Symfony Profiler

[
  "entry" => App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978
      +avatar: null
      +cover: null
      +email: "Pantherina@feddit.de"
      +username: "@Pantherina@feddit.de"
      +roles: []
      +followersCount: 0
      +homepage: "front"
      +about: null
      +lastActive: DateTime @1721498243 {#1515
        date: 2024-07-20 19:57:23.0 +02:00
      }
      +markedForDeletionAt: null
      +fields: null
      +oauthGithubId: null
      +oauthGoogleId: null
      +oauthFacebookId: null
      +oauthKeycloakId: null
      +hideAdult: true
      +showSubscribedUsers: true
      +showSubscribedMagazines: true
      +showSubscribedDomains: true
      +preferredLanguages: []
      +featuredMagazines: null
      +showProfileSubscriptions: false
      +showProfileFollowings: true
      +markNewComments: false
      +notifyOnNewEntry: false
      +notifyOnNewEntryReply: true
      +notifyOnNewEntryCommentReply: true
      +notifyOnNewPost: false
      +notifyOnNewPostReply: true
      +notifyOnNewPostCommentReply: true
      +addMentionsEntries: false
      +addMentionsPosts: true
      +isBanned: false
      +isVerified: false
      +isDeleted: false
      +isBot: false
      +spamProtection: true
      +customCss: null
      +ignoreMagazinesCustomCss: false
      +moderatorTokens: Doctrine\ORM\PersistentCollection {#1519 …}
      +magazineOwnershipRequests: Doctrine\ORM\PersistentCollection {#1517 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#1623 …}
      +entries: Doctrine\ORM\PersistentCollection {#1406 …}
      +entryVotes: Doctrine\ORM\PersistentCollection {#1713 …}
      +entryComments: Doctrine\ORM\PersistentCollection {#1710 …}
      +entryCommentVotes: Doctrine\ORM\PersistentCollection {#1474 …}
      +posts: Doctrine\ORM\PersistentCollection {#1745 …}
      +postVotes: Doctrine\ORM\PersistentCollection {#1485 …}
      +postComments: Doctrine\ORM\PersistentCollection {#1759 …}
      +postCommentVotes: Doctrine\ORM\PersistentCollection {#1637 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#1475 …}
      +subscribedDomains: Doctrine\ORM\PersistentCollection {#1636 …}
      +follows: Doctrine\ORM\PersistentCollection {#1409 …}
      +followers: Doctrine\ORM\PersistentCollection {#1624 …}
      +blocks: Doctrine\ORM\PersistentCollection {#1425 …}
      +blockers: Doctrine\ORM\PersistentCollection {#1441 …}
      +blockedMagazines: Doctrine\ORM\PersistentCollection {#1460 …}
      +blockedDomains: Doctrine\ORM\PersistentCollection {#1439 …}
      +reports: Doctrine\ORM\PersistentCollection {#1416 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1430 …}
      +violations: Doctrine\ORM\PersistentCollection {#1694 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1700 …}
      +awards: Doctrine\ORM\PersistentCollection {#1434 …}
      +subscribedCategories: Doctrine\ORM\PersistentCollection {#1610 …}
      +categories: Doctrine\ORM\PersistentCollection {#1640 …}
      -id: 48318
      -password: "$2y$13$ltFqzTJ0eHIMY8NTIUV0JOoX1AZlaj64ntUxYh5oQTJrg6.lxQmuC"
      -totpSecret: null
      -totpBackupCodes: []
      -oAuth2UserConsents: Doctrine\ORM\PersistentCollection {#1669 …}
      +apId: "Pantherina@feddit.de"
      +apProfileId: "https://feddit.de/u/Pantherina"
      +apPublicUrl: "https://feddit.de/u/Pantherina"
      +apFollowersUrl: null
      +apInboxUrl: "https://feddit.de/inbox"
      +apDomain: "feddit.de"
      +apPreferredUsername: "Pantherina"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: false
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1721236644 {#1516
        date: 2024-07-17 19:17:24.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1696428300 {#1518
        date: 2023-10-04 16:05:00.0 +02:00
      }
      +__isInitialized__: true
       …2
    }
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  "isSingle" => true
  "showShortSentence" => false
  "showBody" => true
]

[
  "class" => "entry--single section--top"
]

App\Twig\Components\EntryComponent {#2955
  -authorizationChecker: Symfony\Component\Security\Core\Authorization\AuthorizationChecker {#931 …}
  -newCommentMarkerCount: App\Kbin\NewCommentMarker\NewCommentMarkerCount {#2956 …}
  -cache: Symfony\Component\Cache\Adapter\TraceableTagAwareAdapter {#600 …}
  -twig: Twig\Environment {#1252 …}
  -requestStack: Symfony\Component\HttpFoundation\RequestStack {#1328 …}
  -security: Symfony\Bundle\SecurityBundle\Security {#1101 …}
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978
      +avatar: null
      +cover: null
      +email: "Pantherina@feddit.de"
      +username: "@Pantherina@feddit.de"
      +roles: []
      +followersCount: 0
      +homepage: "front"
      +about: null
      +lastActive: DateTime @1721498243 {#1515
        date: 2024-07-20 19:57:23.0 +02:00
      }
      +markedForDeletionAt: null
      +fields: null
      +oauthGithubId: null
      +oauthGoogleId: null
      +oauthFacebookId: null
      +oauthKeycloakId: null
      +hideAdult: true
      +showSubscribedUsers: true
      +showSubscribedMagazines: true
      +showSubscribedDomains: true
      +preferredLanguages: []
      +featuredMagazines: null
      +showProfileSubscriptions: false
      +showProfileFollowings: true
      +markNewComments: false
      +notifyOnNewEntry: false
      +notifyOnNewEntryReply: true
      +notifyOnNewEntryCommentReply: true
      +notifyOnNewPost: false
      +notifyOnNewPostReply: true
      +notifyOnNewPostCommentReply: true
      +addMentionsEntries: false
      +addMentionsPosts: true
      +isBanned: false
      +isVerified: false
      +isDeleted: false
      +isBot: false
      +spamProtection: true
      +customCss: null
      +ignoreMagazinesCustomCss: false
      +moderatorTokens: Doctrine\ORM\PersistentCollection {#1519 …}
      +magazineOwnershipRequests: Doctrine\ORM\PersistentCollection {#1517 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#1623 …}
      +entries: Doctrine\ORM\PersistentCollection {#1406 …}
      +entryVotes: Doctrine\ORM\PersistentCollection {#1713 …}
      +entryComments: Doctrine\ORM\PersistentCollection {#1710 …}
      +entryCommentVotes: Doctrine\ORM\PersistentCollection {#1474 …}
      +posts: Doctrine\ORM\PersistentCollection {#1745 …}
      +postVotes: Doctrine\ORM\PersistentCollection {#1485 …}
      +postComments: Doctrine\ORM\PersistentCollection {#1759 …}
      +postCommentVotes: Doctrine\ORM\PersistentCollection {#1637 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#1475 …}
      +subscribedDomains: Doctrine\ORM\PersistentCollection {#1636 …}
      +follows: Doctrine\ORM\PersistentCollection {#1409 …}
      +followers: Doctrine\ORM\PersistentCollection {#1624 …}
      +blocks: Doctrine\ORM\PersistentCollection {#1425 …}
      +blockers: Doctrine\ORM\PersistentCollection {#1441 …}
      +blockedMagazines: Doctrine\ORM\PersistentCollection {#1460 …}
      +blockedDomains: Doctrine\ORM\PersistentCollection {#1439 …}
      +reports: Doctrine\ORM\PersistentCollection {#1416 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1430 …}
      +violations: Doctrine\ORM\PersistentCollection {#1694 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1700 …}
      +awards: Doctrine\ORM\PersistentCollection {#1434 …}
      +subscribedCategories: Doctrine\ORM\PersistentCollection {#1610 …}
      +categories: Doctrine\ORM\PersistentCollection {#1640 …}
      -id: 48318
      -password: "$2y$13$ltFqzTJ0eHIMY8NTIUV0JOoX1AZlaj64ntUxYh5oQTJrg6.lxQmuC"
      -totpSecret: null
      -totpBackupCodes: []
      -oAuth2UserConsents: Doctrine\ORM\PersistentCollection {#1669 …}
      +apId: "Pantherina@feddit.de"
      +apProfileId: "https://feddit.de/u/Pantherina"
      +apPublicUrl: "https://feddit.de/u/Pantherina"
      +apFollowersUrl: null
      +apInboxUrl: "https://feddit.de/inbox"
      +apDomain: "feddit.de"
      +apPreferredUsername: "Pantherina"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: false
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1721236644 {#1516
        date: 2024-07-17 19:17:24.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1696428300 {#1518
        date: 2023-10-04 16:05:00.0 +02:00
      }
      +__isInitialized__: true
       …2
    }
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +isSingle: true
  +showShortSentence: false
  +showBody: true
  +showMagazineName: false
  +canSeeTrash: false
  +newComments: 0
}

