Secureblue?

[ryrona]

@http

I don’t think it was a GrapheneOS dev that said that, just someone in the GrapheneOS community (on the forum I think).

Okay.

@http

I can see there has been a ticket there, but no replies to it? Is secureblue really being considered seriously as a future template?

Yes.

@http

I can imagine that the wayland only policy of secureblue is a big obstacle (although I really do want to see wayland come to qubesos)

Yes, that is a blocker, and not the only one. We won’t have a SecureBlue template before we have Wayland in QubesOS, and that is probably still at least one year into the future.

@http

Yes I understand that, but the base install is the same isn’t it?

Yes. both of the two Whonix virtual machines are based on KickSecure.

@http

I do like the sound of this, but kicksecure says that hardened_malloc hardly works with anything, such as many programs (firefox and probably many others) not working.

I believe SecureBlue disagrees with the “hardly works with anything” part, since they have it enabled for everything by default, and don’t have exceptions, yet it works mostly fine. Though, third-party web browsers does not start, only Trivalent works.

@http

It also says flatpaks don’t work with it, although this is confusing as secureblues main method of installing programs is via flatpak?

Yeah, it is enabled for Flatpaks. That should work. I haven’t heard anything else.

@http

Are many programs incompatible with secureblue

Likely many, yes. They aim for high app compatibility, but security improvements are almost always at odds with app compatibility. You have to try out yourself if the apps you want to use works or not.

@http

I haven’t given secureblue a try yet

Me neither

One day when I have some time I will try it out for myself, and do some audits of it myself.