GitHub - secureblue/secureblue: Images for GNOME and KDE with some hardening applied
github.com
Images for GNOME and KDE with some hardening applied - GitHub - secureblue/secureblue: Images for GNOME and KDE with some hardening applied

As part of the effort of making a “Chromebook-like” secure, autoupdating, cloud-native, “unbreakable” (but still free and privacy-friendly) Distro, I would like some of your recommendations on especially secure software, that could replace common ones like File managers, Archive Managers, PDF reader, Image viewer etc.

I am thinking of Loupe, GNOMEs new image viewer written in Rust, that opens SVGs in a sandbox to avoid issues here.

Memory safety, resonable simplicity, updated code, these should be requirements.

Any other recommendations? Thanks guys!

Btw Flatpaks are working now! Come and test Secureblue!

  • @[email protected]OP
    12•1 year ago

    Firejail has some big security flaws. There us bubblejail, which uses the way better bubblewrap also used for Flatpaks.

    But the Bubblewrap and Flatpak Situation is quite complex. Flatpaks, as well as Podman containers, require user namespaces. Through these namespaces programs can get privileged access to system components, which is why secureblue now has bubblewrap-suid installed.

    bubblejail maybe uses that binary already, or it needs to be patched too.