“Systemd provides a lot of network functionality in systemd-networkd, journald, timesyncd, etc. that is remote attack surface. All the systemd “cloud of daemons” is tightly coupled by dbus interfaces that enable an attacker to move from one exploited system service to the next. Even if the attacker doesn’t manage to find an exploit in another system service, DoS is easily possible because the DBUS interfaces are quite fragile. Even as a benevolent admin it is easily possible to get the system into a state where e.g. clean shutdown is no longer possible because systemctl doesn’t want to talk to systemd any longer and you cannot fix that. systemd-udevd also has raceconditions galore, so sending any message to it in the wrong order relative to another one will kill the system, maybe even open exploit vectors. At the very least I would, for hardening, recommend not using any network-facing systemd functionality.
And lines of code are not ridiculous, they are the best first-order estimate available. Of course an actual inspection of the code is better for a comparison, but that is a huge task. sloccount is quick and easy.”
Like some have mentioned, if you want to try different distros setup a VM (I would recommend KVM for better performance, but virtualbox is easier for beginners in VMing) with the iso of the distro you want to test out.
Like this you can keep a functional system without the hassle of having to setup on baremetal just for testing and having to go back again if doesn’t pay-out.
Also would suggest messing around with more tech-savy setups like debian and fedora (specially minimal ones) if you want to delve deeper into the Linux nerdiness.
Getting rid of WhatsApp is the most challenging part for sure, specially because people at work choose to use this platform. Funny enough, signal is basically the same as WhatsApp and easily accessible on the play store but people refuse to use since they are accustomed to WhatsApp and because the illiteracy on these kind of technologies.
Still the exploit is easier to avoid compared to windows viruses and stuff. Even with the linux popularity increasing there is already out there good solutions to prevent this kinda stuff like have SELinux installed, use firejail to run suspicious files, use proxies to visit weird sites (you can use proxychains + tor, a bit overkill but works if you don’t have a local proxy), etc.
Not to mention that one of the attack vectors of this exploit requires using a systemd feature which is the sysnetd which isnt going to work on other init systems. Reason why a lot of times minimalism can be superior to just having all the features + unnecessary ones out of the box.