https://culug.group logo
Join Discord
Powered by
found this in a blog post i was reading
# show-and-tell
r
j
compliance is super tough on NixOS, too, because most frameworks don't know how to account for anything outside of Fedora-based or Debian-based distros
Not necessarily a NixOS weakness, but rather security/compliance people not knowing Linux
r
yeah, that makes sense but is also kind of scary imo
the blog post was about hardening nixos, i think the pci compliance thing was a joke
j
The sad part about it is general (i.e. not ones specific to NixOS, Arch, Linux, etc.) security/hardening frameworks is that they often focus on implementations rather than principles. Which is pretty dumb on Linux, because you have so many choices
r
yeah, that does kinda suck
ive been looking into it because ive come to realize that while qubes makes it really easy to be secure, it also makes it hard to do anything useful
so im trying to find a good middle ground, cuz qubes is honestly overkill
j
I haven't looked into it lately because of incomplete NixOS support and the inability to use custom DNS servers with it (last time I looked) but Portmaster looks like a really promising middle-ground contender in my opinion: https://safing.io/
On MacOS, I've used LuLu -- application firewalls are so great for restricting your network traffic. With Linux's somewhat recent adoption of eBPF, there is plenty of capability to inspect/restrict network traffic from a desktop user context, but there just aren't many tools that actually do it in a user friendly way
i.e. you got guys like Netflix going super hard with optimizing eBPF, but normal people aren't really able to do the same
r
ok, sweet
ill look into it
j
The other ding for me against Qubes for me is that with X11 support being phased out by most distros over the next ten years, it feels fragile to rely on X11 forwarding hacks to achieve sandboxing. I doubt Wayland will be in a spot anytime soon for Qubes to replace it, too. Is there any plan on their part to replace Xorg? (Or have they already done it?)
r
i think there is a plan but they are still currently on xorg (but there's an option in the installer to install sway packages that's marked as experimental so i think they might be close)
PreviousNext
Powered by