[
  "user" => Proxies\__CG__\App\Entity\User {#1978
    +avatar: null
    +cover: null
    +email: "Pantherina@feddit.de"
    +username: "@Pantherina@feddit.de"
    +roles: []
    +followersCount: 0
    +homepage: "front"
    +about: null
    +lastActive: DateTime @1721498243 {#1515
      date: 2024-07-20 19:57:23.0 +02:00
    }
    +markedForDeletionAt: null
    +fields: null
    +oauthGithubId: null
    +oauthGoogleId: null
    +oauthFacebookId: null
    +oauthKeycloakId: null
    +hideAdult: true
    +showSubscribedUsers: true
    +showSubscribedMagazines: true
    +showSubscribedDomains: true
    +preferredLanguages: []
    +featuredMagazines: null
    +showProfileSubscriptions: false
    +showProfileFollowings: true
    +markNewComments: false
    +notifyOnNewEntry: false
    +notifyOnNewEntryReply: true
    +notifyOnNewEntryCommentReply: true
    +notifyOnNewPost: false
    +notifyOnNewPostReply: true
    +notifyOnNewPostCommentReply: true
    +addMentionsEntries: false
    +addMentionsPosts: true
    +isBanned: false
    +isVerified: false
    +isDeleted: false
    +isBot: false
    +spamProtection: true
    +customCss: null
    +ignoreMagazinesCustomCss: false
    +moderatorTokens: Doctrine\ORM\PersistentCollection {#1519 …}
    +magazineOwnershipRequests: Doctrine\ORM\PersistentCollection {#1517 …}
    +moderatorRequests: Doctrine\ORM\PersistentCollection {#1623 …}
    +entries: Doctrine\ORM\PersistentCollection {#1406 …}
    +entryVotes: Doctrine\ORM\PersistentCollection {#1713 …}
    +entryComments: Doctrine\ORM\PersistentCollection {#1710 …}
    +entryCommentVotes: Doctrine\ORM\PersistentCollection {#1474 …}
    +posts: Doctrine\ORM\PersistentCollection {#1745 …}
    +postVotes: Doctrine\ORM\PersistentCollection {#1485 …}
    +postComments: Doctrine\ORM\PersistentCollection {#1759 …}
    +postCommentVotes: Doctrine\ORM\PersistentCollection {#1637 …}
    +subscriptions: Doctrine\ORM\PersistentCollection {#1475 …}
    +subscribedDomains: Doctrine\ORM\PersistentCollection {#1636 …}
    +follows: Doctrine\ORM\PersistentCollection {#1409 …}
    +followers: Doctrine\ORM\PersistentCollection {#1624 …}
    +blocks: Doctrine\ORM\PersistentCollection {#1425 …}
    +blockers: Doctrine\ORM\PersistentCollection {#1441 …}
    +blockedMagazines: Doctrine\ORM\PersistentCollection {#1460 …}
    +blockedDomains: Doctrine\ORM\PersistentCollection {#1439 …}
    +reports: Doctrine\ORM\PersistentCollection {#1416 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1430 …}
    +violations: Doctrine\ORM\PersistentCollection {#1694 …}
    +notifications: Doctrine\ORM\PersistentCollection {#1700 …}
    +awards: Doctrine\ORM\PersistentCollection {#1434 …}
    +subscribedCategories: Doctrine\ORM\PersistentCollection {#1610 …}
    +categories: Doctrine\ORM\PersistentCollection {#1640 …}
    -id: 48318
    -password: "$2y$13$ltFqzTJ0eHIMY8NTIUV0JOoX1AZlaj64ntUxYh5oQTJrg6.lxQmuC"
    -totpSecret: null
    -totpBackupCodes: []
    -oAuth2UserConsents: Doctrine\ORM\PersistentCollection {#1669 …}
    +apId: "Pantherina@feddit.de"
    +apProfileId: "https://feddit.de/u/Pantherina"
    +apPublicUrl: "https://feddit.de/u/Pantherina"
    +apFollowersUrl: null
    +apInboxUrl: "https://feddit.de/inbox"
    +apDomain: "feddit.de"
    +apPreferredUsername: "Pantherina"
    +apDiscoverable: true
    +apManuallyApprovesFollowers: false
    +privateKey: null
    +publicKey: null
    +apFetchedAt: DateTime @1721236644 {#1516
      date: 2024-07-17 19:17:24.0 +02:00
    }
    +apDeletedAt: null
    +apTimeoutAt: null
    +visibility: "visible             "
    +createdAt: DateTimeImmutable @1696428300 {#1518
      date: 2023-10-04 16:05:00.0 +02:00
    }
    +__isInitialized__: true
     …2
  }
  "showAvatar" => false
]

App\Twig\Components\UserInlineComponent {#3627
  +user: Proxies\__CG__\App\Entity\User {#1978
    +avatar: null
    +cover: null
    +email: "Pantherina@feddit.de"
    +username: "@Pantherina@feddit.de"
    +roles: []
    +followersCount: 0
    +homepage: "front"
    +about: null
    +lastActive: DateTime @1721498243 {#1515
      date: 2024-07-20 19:57:23.0 +02:00
    }
    +markedForDeletionAt: null
    +fields: null
    +oauthGithubId: null
    +oauthGoogleId: null
    +oauthFacebookId: null
    +oauthKeycloakId: null
    +hideAdult: true
    +showSubscribedUsers: true
    +showSubscribedMagazines: true
    +showSubscribedDomains: true
    +preferredLanguages: []
    +featuredMagazines: null
    +showProfileSubscriptions: false
    +showProfileFollowings: true
    +markNewComments: false
    +notifyOnNewEntry: false
    +notifyOnNewEntryReply: true
    +notifyOnNewEntryCommentReply: true
    +notifyOnNewPost: false
    +notifyOnNewPostReply: true
    +notifyOnNewPostCommentReply: true
    +addMentionsEntries: false
    +addMentionsPosts: true
    +isBanned: false
    +isVerified: false
    +isDeleted: false
    +isBot: false
    +spamProtection: true
    +customCss: null
    +ignoreMagazinesCustomCss: false
    +moderatorTokens: Doctrine\ORM\PersistentCollection {#1519 …}
    +magazineOwnershipRequests: Doctrine\ORM\PersistentCollection {#1517 …}
    +moderatorRequests: Doctrine\ORM\PersistentCollection {#1623 …}
    +entries: Doctrine\ORM\PersistentCollection {#1406 …}
    +entryVotes: Doctrine\ORM\PersistentCollection {#1713 …}
    +entryComments: Doctrine\ORM\PersistentCollection {#1710 …}
    +entryCommentVotes: Doctrine\ORM\PersistentCollection {#1474 …}
    +posts: Doctrine\ORM\PersistentCollection {#1745 …}
    +postVotes: Doctrine\ORM\PersistentCollection {#1485 …}
    +postComments: Doctrine\ORM\PersistentCollection {#1759 …}
    +postCommentVotes: Doctrine\ORM\PersistentCollection {#1637 …}
    +subscriptions: Doctrine\ORM\PersistentCollection {#1475 …}
    +subscribedDomains: Doctrine\ORM\PersistentCollection {#1636 …}
    +follows: Doctrine\ORM\PersistentCollection {#1409 …}
    +followers: Doctrine\ORM\PersistentCollection {#1624 …}
    +blocks: Doctrine\ORM\PersistentCollection {#1425 …}
    +blockers: Doctrine\ORM\PersistentCollection {#1441 …}
    +blockedMagazines: Doctrine\ORM\PersistentCollection {#1460 …}
    +blockedDomains: Doctrine\ORM\PersistentCollection {#1439 …}
    +reports: Doctrine\ORM\PersistentCollection {#1416 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1430 …}
    +violations: Doctrine\ORM\PersistentCollection {#1694 …}
    +notifications: Doctrine\ORM\PersistentCollection {#1700 …}
    +awards: Doctrine\ORM\PersistentCollection {#1434 …}
    +subscribedCategories: Doctrine\ORM\PersistentCollection {#1610 …}
    +categories: Doctrine\ORM\PersistentCollection {#1640 …}
    -id: 48318
    -password: "$2y$13$ltFqzTJ0eHIMY8NTIUV0JOoX1AZlaj64ntUxYh5oQTJrg6.lxQmuC"
    -totpSecret: null
    -totpBackupCodes: []
    -oAuth2UserConsents: Doctrine\ORM\PersistentCollection {#1669 …}
    +apId: "Pantherina@feddit.de"
    +apProfileId: "https://feddit.de/u/Pantherina"
    +apPublicUrl: "https://feddit.de/u/Pantherina"
    +apFollowersUrl: null
    +apInboxUrl: "https://feddit.de/inbox"
    +apDomain: "feddit.de"
    +apPreferredUsername: "Pantherina"
    +apDiscoverable: true
    +apManuallyApprovesFollowers: false
    +privateKey: null
    +publicKey: null
    +apFetchedAt: DateTime @1721236644 {#1516
      date: 2024-07-17 19:17:24.0 +02:00
    }
    +apDeletedAt: null
    +apTimeoutAt: null
    +visibility: "visible             "
    +createdAt: DateTimeImmutable @1696428300 {#1518
      date: 2023-10-04 16:05:00.0 +02:00
    }
    +__isInitialized__: true
     …2
  }
  +showAvatar: false
}

