Split "something" and other paranoia gimmicks - what would you setup for end users' Qubes OS installation by default?

[Schnur]

https://forum.qubes-os.org/t/replacing-passwordless-root-with-a-dom0-prompt/
https://forum.qubes-os.org/t/fortifying-sys-net-a-shift-to-openbsd/
https://forum.qubes-os.org/t/easy-sys-i2p/

And something I haven’t done myself yet:
You know how you can set a default kernel? I’d love to have a second stream, a second default option, where you can set an hardened kernel instead - automatically created. So likely this:

More complete (slightly) instructions for compiling a custom kernel

The kernel instructions to compile your own kernel at Managing qube kernels | Qubes OS seem incomplete, so I’m making a slightly more complete version here: do: sudo qubes-dom0-update qubes-kernel-vm-support kernel-devel Find a valid version (which will eventually be used as a parameter for qubes-prepare-vm-kernel) by doing:ls /usr/src/kernels/ each subdirectory name should be a valid version, and will be a valid parameter for qubes-prepare-vm-kernel. Pick a subdirectory / version and ente…

GitHub - anthraxx/linux-hardened: Minimal supplement to upstream Kernel Self...

Also, why not GitHub - GrapheneOS/hardened_malloc: Hardened allocator designed for modern systems. It has integration into Android's Bionic libc and can be used externally with musl and glibc as a dynamic library for use on other Linux-based platforms. It will gain more portability/integration over time. · GitHub