Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Secureblue: Hardened Immutable Fedora Images

github.com

Post reply on HN
Print view View original

21–30 of 51 posts

Re: Secureblue: Hardened Immutable Fedora Images

#21

Post by 15457345234 »

Retr0id wrote: post #13
yjftsjthsd-h wrote: post #10

So I'm not against it in the general case, but there are some very specific tradeoffs being made here. > The following are not in scope for this project: > Anything related to increasing "privacy", especially when at odds with improving security > Anything related to "degoogling" Frankly, knowing nothing further, I'm a little concerned that degoogling would be necessary. Like, is that just because the system bakes in…

"degoogling" is nice in theory but I've rarely seen it done well in practice. There are either severe UX tradeoffs, or security pitfalls where maintainers mess with configs they don't actually understand. Having not looked at this project in detail, perhaps it suffers the same fate regardless, but I do find their classification of it as a non-goal to be broadly reassuring. "Not talking to google" might be more import…

> "degoogling" is nice in theory but I've rarely seen it done well in practice.

Install Kali. There - unless you count Firefox - you have a viable 'degoogled' desktop.

Re: Secureblue: Hardened Immutable Fedora Images

#22

Post by 0cf8612b2e1e »

What is considered the most security conscious OS today? What is the most secure OS that can be run without enormous pain?

I am about to rebuild my machine, and have been toying with switching to Qubes or Fedora Silverblue + distrobox, but would love to hear if there are better options available today.

I install so much developer tooling it seems inevitable that a bad actor can slip in and upload my $HOME. Trying to ascertain a practical way of segregating personal data from applications. I already run some apps in VMs, but trying to become a bit more rigorous about isolation.

Re: Secureblue: Hardened Immutable Fedora Images

#23

Post by secureblue »

secureblue wrote: post #14
yjftsjthsd-h wrote: post #10

So I'm not against it in the general case, but there are some very specific tradeoffs being made here. > The following are not in scope for this project: > Anything related to increasing "privacy", especially when at odds with improving security > Anything related to "degoogling" Frankly, knowing nothing further, I'm a little concerned that degoogling would be necessary. Like, is that just because the system bakes in…

I'm a little concerned that degoogling would be necessary. I don't follow. The readme specifically says it's not in scope. How much of the user's privacy is this thing selling away in the name of "security"? Nothing more or less than upstream fedora. The point of putting that in there is to make it so we don't get people opening issues to ask us to switch to Brave or what have you. tradeoff Yes, it's a tradeoff and i…

As a follow up to this, given that bubblewrap-suid without userns vs bubblewrap with userns is a tradeoff, I could make it so both variants are published. This would give users choice between the two and be less opinionated. If this is wanted please open an issue for it and I'll add it.

Re: Secureblue: Hardened Immutable Fedora Images

#24

Post by Garcia98 »

INTPenis wrote: post #2

Most of this can be done with Ansible. So why should I download images from a 3rd party outside of the Fedora project? If you really want to harden an OS with a good SElinux implementation you should try enabling user roles. Last time I tried that was maybe Fedora 20 something and it broke a lot.

I see this (and other ublue images) as an alternative to Ansible, rather than just an image. I could fork this repo, automate PRs from upstream with a GH action while making my own changes to it and keep an automated CI/CD pipeline. This painless extensibility is a big advantage imo over traditional distributions.

Re: Secureblue: Hardened Immutable Fedora Images

#25

Post by _factor »

0cf8612b2e1e wrote: post #22

What is considered the most security conscious OS today? What is the most secure OS that can be run without enormous pain? I am about to rebuild my machine, and have been toying with switching to Qubes or Fedora Silverblue + distrobox, but would love to hear if there are better options available today. I install so much developer tooling it seems inevitable that a bad actor can slip in and upload my $HOME. Trying to…

An SEL4 kernel based os, but they’re few and far between for desktop use for some reason.

Re: Secureblue: Hardened Immutable Fedora Images

#26

Post by rustcleaner »

0cf8612b2e1e wrote: post #22

What is considered the most security conscious OS today? What is the most secure OS that can be run without enormous pain? I am about to rebuild my machine, and have been toying with switching to Qubes or Fedora Silverblue + distrobox, but would love to hear if there are better options available today. I install so much developer tooling it seems inevitable that a bad actor can slip in and upload my $HOME. Trying to…

[dead]

Re: Secureblue: Hardened Immutable Fedora Images

#28

Post by yjftsjthsd-h »

secureblue wrote: post #14
yjftsjthsd-h wrote: post #10

So I'm not against it in the general case, but there are some very specific tradeoffs being made here. > The following are not in scope for this project: > Anything related to increasing "privacy", especially when at odds with improving security > Anything related to "degoogling" Frankly, knowing nothing further, I'm a little concerned that degoogling would be necessary. Like, is that just because the system bakes in…

I'm a little concerned that degoogling would be necessary. I don't follow. The readme specifically says it's not in scope. How much of the user's privacy is this thing selling away in the name of "security"? Nothing more or less than upstream fedora. The point of putting that in there is to make it so we don't get people opening issues to ask us to switch to Brave or what have you. tradeoff Yes, it's a tradeoff and i…

> I don't follow. The readme specifically says it's not in scope.

Let me rephrase: What is your distro doing that would make someone want to degoogle it?

Re: Secureblue: Hardened Immutable Fedora Images

#29

Post by Hizonner »

No threat model given.

> Adds per-network MAC randomization

Where the heck is this thing being used?

> Setting more restrictive file permissions (Based on recommendations from lynis)

Often results in more code being run privileged...

> Brute force protection by locking user accounts for 24 hours after 50 failed login attempts, hardened password encryption and password quality suggestions

Introduces a serious DoS vulnerability.

> Disabling unprivileged user namespaces

> Replacing bubblewrap with bubblewrap-suid so flatpak can be used without unprivileged user namespaces

Trading off possible kernel bugs against letting a whole LOT of userspace software run with real root privilege. And flatpak is a lot of attack surface no matter how you run it, and the packages have a bad security reputation.

> Installing Chromium into the base image (Why chromium?) (Why not flatpak chromium?)

Just more attack surface if you didn't remove Firefox.

> Including a hardened chromium config (disabling JIT javascript)

... and pushing everybody into a less tested code path.

Again, what is this trying to solve?

Re: Secureblue: Hardened Immutable Fedora Images

#30

Post by yjftsjthsd-h »

Retr0id wrote: post #13
yjftsjthsd-h wrote: post #10

So I'm not against it in the general case, but there are some very specific tradeoffs being made here. > The following are not in scope for this project: > Anything related to increasing "privacy", especially when at odds with improving security > Anything related to "degoogling" Frankly, knowing nothing further, I'm a little concerned that degoogling would be necessary. Like, is that just because the system bakes in…

"degoogling" is nice in theory but I've rarely seen it done well in practice. There are either severe UX tradeoffs, or security pitfalls where maintainers mess with configs they don't actually understand. Having not looked at this project in detail, perhaps it suffers the same fate regardless, but I do find their classification of it as a non-goal to be broadly reassuring. "Not talking to google" might be more import…

> "degoogling" is nice in theory but I've rarely seen it done well in practice. There are either severe UX tradeoffs, or security pitfalls where maintainers mess with configs they don't actually understand.

As heuristics go that's how I feel about many "security" respins

Post reply on HN