[
  "date" => DateTimeImmutable @1700841697 {#2402
    date: 2023-11-24 17:01:37.0 +01:00
  }
]

App\Twig\Components\DateComponent {#3697
  +date: DateTimeImmutable @1700841697 {#2402
    date: 2023-11-24 17:01:37.0 +01:00
  }
}

[
  "createdAt" => DateTimeImmutable @1700841697 {#2402
    date: 2023-11-24 17:01:37.0 +01:00
  }
  "editedAt" => DateTimeImmutable @1701462094 {#1793
    date: 2023-12-01 21:21:34.0 +01:00
  }
]

App\Twig\Components\DateEditedComponent {#3761
  +createdAt: DateTimeImmutable @1700841697 {#2402
    date: 2023-11-24 17:01:37.0 +01:00
  }
  +editedAt: DateTimeImmutable @1701462094 {#1793
    date: 2023-12-01 21:21:34.0 +01:00
  }
}

[
  "subject" => App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978
      +avatar: null
      +cover: null
      +email: "Pantherina@feddit.de"
      +username: "@Pantherina@feddit.de"
      +roles: []
      +followersCount: 0
      +homepage: "front"
      +about: null
      +lastActive: DateTime @1721498243 {#1515
        date: 2024-07-20 19:57:23.0 +02:00
      }
      +markedForDeletionAt: null
      +fields: null
      +oauthGithubId: null
      +oauthGoogleId: null
      +oauthFacebookId: null
      +oauthKeycloakId: null
      +hideAdult: true
      +showSubscribedUsers: true
      +showSubscribedMagazines: true
      +showSubscribedDomains: true
      +preferredLanguages: []
      +featuredMagazines: null
      +showProfileSubscriptions: false
      +showProfileFollowings: true
      +markNewComments: false
      +notifyOnNewEntry: false
      +notifyOnNewEntryReply: true
      +notifyOnNewEntryCommentReply: true
      +notifyOnNewPost: false
      +notifyOnNewPostReply: true
      +notifyOnNewPostCommentReply: true
      +addMentionsEntries: false
      +addMentionsPosts: true
      +isBanned: false
      +isVerified: false
      +isDeleted: false
      +isBot: false
      +spamProtection: true
      +customCss: null
      +ignoreMagazinesCustomCss: false
      +moderatorTokens: Doctrine\ORM\PersistentCollection {#1519 …}
      +magazineOwnershipRequests: Doctrine\ORM\PersistentCollection {#1517 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#1623 …}
      +entries: Doctrine\ORM\PersistentCollection {#1406 …}
      +entryVotes: Doctrine\ORM\PersistentCollection {#1713 …}
      +entryComments: Doctrine\ORM\PersistentCollection {#1710 …}
      +entryCommentVotes: Doctrine\ORM\PersistentCollection {#1474 …}
      +posts: Doctrine\ORM\PersistentCollection {#1745 …}
      +postVotes: Doctrine\ORM\PersistentCollection {#1485 …}
      +postComments: Doctrine\ORM\PersistentCollection {#1759 …}
      +postCommentVotes: Doctrine\ORM\PersistentCollection {#1637 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#1475 …}
      +subscribedDomains: Doctrine\ORM\PersistentCollection {#1636 …}
      +follows: Doctrine\ORM\PersistentCollection {#1409 …}
      +followers: Doctrine\ORM\PersistentCollection {#1624 …}
      +blocks: Doctrine\ORM\PersistentCollection {#1425 …}
      +blockers: Doctrine\ORM\PersistentCollection {#1441 …}
      +blockedMagazines: Doctrine\ORM\PersistentCollection {#1460 …}
      +blockedDomains: Doctrine\ORM\PersistentCollection {#1439 …}
      +reports: Doctrine\ORM\PersistentCollection {#1416 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1430 …}
      +violations: Doctrine\ORM\PersistentCollection {#1694 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1700 …}
      +awards: Doctrine\ORM\PersistentCollection {#1434 …}
      +subscribedCategories: Doctrine\ORM\PersistentCollection {#1610 …}
      +categories: Doctrine\ORM\PersistentCollection {#1640 …}
      -id: 48318
      -password: "$2y$13$ltFqzTJ0eHIMY8NTIUV0JOoX1AZlaj64ntUxYh5oQTJrg6.lxQmuC"
      -totpSecret: null
      -totpBackupCodes: []
      -oAuth2UserConsents: Doctrine\ORM\PersistentCollection {#1669 …}
      +apId: "Pantherina@feddit.de"
      +apProfileId: "https://feddit.de/u/Pantherina"
      +apPublicUrl: "https://feddit.de/u/Pantherina"
      +apFollowersUrl: null
      +apInboxUrl: "https://feddit.de/inbox"
      +apDomain: "feddit.de"
      +apPreferredUsername: "Pantherina"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: false
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1721236644 {#1516
        date: 2024-07-17 19:17:24.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1696428300 {#1518
        date: 2023-10-04 16:05:00.0 +02:00
      }
      +__isInitialized__: true
       …2
    }
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
]

