mirror of
https://github.com/privacyguides/privacyguides.org.git
synced 2025-07-24 12:21:09 +00:00
update: Linux Overview security updates (#2690)
- Remove Wayland section - Add Permission Controls section Signed-off-by: Daniel Gray <dngray@privacyguides.org> Signed-off-by: Jonah Aragon <jonah@privacyguides.org>
This commit is contained in:
@@ -16,7 +16,7 @@ Linux distributions are commonly recommended for privacy protection and software
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Fedora Workstation** is our recommended distribution for people new to Linux. Fedora generally adopts newer technologies before other distributions e.g., [Wayland](https://wayland.freedesktop.org) and [PipeWire](https://pipewire.org). These new technologies often come with improvements in security, privacy, and usability in general.
|
||||
**Fedora Workstation** is our recommended distribution for people new to Linux. Fedora generally adopts newer technologies (e.g., [Wayland](https://wayland.freedesktop.org) and [PipeWire](https://pipewire.org)) before other distributions. These new technologies often come with improvements in security, privacy, and usability in general.
|
||||
|
||||
[:octicons-home-16: Homepage](https://fedoraproject.org/workstation){ .md-button .md-button--primary }
|
||||
[:octicons-info-16:](https://docs.fedoraproject.org/en-US/docs){ .card-link title=Documentation}
|
||||
@@ -90,11 +90,11 @@ A large portion of [Arch Linux’s packages](https://reproducible.archlinux.org)
|
||||
|
||||
</div>
|
||||
|
||||
[Fedora Atomic Desktops](https://fedoramagazine.org/introducing-fedora-atomic-desktops) come in a variety of flavors depending on the desktop environment you prefer, such as **Fedora Silverblue** (which comes with [GNOME](https://gnome.org)), **Fedora Kinoite** (which comes with [KDE](https://kde.org)), **Fedora Sway Atomic**, or **Fedora Budgie Atomic**. However, we don't recommend the last of these as the Budgie desktop environment [still requires X11](https://buddiesofbudgie.org/blog/wayland).
|
||||
[Fedora Atomic Desktops](https://fedoramagazine.org/introducing-fedora-atomic-desktops) come in a variety of flavors depending on the desktop environment you prefer. As with the recommendation to avoid X11 in our [criteria](#criteria) for Linux distributions, we recommend avoiding flavors that support only the legacy X11 window system.
|
||||
|
||||
These operating systems differ from Fedora Workstation as they replace the [DNF](https://docs.fedoraproject.org/en-US/quick-docs/dnf) package manager with a much more advanced alternative called [`rpm-ostree`](https://docs.fedoraproject.org/en-US/fedora/latest/system-administrators-guide/package-management/rpm-ostree). The `rpm-ostree` package manager works by downloading a base image for the system, then overlaying packages over it in a [git](https://en.wikipedia.org/wiki/Git)-like commit tree. When the system is updated, a new base image is downloaded and the overlays will be applied to that new image.
|
||||
|
||||
After the update is complete you will reboot the system into the new deployment. `rpm-ostree` keeps two deployments of the system so that you can easily roll back if something breaks in the new deployment. There is also the option to pin more deployments as needed.
|
||||
After the update is complete, you will reboot the system into the new deployment. `rpm-ostree` keeps two deployments of the system so that you can easily roll back if something breaks in the new deployment. There is also the option to pin more deployments as needed.
|
||||
|
||||
[Flatpak](https://flatpak.org) is the primary package installation method on these distributions, as `rpm-ostree` is only meant to overlay packages that cannot stay inside of a container on top of the base image.
|
||||
|
||||
@@ -124,7 +124,7 @@ The Nix package manager uses a purely functional language—which is also called
|
||||
|
||||
[Nixpkgs](https://github.com/nixos/nixpkgs) (the main source of packages) are contained in a single GitHub repository. You can also define your own packages in the same language and then easily include them in your config.
|
||||
|
||||
Nix is a source-based package manager; if there’s no pre-built available in the binary cache, Nix will just build the package from source using its definition. It builds each package in a sandboxed *pure* environment, which is as independent of the host system as possible, thus making binaries reproducible.
|
||||
Nix is a source-based package manager; if there’s no pre-built available in the binary cache, Nix will just build the package from source using its definition. It builds each package in a sandboxed *pure* environment, which is as independent of the host system as possible. Binaries built with this method are reproducible, which can be useful as a safeguard against [:material-package-variant-closed-remove: Supply Chain Attacks](basics/common-threats.md#attacks-against-certain-organizations){ .pg-viridian }.
|
||||
|
||||
## Anonymity-Focused Distributions
|
||||
|
||||
@@ -231,8 +231,8 @@ Choosing a Linux distro that is right for you will come down to a huge variety o
|
||||
|
||||
- Free and open source.
|
||||
- Receives regular software and kernel updates.
|
||||
- [Avoids X11](os/linux-overview.md#wayland).
|
||||
- The notable exception here is Qubes, but the isolation issues which X11 typically has are avoided by virtualization. This isolation only applies to apps *running in different qubes* (virtual machines); apps running in the *same* qube are not protected from each other.
|
||||
- Avoids X11, as its last major release was [more than a decade](https://www.x.org/wiki/Releases) ago.
|
||||
- The notable exception here is Qubes, but the [isolation issues](https://blog.invisiblethings.org/2011/04/23/linux-security-circus-on-gui-isolation) which X11 typically has are avoided by virtualization. This isolation only applies to apps *running in different qubes* (virtual machines); apps running in the *same* qube are not protected from each other.
|
||||
- Supports full-disk encryption during installation.
|
||||
- Doesn't freeze regular releases for more than 1 year.
|
||||
- We [recommend against](os/linux-overview.md#release-cycle) "Long Term Support" or "stable" distro releases for desktop usage.
|
||||
|
Reference in New Issue
Block a user