if you are into it."
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1700842891 {#5087
    date: 2023-11-24 17:21:31.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
  ]
  +children: Doctrine\ORM\PersistentCollection {#5093 …}
  +nested: Doctrine\ORM\PersistentCollection {#5095 …}
  +votes: Doctrine\ORM\PersistentCollection {#5097 …}
  +reports: Doctrine\ORM\PersistentCollection {#5099 …}
  +favourites: Doctrine\ORM\PersistentCollection {#5101 …}
  +notifications: Doctrine\ORM\PersistentCollection {#5103 …}
  -id: 159030
  -bodyTs: "'24/7':85 'add':9 'anoth':72 'anyth':6 'behind':31 'bring':65 'buy':12 'close':75 'complex':7 'configur':61 'connect':34 'dns':21,23 'docker/ipvlan':25 'eh':1 'even':51,79 'hide':29 'hotkey':63 'live':82 'macvlan':33 'mpv':67 'music':56 'network':26 'never':43 'oh':77 'one':73 'pi':15 'player':57,84 'playlist':70 'problem':46 'raspberri':14 'sever':40 'sinkhole/recursive':22 'sort':59 'stream':83 'ufw':35 'use':17,52 'year':41"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/5552128"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700842891 {#5088
    date: 2023-11-24 17:21:31.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
64 DENIED moderate 
App\Entity\EntryComment {#5092
  +user: App\Entity\User {#5105 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978 …}
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +magazine: App\Entity\Magazine {#265}
  +image: null
  +parent: null
  +root: null
  +body: "Eh, I don’t have anything “complex” to add, other than buying a raspberry pi and using it as a DNS sinkhole/recursive dns under docker/ipvlan network, and then “hiding” it behind a macvlan connection + ufw. Been doing this over several years and never had any problems with it. You can even use it as a music player of sorts by configuring a hotkey to bring up mpv with a playlist, and another one to close it. Oh, and even as a “live stream player 24/7” if you are into it."
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1700842891 {#5087
    date: 2023-11-24 17:21:31.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Pantherina@feddit.de"
  ]
  +children: Doctrine\ORM\PersistentCollection {#5093 …}
  +nested: Doctrine\ORM\PersistentCollection {#5095 …}
  +votes: Doctrine\ORM\PersistentCollection {#5097 …}
  +reports: Doctrine\ORM\PersistentCollection {#5099 …}
  +favourites: Doctrine\ORM\PersistentCollection {#5101 …}
  +notifications: Doctrine\ORM\PersistentCollection {#5103 …}
  -id: 159030
  -bodyTs: "'24/7':85 'add':9 'anoth':72 'anyth':6 'behind':31 'bring':65 'buy':12 'close':75 'complex':7 'configur':61 'connect':34 'dns':21,23 'docker/ipvlan':25 'eh':1 'even':51,79 'hide':29 'hotkey':63 'live':82 'macvlan':33 'mpv':67 'music':56 'network':26 'never':43 'oh':77 'one':73 'pi':15 'player':57,84 'playlist':70 'problem':46 'raspberri':14 'sever':40 'sinkhole/recursive':22 'sort':59 'stream':83 'ufw':35 'use':17,52 'year':41"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/5552128"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700842891 {#5088
    date: 2023-11-24 17:21:31.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
65 DENIED edit 
App\Entity\Magazine {#265
  +icon: Proxies\__CG__\App\Entity\Image {#246 …}
  +name: "linux@lemmy.ml"
  +title: "linux"
  +description: """
    From Wikipedia, the free encyclopedia\n
    \n
    Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
    \n
    Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
    \n
    ### Rules\n
    \n
    - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
    - No misinformation\n
    - No NSFW content\n
    - No hate speech, bigotry, etc\n
    \n
    ### Related Communities\n
    \n
    - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
    - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
    - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
    - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
    \n
    Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
    """
  +rules: null
  +subscriptionsCount: 1
  +entryCount: 1406
  +entryCommentCount: 28632
  +postCount: 6
  +postCommentCount: 214
  +isAdult: false
  +customCss: null
  +lastActive: DateTime @1729583542 {#275
    date: 2024-10-22 09:52:22.0 +02:00
  }
  +markedForDeletionAt: null
  +tags: null
  +moderators: Doctrine\ORM\PersistentCollection {#237 …}
  +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
  +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
  +entries: Doctrine\ORM\PersistentCollection {#180 …}
  +posts: Doctrine\ORM\PersistentCollection {#138 …}
  +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
  +bans: Doctrine\ORM\PersistentCollection {#117 …}
  +reports: Doctrine\ORM\PersistentCollection {#103 …}
  +badges: Doctrine\ORM\PersistentCollection {#81 …}
  +logs: Doctrine\ORM\PersistentCollection {#71 …}
  +awards: Doctrine\ORM\PersistentCollection {#1346 …}
  +categories: Doctrine\ORM\PersistentCollection {#1823 …}
  -id: 73
  +apId: "linux@lemmy.ml"
  +apProfileId: "https://lemmy.ml/c/linux"
  +apPublicUrl: "https://lemmy.ml/c/linux"
  +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
  +apInboxUrl: "https://lemmy.ml/inbox"
  +apDomain: "lemmy.ml"
  +apPreferredUsername: "linux"
  +apDiscoverable: true
  +apManuallyApprovesFollowers: null
  +privateKey: null
  +publicKey: null
  +apFetchedAt: DateTime @1729583596 {#269
    date: 2024-10-22 09:53:16.0 +02:00
  }
  +apDeletedAt: null
  +apTimeoutAt: null
  +visibility: "visible             "
  +createdAt: DateTimeImmutable @1698929468 {#271
    date: 2023-11-02 13:51:08.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS DENIED 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details