App\Twig\Components\VoteComponent {#3826
  +subject: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978
      +avatar: null
      +cover: null
      +email: "Pantherina@feddit.de"
      +username: "@Pantherina@feddit.de"
      +roles: []
      +followersCount: 0
      +homepage: "front"
      +about: null
      +lastActive: DateTime @1721498243 {#1515
        date: 2024-07-20 19:57:23.0 +02:00
      }
      +markedForDeletionAt: null
      +fields: null
      +oauthGithubId: null
      +oauthGoogleId: null
      +oauthFacebookId: null
      +oauthKeycloakId: null
      +hideAdult: true
      +showSubscribedUsers: true
      +showSubscribedMagazines: true
      +showSubscribedDomains: true
      +preferredLanguages: []
      +featuredMagazines: null
      +showProfileSubscriptions: false
      +showProfileFollowings: true
      +markNewComments: false
      +notifyOnNewEntry: false
      +notifyOnNewEntryReply: true
      +notifyOnNewEntryCommentReply: true
      +notifyOnNewPost: false
      +notifyOnNewPostReply: true
      +notifyOnNewPostCommentReply: true
      +addMentionsEntries: false
      +addMentionsPosts: true
      +isBanned: false
      +isVerified: false
      +isDeleted: false
      +isBot: false
      +spamProtection: true
      +customCss: null
      +ignoreMagazinesCustomCss: false
      +moderatorTokens: Doctrine\ORM\PersistentCollection {#1519 …}
      +magazineOwnershipRequests: Doctrine\ORM\PersistentCollection {#1517 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#1623 …}
      +entries: Doctrine\ORM\PersistentCollection {#1406 …}
      +entryVotes: Doctrine\ORM\PersistentCollection {#1713 …}
      +entryComments: Doctrine\ORM\PersistentCollection {#1710 …}
      +entryCommentVotes: Doctrine\ORM\PersistentCollection {#1474 …}
      +posts: Doctrine\ORM\PersistentCollection {#1745 …}
      +postVotes: Doctrine\ORM\PersistentCollection {#1485 …}
      +postComments: Doctrine\ORM\PersistentCollection {#1759 …}
      +postCommentVotes: Doctrine\ORM\PersistentCollection {#1637 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#1475 …}
      +subscribedDomains: Doctrine\ORM\PersistentCollection {#1636 …}
      +follows: Doctrine\ORM\PersistentCollection {#1409 …}
      +followers: Doctrine\ORM\PersistentCollection {#1624 …}
      +blocks: Doctrine\ORM\PersistentCollection {#1425 …}
      +blockers: Doctrine\ORM\PersistentCollection {#1441 …}
      +blockedMagazines: Doctrine\ORM\PersistentCollection {#1460 …}
      +blockedDomains: Doctrine\ORM\PersistentCollection {#1439 …}
      +reports: Doctrine\ORM\PersistentCollection {#1416 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1430 …}
      +violations: Doctrine\ORM\PersistentCollection {#1694 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1700 …}
      +awards: Doctrine\ORM\PersistentCollection {#1434 …}
      +subscribedCategories: Doctrine\ORM\PersistentCollection {#1610 …}
      +categories: Doctrine\ORM\PersistentCollection {#1640 …}
      -id: 48318
      -password: "$2y$13$ltFqzTJ0eHIMY8NTIUV0JOoX1AZlaj64ntUxYh5oQTJrg6.lxQmuC"
      -totpSecret: null
      -totpBackupCodes: []
      -oAuth2UserConsents: Doctrine\ORM\PersistentCollection {#1669 …}
      +apId: "Pantherina@feddit.de"
      +apProfileId: "https://feddit.de/u/Pantherina"
      +apPublicUrl: "https://feddit.de/u/Pantherina"
      +apFollowersUrl: null
      +apInboxUrl: "https://feddit.de/inbox"
      +apDomain: "feddit.de"
      +apPreferredUsername: "Pantherina"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: false
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1721236644 {#1516
        date: 2024-07-17 19:17:24.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1696428300 {#1518
        date: 2023-10-04 16:05:00.0 +02:00
      }
      +__isInitialized__: true
       …2
    }
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  +formDest: "entry"
  +showDownvote: true
  -cache: Symfony\Component\Cache\Adapter\TraceableTagAwareAdapter {#600 …}
}

[
  "subject" => App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978
      +avatar: null
      +cover: null
      +email: "Pantherina@feddit.de"
      +username: "@Pantherina@feddit.de"
      +roles: []
      +followersCount: 0
      +homepage: "front"
      +about: null
      +lastActive: DateTime @1721498243 {#1515
        date: 2024-07-20 19:57:23.0 +02:00
      }
      +markedForDeletionAt: null
      +fields: null
      +oauthGithubId: null
      +oauthGoogleId: null
      +oauthFacebookId: null
      +oauthKeycloakId: null
      +hideAdult: true
      +showSubscribedUsers: true
      +showSubscribedMagazines: true
      +showSubscribedDomains: true
      +preferredLanguages: []
      +featuredMagazines: null
      +showProfileSubscriptions: false
      +showProfileFollowings: true
      +markNewComments: false
      +notifyOnNewEntry: false
      +notifyOnNewEntryReply: true
      +notifyOnNewEntryCommentReply: true
      +notifyOnNewPost: false
      +notifyOnNewPostReply: true
      +notifyOnNewPostCommentReply: true
      +addMentionsEntries: false
      +addMentionsPosts: true
      +isBanned: false
      +isVerified: false
      +isDeleted: false
      +isBot: false
      +spamProtection: true
      +customCss: null
      +ignoreMagazinesCustomCss: false
      +moderatorTokens: Doctrine\ORM\PersistentCollection {#1519 …}
      +magazineOwnershipRequests: Doctrine\ORM\PersistentCollection {#1517 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#1623 …}
      +entries: Doctrine\ORM\PersistentCollection {#1406 …}
      +entryVotes: Doctrine\ORM\PersistentCollection {#1713 …}
      +entryComments: Doctrine\ORM\PersistentCollection {#1710 …}
      +entryCommentVotes: Doctrine\ORM\PersistentCollection {#1474 …}
      +posts: Doctrine\ORM\PersistentCollection {#1745 …}
      +postVotes: Doctrine\ORM\PersistentCollection {#1485 …}
      +postComments: Doctrine\ORM\PersistentCollection {#1759 …}
      +postCommentVotes: Doctrine\ORM\PersistentCollection {#1637 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#1475 …}
      +subscribedDomains: Doctrine\ORM\PersistentCollection {#1636 …}
      +follows: Doctrine\ORM\PersistentCollection {#1409 …}
      +followers: Doctrine\ORM\PersistentCollection {#1624 …}
      +blocks: Doctrine\ORM\PersistentCollection {#1425 …}
      +blockers: Doctrine\ORM\PersistentCollection {#1441 …}
      +blockedMagazines: Doctrine\ORM\PersistentCollection {#1460 …}
      +blockedDomains: Doctrine\ORM\PersistentCollection {#1439 …}
      +reports: Doctrine\ORM\PersistentCollection {#1416 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1430 …}
      +violations: Doctrine\ORM\PersistentCollection {#1694 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1700 …}
      +awards: Doctrine\ORM\PersistentCollection {#1434 …}
      +subscribedCategories: Doctrine\ORM\PersistentCollection {#1610 …}
      +categories: Doctrine\ORM\PersistentCollection {#1640 …}
      -id: 48318
      -password: "$2y$13$ltFqzTJ0eHIMY8NTIUV0JOoX1AZlaj64ntUxYh5oQTJrg6.lxQmuC"
      -totpSecret: null
      -totpBackupCodes: []
      -oAuth2UserConsents: Doctrine\ORM\PersistentCollection {#1669 …}
      +apId: "Pantherina@feddit.de"
      +apProfileId: "https://feddit.de/u/Pantherina"
      +apPublicUrl: "https://feddit.de/u/Pantherina"
      +apFollowersUrl: null
      +apInboxUrl: "https://feddit.de/inbox"
      +apDomain: "feddit.de"
      +apPreferredUsername: "Pantherina"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: false
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1721236644 {#1516
        date: 2024-07-17 19:17:24.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1696428300 {#1518
        date: 2023-10-04 16:05:00.0 +02:00
      }
      +__isInitialized__: true
       …2
    }
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
]

