Secureblue?

[http]

@ryrona

I doubt that to be true. It is hard to do worse than Debian, and KickSecure’s goal is very expressively to do better than Debian on all fronts. I also doubt GrapheneOS developers have said this, since they never speak without having merits to what they say. A reference to where this was stated would be welcome.

I don’t think it was a GrapheneOS dev that said that, just someone in the GrapheneOS community (on the forum I think).

@ryrona

Yes, and yes.

Relevant ticket filed by one of the QubesOS developers:

I can see there has been a ticket there, but no replies to it? Is secureblue really being considered seriously as a future template? I can imagine that the wayland only policy of secureblue is a big obstacle (although I really do want to see wayland come to qubesos)

@ryrona

This is actually not true. The whole thing with Whonix is the gateway-workstation separation using virtual machines. That is what the security in Whonix relies on, and that is a very strong isolation that provides very tangible security and privacy guarantees. KickSecure itself is a very modest improvement over Debian, and it lacks that separation.

Yes I understand that, but the base install is the same isn’t it?

@ryrona

but also contains some additional security improvements, like the hardened_malloc project from GrapheneOS, which increases likelihood of stopping exploits in most apps.

I do like the sound of this, but kicksecure says that hardened_malloc hardly works with anything, such as many programs (firefox and probably many others) not working. It also says flatpaks don’t work with it, although this is confusing as secureblues main method of installing programs is via flatpak? Are many programs incompatible with secureblue, for example, KiCad?

I haven’t given secureblue a try yet but do plan to so I can try an see for myself how program compatibility is.