What is the most secure FOSS operating system with Internet access?

Random people say Arch Linux, OpenBSD or Qubes, but it is true that Arch Linux is secure to an extent if it is fully hardened, but not as secure as OpenBSD, so is OpenBSD secure? Qubes is a good approach to an OS, but it's Xen security, not OS security, and I'd rather run a secure OS other than Fedora or Debian on Qubes. And I've heard that Chrome OS/Chromium OS has the highest security of any Linux OS, but it's not more secure, it's just more limited. But that, like Qubes, goes back to the drawing board. So which OS is the most secure? Maybe Multics (better protection rings than Linux, OSX or Windows)? I use the most aggressive attackers as my threat model.

I have also heard that the Windows NT kernel design, although not FOSS, is better than Linux, BSD and OSX because it is based on OpenVMS knowledge.

Based on my research, I would suggest seL4 microKernel running on ARM-64 hardware with Genode built variant of Linux.

AFAIK seL4 is the only formally security verified kernel for specific hardware. See their website for verification status of different hardware configurations.

The closest widely used system is Apple OSX which in turn was evolved from CMU Mach. The critical aspect is keeping the smallest possible attack surface, which is why capability based message-passing microkernels are more resilient than monolithic kernels.

I came here to suggest Genode as well. Default deny goes a long way toward stopping trouble.

> I use the most aggressive attackers as my threat model.

Is that what you chose out of interest, or do you actually need it? I will assume the former, because that's how your question sounds.

My answer in that case would be: you need to work on your threat model. It is tempting to say "I want the best security, therefore I will define my threat model as 'the most aggressive one'". But that is a fallacy: the best security model is the one that fits your use-case best, not the one that defends against most attackers.

Security is always a tradeoff. Remember that you need security fundamentally because what you want to do has some inherent risk (small or high). The whole point is to decide what risk you can afford and find a security model that is acceptable under those conditions. If you say "I can't take any risk at all", then the answer is always "don't do anything at all".

But if you say "I am making a connected fridge for my home and I really want to make sure that the NSA won't be able to shut it down remotely", then the answer is most likely that your threat model is wrong. Because you actually don't really care about the NSA shutting down your fridge: you can probably live with that risk.

To go back more concretely on your specific question ("which OS should I use against the most aggressive attacker?"), it means that you are probably simply not competent to defend against the most aggressive attacker. There is no such thing as "the most secure OS" if you don't know how to configure and use it properly, and there is arguably no such thing as "security against the most aggressive attacker".

If that's out of interest, I would suggest you pick a realistic threat model and try to reason about it. If you have an actual need (e.g. you need to contact a journalist or something), then try to be more specific than "the most aggressive attacker".