App\Twig\Components\BoostComponent {#3892
  +formDest: "entry"
  +subject: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978
      +avatar: null
      +cover: null
      +email: "Pantherina@feddit.de"
      +username: "@Pantherina@feddit.de"
      +roles: []
      +followersCount: 0
      +homepage: "front"
      +about: null
      +lastActive: DateTime @1721498243 {#1515
        date: 2024-07-20 19:57:23.0 +02:00
      }
      +markedForDeletionAt: null
      +fields: null
      +oauthGithubId: null
      +oauthGoogleId: null
      +oauthFacebookId: null
      +oauthKeycloakId: null
      +hideAdult: true
      +showSubscribedUsers: true
      +showSubscribedMagazines: true
      +showSubscribedDomains: true
      +preferredLanguages: []
      +featuredMagazines: null
      +showProfileSubscriptions: false
      +showProfileFollowings: true
      +markNewComments: false
      +notifyOnNewEntry: false
      +notifyOnNewEntryReply: true
      +notifyOnNewEntryCommentReply: true
      +notifyOnNewPost: false
      +notifyOnNewPostReply: true
      +notifyOnNewPostCommentReply: true
      +addMentionsEntries: false
      +addMentionsPosts: true
      +isBanned: false
      +isVerified: false
      +isDeleted: false
      +isBot: false
      +spamProtection: true
      +customCss: null
      +ignoreMagazinesCustomCss: false
      +moderatorTokens: Doctrine\ORM\PersistentCollection {#1519 …}
      +magazineOwnershipRequests: Doctrine\ORM\PersistentCollection {#1517 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#1623 …}
      +entries: Doctrine\ORM\PersistentCollection {#1406 …}
      +entryVotes: Doctrine\ORM\PersistentCollection {#1713 …}
      +entryComments: Doctrine\ORM\PersistentCollection {#1710 …}
      +entryCommentVotes: Doctrine\ORM\PersistentCollection {#1474 …}
      +posts: Doctrine\ORM\PersistentCollection {#1745 …}
      +postVotes: Doctrine\ORM\PersistentCollection {#1485 …}
      +postComments: Doctrine\ORM\PersistentCollection {#1759 …}
      +postCommentVotes: Doctrine\ORM\PersistentCollection {#1637 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#1475 …}
      +subscribedDomains: Doctrine\ORM\PersistentCollection {#1636 …}
      +follows: Doctrine\ORM\PersistentCollection {#1409 …}
      +followers: Doctrine\ORM\PersistentCollection {#1624 …}
      +blocks: Doctrine\ORM\PersistentCollection {#1425 …}
      +blockers: Doctrine\ORM\PersistentCollection {#1441 …}
      +blockedMagazines: Doctrine\ORM\PersistentCollection {#1460 …}
      +blockedDomains: Doctrine\ORM\PersistentCollection {#1439 …}
      +reports: Doctrine\ORM\PersistentCollection {#1416 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1430 …}
      +violations: Doctrine\ORM\PersistentCollection {#1694 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1700 …}
      +awards: Doctrine\ORM\PersistentCollection {#1434 …}
      +subscribedCategories: Doctrine\ORM\PersistentCollection {#1610 …}
      +categories: Doctrine\ORM\PersistentCollection {#1640 …}
      -id: 48318
      -password: "$2y$13$ltFqzTJ0eHIMY8NTIUV0JOoX1AZlaj64ntUxYh5oQTJrg6.lxQmuC"
      -totpSecret: null
      -totpBackupCodes: []
      -oAuth2UserConsents: Doctrine\ORM\PersistentCollection {#1669 …}
      +apId: "Pantherina@feddit.de"
      +apProfileId: "https://feddit.de/u/Pantherina"
      +apPublicUrl: "https://feddit.de/u/Pantherina"
      +apFollowersUrl: null
      +apInboxUrl: "https://feddit.de/inbox"
      +apDomain: "feddit.de"
      +apPreferredUsername: "Pantherina"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: false
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1721236644 {#1516
        date: 2024-07-17 19:17:24.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1696428300 {#1518
        date: 2023-10-04 16:05:00.0 +02:00
      }
      +__isInitialized__: true
       …2
    }
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  -cache: Symfony\Component\Cache\Adapter\TraceableTagAwareAdapter {#600 …}
}

[
  "entry" => App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978
      +avatar: null
      +cover: null
      +email: "Pantherina@feddit.de"
      +username: "@Pantherina@feddit.de"
      +roles: []
      +followersCount: 0
      +homepage: "front"
      +about: null
      +lastActive: DateTime @1721498243 {#1515
        date: 2024-07-20 19:57:23.0 +02:00
      }
      +markedForDeletionAt: null
      +fields: null
      +oauthGithubId: null
      +oauthGoogleId: null
      +oauthFacebookId: null
      +oauthKeycloakId: null
      +hideAdult: true
      +showSubscribedUsers: true
      +showSubscribedMagazines: true
      +showSubscribedDomains: true
      +preferredLanguages: []
      +featuredMagazines: null
      +showProfileSubscriptions: false
      +showProfileFollowings: true
      +markNewComments: false
      +notifyOnNewEntry: false
      +notifyOnNewEntryReply: true
      +notifyOnNewEntryCommentReply: true
      +notifyOnNewPost: false
      +notifyOnNewPostReply: true
      +notifyOnNewPostCommentReply: true
      +addMentionsEntries: false
      +addMentionsPosts: true
      +isBanned: false
      +isVerified: false
      +isDeleted: false
      +isBot: false
      +spamProtection: true
      +customCss: null
      +ignoreMagazinesCustomCss: false
      +moderatorTokens: Doctrine\ORM\PersistentCollection {#1519 …}
      +magazineOwnershipRequests: Doctrine\ORM\PersistentCollection {#1517 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#1623 …}
      +entries: Doctrine\ORM\PersistentCollection {#1406 …}
      +entryVotes: Doctrine\ORM\PersistentCollection {#1713 …}
      +entryComments: Doctrine\ORM\PersistentCollection {#1710 …}
      +entryCommentVotes: Doctrine\ORM\PersistentCollection {#1474 …}
      +posts: Doctrine\ORM\PersistentCollection {#1745 …}
      +postVotes: Doctrine\ORM\PersistentCollection {#1485 …}
      +postComments: Doctrine\ORM\PersistentCollection {#1759 …}
      +postCommentVotes: Doctrine\ORM\PersistentCollection {#1637 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#1475 …}
      +subscribedDomains: Doctrine\ORM\PersistentCollection {#1636 …}
      +follows: Doctrine\ORM\PersistentCollection {#1409 …}
      +followers: Doctrine\ORM\PersistentCollection {#1624 …}
      +blocks: Doctrine\ORM\PersistentCollection {#1425 …}
      +blockers: Doctrine\ORM\PersistentCollection {#1441 …}
      +blockedMagazines: Doctrine\ORM\PersistentCollection {#1460 …}
      +blockedDomains: Doctrine\ORM\PersistentCollection {#1439 …}
      +reports: Doctrine\ORM\PersistentCollection {#1416 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1430 …}
      +violations: Doctrine\ORM\PersistentCollection {#1694 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1700 …}
      +awards: Doctrine\ORM\PersistentCollection {#1434 …}
      +subscribedCategories: Doctrine\ORM\PersistentCollection {#1610 …}
      +categories: Doctrine\ORM\PersistentCollection {#1640 …}
      -id: 48318
      -password: "$2y$13$ltFqzTJ0eHIMY8NTIUV0JOoX1AZlaj64ntUxYh5oQTJrg6.lxQmuC"
      -totpSecret: null
      -totpBackupCodes: []
      -oAuth2UserConsents: Doctrine\ORM\PersistentCollection {#1669 …}
      +apId: "Pantherina@feddit.de"
      +apProfileId: "https://feddit.de/u/Pantherina"
      +apPublicUrl: "https://feddit.de/u/Pantherina"
      +apFollowersUrl: null
      +apInboxUrl: "https://feddit.de/inbox"
      +apDomain: "feddit.de"
      +apPreferredUsername: "Pantherina"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: false
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1721236644 {#1516
        date: 2024-07-17 19:17:24.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1696428300 {#1518
        date: 2023-10-04 16:05:00.0 +02:00
      }
      +__isInitialized__: true
       …2
    }
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
]

App\Twig\Components\EntriesCrossComponent {#4206
  +entry: App\Entity\Entry {#2400
    +user: Proxies\__CG__\App\Entity\User {#1978
      +avatar: null
      +cover: null
      +email: "Pantherina@feddit.de"
      +username: "@Pantherina@feddit.de"
      +roles: []
      +followersCount: 0
      +homepage: "front"
      +about: null
      +lastActive: DateTime @1721498243 {#1515
        date: 2024-07-20 19:57:23.0 +02:00
      }
      +markedForDeletionAt: null
      +fields: null
      +oauthGithubId: null
      +oauthGoogleId: null
      +oauthFacebookId: null
      +oauthKeycloakId: null
      +hideAdult: true
      +showSubscribedUsers: true
      +showSubscribedMagazines: true
      +showSubscribedDomains: true
      +preferredLanguages: []
      +featuredMagazines: null
      +showProfileSubscriptions: false
      +showProfileFollowings: true
      +markNewComments: false
      +notifyOnNewEntry: false
      +notifyOnNewEntryReply: true
      +notifyOnNewEntryCommentReply: true
      +notifyOnNewPost: false
      +notifyOnNewPostReply: true
      +notifyOnNewPostCommentReply: true
      +addMentionsEntries: false
      +addMentionsPosts: true
      +isBanned: false
      +isVerified: false
      +isDeleted: false
      +isBot: false
      +spamProtection: true
      +customCss: null
      +ignoreMagazinesCustomCss: false
      +moderatorTokens: Doctrine\ORM\PersistentCollection {#1519 …}
      +magazineOwnershipRequests: Doctrine\ORM\PersistentCollection {#1517 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#1623 …}
      +entries: Doctrine\ORM\PersistentCollection {#1406 …}
      +entryVotes: Doctrine\ORM\PersistentCollection {#1713 …}
      +entryComments: Doctrine\ORM\PersistentCollection {#1710 …}
      +entryCommentVotes: Doctrine\ORM\PersistentCollection {#1474 …}
      +posts: Doctrine\ORM\PersistentCollection {#1745 …}
      +postVotes: Doctrine\ORM\PersistentCollection {#1485 …}
      +postComments: Doctrine\ORM\PersistentCollection {#1759 …}
      +postCommentVotes: Doctrine\ORM\PersistentCollection {#1637 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#1475 …}
      +subscribedDomains: Doctrine\ORM\PersistentCollection {#1636 …}
      +follows: Doctrine\ORM\PersistentCollection {#1409 …}
      +followers: Doctrine\ORM\PersistentCollection {#1624 …}
      +blocks: Doctrine\ORM\PersistentCollection {#1425 …}
      +blockers: Doctrine\ORM\PersistentCollection {#1441 …}
      +blockedMagazines: Doctrine\ORM\PersistentCollection {#1460 …}
      +blockedDomains: Doctrine\ORM\PersistentCollection {#1439 …}
      +reports: Doctrine\ORM\PersistentCollection {#1416 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1430 …}
      +violations: Doctrine\ORM\PersistentCollection {#1694 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1700 …}
      +awards: Doctrine\ORM\PersistentCollection {#1434 …}
      +subscribedCategories: Doctrine\ORM\PersistentCollection {#1610 …}
      +categories: Doctrine\ORM\PersistentCollection {#1640 …}
      -id: 48318
      -password: "$2y$13$ltFqzTJ0eHIMY8NTIUV0JOoX1AZlaj64ntUxYh5oQTJrg6.lxQmuC"
      -totpSecret: null
      -totpBackupCodes: []
      -oAuth2UserConsents: Doctrine\ORM\PersistentCollection {#1669 …}
      +apId: "Pantherina@feddit.de"
      +apProfileId: "https://feddit.de/u/Pantherina"
      +apPublicUrl: "https://feddit.de/u/Pantherina"
      +apFollowersUrl: null
      +apInboxUrl: "https://feddit.de/inbox"
      +apDomain: "feddit.de"
      +apPreferredUsername: "Pantherina"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: false
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1721236644 {#1516
        date: 2024-07-17 19:17:24.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1696428300 {#1518
        date: 2023-10-04 16:05:00.0 +02:00
      }
      +__isInitialized__: true
       …2
    }
    +magazine: App\Entity\Magazine {#265
      +icon: Proxies\__CG__\App\Entity\Image {#246 …}
      +name: "linux@lemmy.ml"
      +title: "linux"
      +description: """
        From Wikipedia, the free encyclopedia\n
        \n
        Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
        \n
        Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
        \n
        ### Rules\n
        \n
        - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
        - No misinformation\n
        - No NSFW content\n
        - No hate speech, bigotry, etc\n
        \n
        ### Related Communities\n
        \n
        - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
        - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
        - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
        - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
        \n
        Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
        """
      +rules: null
      +subscriptionsCount: 1
      +entryCount: 1406
      +entryCommentCount: 28632
      +postCount: 6
      +postCommentCount: 214
      +isAdult: false
      +customCss: null
      +lastActive: DateTime @1729583542 {#275
        date: 2024-10-22 09:52:22.0 +02:00
      }
      +markedForDeletionAt: null
      +tags: null
      +moderators: Doctrine\ORM\PersistentCollection {#237 …}
      +ownershipRequests: Doctrine\ORM\PersistentCollection {#233 …}
      +moderatorRequests: Doctrine\ORM\PersistentCollection {#222 …}
      +entries: Doctrine\ORM\PersistentCollection {#180 …}
      +posts: Doctrine\ORM\PersistentCollection {#138 …}
      +subscriptions: Doctrine\ORM\PersistentCollection {#200 …}
      +bans: Doctrine\ORM\PersistentCollection {#117 …}
      +reports: Doctrine\ORM\PersistentCollection {#103 …}
      +badges: Doctrine\ORM\PersistentCollection {#81 …}
      +logs: Doctrine\ORM\PersistentCollection {#71 …}
      +awards: Doctrine\ORM\PersistentCollection {#1346 …}
      +categories: Doctrine\ORM\PersistentCollection {#1823 …}
      -id: 73
      +apId: "linux@lemmy.ml"
      +apProfileId: "https://lemmy.ml/c/linux"
      +apPublicUrl: "https://lemmy.ml/c/linux"
      +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
      +apInboxUrl: "https://lemmy.ml/inbox"
      +apDomain: "lemmy.ml"
      +apPreferredUsername: "linux"
      +apDiscoverable: true
      +apManuallyApprovesFollowers: null
      +privateKey: null
      +publicKey: null
      +apFetchedAt: DateTime @1729583596 {#269
        date: 2024-10-22 09:53:16.0 +02:00
      }
      +apDeletedAt: null
      +apTimeoutAt: null
      +visibility: "visible             "
      +createdAt: DateTimeImmutable @1698929468 {#271
        date: 2023-11-02 13:51:08.0 +01:00
      }
    }
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#1889 …}
    +slug: "Security-advise-collection-what-do-you-recommend"
    +title: "Security advise collection - what do you recommend?"
    +url: null
    +body: """
      I use Linux for quite a while and would like to gather some security advice, well known and lesser known.\n
      \n
      ### Well known\n
      \n
      #### Dont install random apps from the internet\n
      \n
      This is the (old) Windows way and the result of an OS not caring about its software. Often bundled with also outsourced antivirus, or scanning all files you download.\n
      \n
      So use official repos nearly exclusively. If there is an app not in your distros repos, try Distrobox, create a Container of any image and install it there. You can display the images available by pressing tab after `-i`.\n
      \n
      `distrobox-create NAME -i IMAGE-NAME`\n
      \n
      This also goes for\n
      \n
      - Ubuntu PPAs\n
      - Arch AUR\n
      - Opensuse Build service repos\n
      - Fedora COPR\n
      - Random external repos\n
      \n
      Some repos are more or less controlled, so be careful!\n
      \n
      Some “external ones” are trusted, like:\n
      \n
      - Fedora/Derivates: rpmfusion\n
      - Flathub\n
      - Steam Fedora Repo\n
      - Google Chrome Fedora Repo (dont use Chrome lol)\n
      - Open-h264 from Cisco\n
      - …\n
      \n
      [Not all Flathub repos are controlled, but here is a list](https://github.com/trytomakeyouprivate/Flatpak-remotes)\n
      \n
      #### Update, update, update\n
      \n
      Its best to enable automatic updates. If you have a slim system and install your apps as Flatpak apps (best if they are verified, look at flathub.org or directly add the verified repo), updates should never break something.\n
      \n
      #### Wayland\n
      \n
      X11 is an outdated security desaster with design flaws so big, that nobody cared to fix it. Instead, Wayland was created with way tighter (and more modern) restrictions, requiring Portals for apps to do stuff like\n
      \n
      - using your Camera\n
      - using your Microphone\n
      - viewing your screen or specific app Windows\n
      - simulating input devices\n
      - watching for keypresses\n
      \n
      Only KDE and GNOME have full Wayland support for now, along with some Window Managers and RaspberryPi OS. This means\n
      \n
      - XFCE\n
      - LXQt, LXDE\n
      - Budgie\n
      - Mate\n
      - Cinnamon\n
      - …\n
      \n
      Should be avoided until at least a year when they have full Wayland support. Wayland is not a new protocol at all, but requires Desktops to do more work. It can be expected (and hoped) that at least some effords combine, Desktops use existing Compositors etc.\n
      \n
      Wayland is backwards compatible (X11-only apps run through xwayland, and you can also force apps to use Xwayland if they otherwise lose features).\n
      \n
      All apps work on Wayland that dont do weird stuff that uses insecure methods. Poorly this includes screen readers and lots of Remote Desktop Software, as well as Screen recording. But things will evolve, and there are Apps that only support Wayland.\n
      \n
      ### Less known\n
      \n
      #### Avoid stable Distributions\n
      \n
      Stable Distros dont get regular updates of every package that… gets an update, but they get ***backported*** security fixes.\n
      \n
      Correct me if I am wrong, but not all security related bugs get a CVE ([Common Vulnerabilities and Exposures](https://en.m.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) and thus dont get backported.\n
      \n
      Stable Distributions are used everywhere on the internet though, so this could be debatable.\n
      \n
      #### Use an “immutable” distro\n
      \n
      Immutability is implemented in various ways, there is no standard at all\n
      \n
      - Android, Chromeos\n
      - Fedora Atomic (Silverblue, Kinoite, …)\n
      - Opensuse microOS (now Kalpa, Aeon)\n
      - VanillaOS\n
      - SteamOS\n
      \n
      They are all different from each other, with Chromeos and Android being fully immutable, allowing no deviations from the OS at all, SteamOS being similar but allowing to run Flatpak apps natively.\n
      \n
      VanillaOS and Opensuse microOS use a different form of “regular package management but atomic”, so the change does not apply to the running system but to a clone of it, being applied on reboot.\n
      \n
      Fedora Atomic goes the “Cloud way” with an image-based system that can be downloaded, swapped out but also modified. They use OSTree for keeping track of every single package on your system and also changes, a simple `rpm-ostree reset` will reset your base system. It is the most secure of the customizable ones to my knowledge.\n
      \n
      Immutable Operating systems make sure that every update works, so they can easily be done automatically and on a running system.\n
      \n
      Also, changes to the core system through malware are not possible, at least not directly.\n
      \n
      #### secure directories and dotfiles\n
      \n
      An exception here is, if a malware would simply create a bash alias to ***anything***. So a sudo password can easily be grabbed, or a second command executed whenever you do something with sudo.\n
      \n
      [madaidans-insecurities.github.io/linux.html#examp…](https://madaidans-insecurities.github.io/linux.html#examples)\n
      \n
      So this means that your shell configs should only be writable by sudo, all others can only read! The same for ~/.gnupg or ~/.ssh, maybe even only readable by sudo depending on your use case.\n
      \n
      ```\n
      \n
      <span style="color:#323232;">sudo chmod 755 ~/.bashrc &amp;&amp; sudo chown root ~/.bashrc\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.ssh &amp;&amp; sudo chown -R root ~/.ssh\n
      </span><span style="color:#323232;">sudo chmod -R 700 ~/.gnupg &amp;&amp; sudo chown -R root ~/.gnupg\n
      </span><span style="color:#323232;">sudo chmod 755 ~/.zshrc &amp;&amp; sudo chown root ~/.zshrc\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/fish/ &amp;&amp; sudo chown -R root ~/.config/fish/\n
      </span><span style="color:#323232;">sudo chmod -R 755 ~/.config/autostart &amp;&amp; sudo chown root -R ~/.config/autostart\n
      </span><span style="color:#323232;">#sudo chmod -R 755 ~/.local/share/applications &amp;&amp; sudo chown -R root ~/.local/share/applications\n
      </span>\n
      ```\n
      \n
      (7: **r**ead **w**rite e**x**execute, 5: read execute, “-R”, recursively)\n
      \n
      This may still be incomplete, and the security is pretty flawed as long as random software can write to these directories at all, and as long as everything important is stored there.\n
      \n
      Please report if any setting breaks something. Making the local applications directory read-only for everyone but root might be good, but will break for example KDEs GUI editor. But they put apps in `~/.local/share/applications/ons` anyways for some reason.\n
      \n
      #### SELinux or Apparmor\n
      \n
      I dont know what is better, but I feel secure on Fedora with SELinux on enforcing. If any tools require you to disable it, they are poorly written.\n
      \n
      #### Sandboxing\n
      \n
      I am not nearly technical enough to explain details, but firejail is said to have many design flaws, a reason why bubblejail (using bubblewrap, which is used in Flatpak) should be preferred.\n
      \n
      It is in early stages though.\n
      \n
      Browser sandboxes are also not easy, Firefox Flatpak vs. Firefox native for example. Flatpaks need to replace the internal sandbox with bubblewrap. The same goes for Chromium and electron apps, and especially Chromium as a native app is said to be very secure.\n
      \n
      For regular and especially privacy concerns, Flatpak with mostly manually hardened permissions is the best way. KDE has the permissions graphically integrated, otherwise Flatseal is nice.\n
      \n
      Flatpak apps are always weakly isolated to make sure nothing breaks. In the future with portals for every (i.e. dynamic permissions) static permissions should be gone.\n
      \n
      #### Firmware updates &amp; Coreboot\n
      \n
      While you may use the linux-libre Kernel and live full stallman, what Firmware does your PC use?\n
      \n
      In most cases, especially for “Laptops with good Linux compatibility” that may be older Laptops, decommissioned Company devices, older Thinkpads… and they all probably dont get Firmware updates anymore!\n
      \n
      My Thinkpad T495 has an outdated, bloated Lenovo Firmware. Firmware can read RAM, connect to the Internet and do anything. You cannot monitor that from the OS, you need a MITM proxy using another device.\n
      \n
      And also, proprietary Firmware is everywhere. Only a vew people develop it, but it is there!\n
      \n
      - [Novacustom](configurelaptop.eu) for EU people, they partner with [3mdeb](3mdeb.com) to support and ship Dasharo, a secure Coreboot Distro similar to Heads\n
      - System76 for US People\n
      - Starlabs also ships coreboot\n
      - [3mdeb](shop.3mdeb.com) sells PCs with Coreboot\n
      \n
      Lots of Coreboot Distros only support old Hardware like Thinkpads up to T430. Nitrokey is a good vendor here, but keep in mind that these machines are now 11 years old. I still have one and it works great! But not for complex stuff like multiple VMs.\n
      \n
      #### Secureboot\n
      \n
      Also important to verify that your OS was not tempered with. Many Distros support it, even though they may not have an agreement with Microsoft so work out of the box, but they generate their own keys after installation.\n
      \n
      Firmware like Dasharo or heads with integrity checks is better than Secureboot alone.\n
      \n
      ---\n
      \n
      What other tips do you know?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 15
    +favouriteCount: 28
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1710702956 {#2414
      date: 2024-03-17 20:15:56.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#1688 …}
    +votes: Doctrine\ORM\PersistentCollection {#1966 …}
    +reports: Doctrine\ORM\PersistentCollection {#1965 …}
    +favourites: Doctrine\ORM\PersistentCollection {#1368 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2426 …}
    +badges: Doctrine\ORM\PersistentCollection {#2439 …}
    +children: []
    -id: 16322
    -titleTs: "'advis':2 'collect':3 'recommend':7 'secur':1"
    -bodyTs: "'/.bashrc':746,750 '/.config/autostart':793,798 '/.config/fish':783,788 '/.gnupg':729,765,770 '/.local/share/applications':803,808 '/.local/share/applications/ons':889 '/.ssh':731,755,760 '/.zshrc':774,778 '/linux.html#examp':704 '/linux.html#examples)':707 '/trytomakeyouprivate/flatpak-remotes)':171 '/wiki/common_vulnerabilities_and_exposures))':453 '11':1225 '3mdeb':1169,1191 '3mdeb.com':1170 '5':817 '7':809 '700':754,764 '755':745,773,782,792,802 'add':204 'advic':15 'aeon':499 'agreement':1267 'alia':680 'allow':516,528 'alon':1296 'along':279 'also':50,107,355,587,603,649,967,1146,1188,1245 'alway':1036 'android':489,512 'anoth':1143 'antivirus':52 'anymor':1109 'anyth':682,1129 'anyway':890 'app':26,69,190,193,245,261,348,357,367,403,532,887,993,1000,1034 'apparmor':896 'appli':553,565 'applic':864 'arch':112 'atom':492,547,569 'aur':113 'automat':179,643 'avail':92 'avoid':297,410 'backport':429,458 'backward':343 'base':578,614 'bash':679 'best':176,194,1021 'better':902,1293 'big':224 'bloat':1116 'box':1275 'break':211,859,878,1043 'browser':964 'bubblejail':947 'bubblewrap':949,985 'budgi':292 'bug':443 'build':115 'bundl':48 'camera':252 'cannot':1131 'care':43,132,227 'case':742,1083 'chang':550,604,650 'check':1291 'chmod':744,752,762,772,780,790,800 'chown':748,757,767,776,785,795,805 'chrome':146,151 'chromeo':490,510 'chromium':990,996 'cinnamon':294 'cisco':157 'clone':561 'cloud':572 'combin':335 'command':694 'common':447 'compani':1097 'compat':344,1090 'complex':1239 'compositor':339 'concern':1012 'config':714 'configurelaptop.eu':1162 'connect':1123 'contain':79 'control':129,163 'copr':119 'core':653 'coreboot':1061,1178,1190,1196,1199 'correct':432 'could':470 'creat':77,100,234,677 'customiz':623 'cve':446 'dasharo':1175,1286 'debat':472 'decommiss':1096 'depend':738 'desast':219 'design':221,942 'desktop':319,336,389 'detail':934 'develop':1155 'deviat':518 'devic':265,1098,1144 'differ':505,540 'direct':203,663 'directori':665,842,865 'disabl':919 'display':89 'distribut':412,460 'distro':73,414,476,1179,1200,1257 'distrobox':76,99 'distrobox-cr':98 'done':642 'dont':23,149,372,415,456,898,1105 'dotfil':667 'download':58,583 'dynam':1052 'e':814 'ead':811 'earli':961 'easi':969 'easili':640,688 'editor':883 'efford':334 'electron':992 'en.m.wikipedia.org':452 'en.m.wikipedia.org/wiki/common_vulnerabilities_and_exposures))':451 'enabl':178 'enforc':912 'enough':931 'especi':995,1010,1084 'etc':340 'eu':1164 'even':733,1260 'everi':420,596,634,1050 'everyon':870 'everyth':849 'everywher':463,1150 'evolv':399 'exampl':880,976 'except':669 'exclus':64 'execut':695,816,819 'exist':338 'expect':327 'explain':933 'exposur':450 'extern':121,134 'featur':365 'fedora':118,143,147,491,568,908 'fedora/derivates':139 'feel':905 'file':56 'firefox':970,973 'firejail':936 'firmwar':1059,1076,1107,1118,1119,1148,1284 'fix':229,431 'flathub':141,160 'flathub.org':201 'flatpak':192,531,954,971,977,1013,1033 'flatseal':1030 'flaw':222,832,943 'forc':356 'form':541 'full':274,306,1073 'fulli':514 'futur':1046 'gather':12 'generat':1278 'get':416,423,428,444,457,1106 'github.com':170 'github.com/trytomakeyouprivate/flatpak-remotes)':169 'gnome':272 'goe':108,570,988 'gone':1058 'good':875,1088,1213 'googl':145 'grab':690 'graphic':1027 'great':1235 'gui':882 'h264':155 'harden':1017 'hardwar':1204 'head':1182,1288 'hope':329 'i.e':1051 'imag':82,91,104,577 'image-bas':576 'image-nam':103 'immut':475,477,515,628 'implement':479 'import':850,1246 'includ':382 'incomplet':826 'input':264 'insecur':378 'instal':24,84,188,1283 'instead':231 'integr':1028,1290 'intern':982 'internet':29,466,1126 'isol':1038 'kalpa':498 'kde':270,1023 'kdes':881 'keep':593,1217 'kernel':1070 'key':1281 'keypress':268 'kinoit':494 'know':899,1302 'knowledg':627 'known':17,20,22,409 'laptop':1086,1095 'least':300,332,661 'lenovo':1117 'less':128,408 'lesser':19 'libr':1069 'like':10,138,249,1205,1241,1285 'linux':3,1068,1089 'linux-libr':1067 'list':168 'live':1072 'local':863 'lol':152 'long':834,847 'look':199 'lose':364 'lot':386,1197 'lxde':291 'lxqt':290 'machin':1222 'madaidans-insecurities.github.io':703,706 'madaidans-insecurities.github.io/linux.html#examp':702 'madaidans-insecurities.github.io/linux.html#examples)':705 'make':631,861,1040 'malwar':656,674 'manag':283,545 'mani':941,1256 'manual':1016 'mate':293 'may':823,1064,1092,1263 'mayb':732 'mean':288,710 'method':379 'microo':496,537 'microphon':255 'microsoft':1269 'might':873 'mind':1219 'mitm':1140 'modern':240 'modifi':588 'monitor':1132 'most':1015 'multipl':1242 'name':101,105 'nativ':533,974,999 'near':63,929 'need':978,1138 'never':210 'new':313 'nice':1032 'nitrokey':1210 'nobodi':226 'noth':1042 'novacustom':1161 'offici':61 'often':47 'old':33,1203,1227 'older':1094,1099 'one':135,624,1231 'open':154 'open-h264':153 'opensus':114,495,536 'oper':629 'os':41,286,521,1136,1251 'ostre':591,609 'other':722 'otherwis':363,1029 'outdat':217,1115 'outsourc':51 'packag':421,544,598 'partner':1167 'password':686 'pc':1079 'pcs':1194 'peopl':1154,1165,1186 'permiss':1018,1026,1053,1055 'pleas':854 'poor':380,923 'portal':243,1048 'possibl':659 'ppas':111 'prefer':957 'press':94 'pretti':831 'privaci':1011 'probabl':1104 'proprietari':1147 'protocol':314 'proxi':1141 'put':886 'quit':5 'r':753,758,763,768,781,786,791,797,801,806,810,820 'ram':1122 'random':25,120,836 'raspberrypi':285 'read':725,818,867,1121 'read-on':866 'readabl':735 'reader':384 'reason':893,945 'reboot':567 'record':395 'recurs':821 'regular':417,543,1008 'relat':442 'remot':388 'replac':980 'repo':62,74,117,122,124,144,148,161,207 'report':855 'requir':242,318,916 'reset':610,612 'restrict':241 'result':38 'rite':813 'root':749,759,769,777,787,796,807,872 'rpm':608 'rpm-ostre':607 'rpmfusion':140 'run':349,530,556,647 'said':938,1002 'sandbox':925,965,983 'scan':54 'screen':258,383,394 'second':693 'secur':14,218,430,441,620,664,829,906,1006,1177 'secureboot':1244,1295 'selinux':894,910 'sell':1193 'servic':116 'set':858 'shell':713 'ship':1174,1189 'shop.3mdeb.com':1192 'silverblu':493 'similar':526,1180 'simpl':606 'simpli':676 'simul':263 'singl':597 'slim':185 'softwar':46,390,837 'someth':212,699,860 'specif':260 'stabl':411,413,459 'stage':962 'stallman':1074 'standard':486 'starlab':1187 'static':1054 'steam':142 'steamo':501,524 'still':824,1229 'store':852 'stuff':248,375,1240 'sudo':685,701,720,737,743,747,751,756,761,766,771,775,779,784,789,794,799,804 'support':276,308,406,1172,1202,1258 'sure':632,1041 'swap':584 'system':186,557,579,601,615,630,648,654 'system76':1183 't430':1209 't495':1112 'tab':95 'technic':930 'temper':1254 'thing':397 'thinkpad':1100,1111,1206 'though':467,963,1261 'thus':455 'tighter':237 'tip':1299 'tool':915 'track':594 'tri':75 'trust':137 'ubuntu':110 'updat':172,173,174,180,208,418,425,635,1060,1108 'us':1185 'use':2,60,150,250,253,337,359,377,462,473,538,590,741,948,952,1065,1080,1142 'vanillao':500,534 'various':481 'vendor':1214 'verifi':198,206,1248 'vew':1153 'view':256 'vms':1243 'vs':972 'vulner':448 'w':812 'watch':266 'way':35,236,482,573,1022 'wayland':213,232,275,307,309,341,370,407 'weak':1037 'weird':374 'well':16,21,392 'whenev':696 'window':34,262,282 'work':323,368,636,1234,1271 'would':9,675 'writabl':718 'write':839 'written':924 'wrong':437 'x':815 'x11':214,346 'x11-only':345 'xfce':289 'xwayland':351,360 'year':302,1226"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700928097
    +visibility: "visible             "
    +apId: "https://feddit.de/post/6001973"
    +editedAt: DateTimeImmutable @1701462094 {#1793
      date: 2023-12-01 21:21:34.0 +01:00
    }
    +createdAt: DateTimeImmutable @1700841697 {#2402
      date: 2023-11-24 17:01:37.0 +01:00
    }
  }
  -repository: App\Repository\EntryRepository {#270 …}
  -cache: Symfony\Component\Cache\Adapter\TraceableTagAwareAdapter {#600 …}
  -twig: Twig\Environment {#1252 …}
  -requestStack: Symfony\Component\HttpFoundation\RequestStack {#1328 …}
  -security: Symfony\Bundle\SecurityBundle\Security {#1101 …}
}