Linux for laptop

Hello, Lain. I am working for a company that has close ties to a government that's in bad relations with the US government. I need a Linux setup for my laptop. Specifically, I want to know if Lain knows any Linux distros that come preconfigured out of the box for minimalised power usage, while retaining functionality and stability, also, ideally, without systemd. In the past, I've used Archlinux, but the rolling release model and the amount of time it takes to actually configure it to my taste left me unsatisfied. That, and the fact it's far from being a stable distro. I do have to mention, I work in IT, and my Linux experience isn't limited to Arch. I've used OpenSUSE for years, and I work with debian-based servers daily, so I know my way around Linux.

Devuan. It's just Debian without the whole Systemd soykaf, that includes all the pros and cons. I personally use it on my laptop and cannot complain.

>>20327 I'm a little confused about your specific needs. >low power This is understandable >function and stable For what? >without systemd This is understandable. >Archlinux, but the rolling release model and the amount of time it takes to actually configure it to my taste left me unsatisfied You want something out of the box. This is understandable. What confuses me is "function and stable" as well as your mention of the US government. Are you saying that you need something that will protect you from the US government's eyes? Your only real option, for out of the box, is "heads", which is a systemd-less version of Tails. Alternatively, you can use something like devuan, but you'll need to correct the extremely permissive behavior natural to most linux distros, as well as setting up certain features (LVM+LUKS [or some other type of setup], Using macchanger prior to connecting to things, etc.) It may be best to create your own solution. I know that Gentoo tends to be a meme to people, but if you have the resources (a powerful desktop), then setting up a laptop should be fairly quick for the compilation process. Of course, your complaint about arch could easily nullify this solution. (It is my solution, for example.) But I can also take the time to deal with things.

>>20328 True, I should have specified what I meant. My initial post was directed at 4channel, but those people are fuarrrking useless, as usual. When I mentioned the US government, I meant no Windows or Mac, as people on said imageboard website like to wage slave these two options a lot. I don't need a very high level of privacy, as I have very good relations with my own government (not to say I don't need privacy at all, all my hard drives are encrypted and I have good security practices, as well as avoiding anything telemetry like the plague, it's just that I don't see myself getting arrested, at all), so, no Tails or Qubes. By stable I meant something that's not rolling release, and something where packages get sufficient testing before being pushed to the stable branch. Here, my experience with Arch makes me wary because this thing broke on me every major update, so I had the temptation to just stay on one version, which would be wrong, as I still need the security updates, which, rolling release model suggests against, as that would be considered a partial update. By functional, I meant something that's capable of running a multitude of programs like the JetBrains IDEs, certain pentesting utilities, appimages, crypto wallets, etc. I see a trend of "minimalist" distros coming gimped out of the box where their minimalism is so radical if makes it impossible for me to even properly launch an appimage which I need for my work. That, and an interface which can be navigated without learning a million keyboard shortcuts. The very least I need from an interface is a start menu button. But that's about it.

>>20331 If you just want something that works, forget all the no systemd, arch, install gentoo memes and go with something like Kubuntu LTS, just configure it to your needs.

>>20332 >forget all the no systemd, arch, install gentoo memes and go with something like Kubuntu LTS, just configure it to your needs. Basically my suggestion, too. Once you find and get something good enough and running, then sure. Delve into the memes / philosophies and try out different stuff on VMs, see what you like. Kubuntu, anything debian-based even, is pretty fine. >>20331 >JetBrains IDEs, certain pentesting utilities, appimages Sounds alot like Kali right out of the box sounds like the quickest way to deploy and setup your environment. you may need to install jetbrains ides, but its straight forward. all your basic pentest apps and more will be there too for sure. I think appimages is on there by default too. (citation needed)

>>20332 >kubuntu Not secure, arguably backdoored, too bloated to actually be energy efficient >>20336 >Kali A massive meme, and something that should only be used in a VM Okay, niggers, I hoped at least someone would give a proper suggestion at least here, but it seems like gentoo + openrc + dwm is unavoidable, along with a couple of wasted hours of configuration. I wish I could just use OpenSUSE Leap without it being either laggy due to no GPU or draining my battery in a second due to a presence of GPU

>>20326 Unironically gentoo would be suitable for this.

>>20326 Try Alpine Linux. It uses musl libc and it doesn't have GNU utils by default (instead it uses Busybox, but you can install coreutils+GNU sed+gawk if you want). As result, Alpine Linux is really lightweight! But you can install a full DE like xfce4, GNU Utils (like gawk, GNU Sed and coreutils), Udev, util-linux, etc. if you want to. See this paste for more details: https://pst.moe/paste/xfkmfy (remember to install and enable tlp as well!) >In the past, I've used Archlinux, but the rolling release model and the amount of time it takes to actually configure it to my taste left me unsatisfied.That, and the fact it's far from being a stable distro. I do have to mention, I work in IT, and my Linux experience isn't limited to Arch. I've used OpenSUSE for years, and I work with debian-based servers daily, so I know my way around Linux. You might want to consider Devuan as well (it's a fork of Debian that doesn't use systemd).

>>20340 my only problem with alpine is openrc. it does package s6 and there are ways to swap to it, but itd be better if they supported it as a full fledged variant rather than something the user has to work out.

>>20331 >4ch You should have known. But now about your needs: imho is Debian/Devuan just the right one for you, especially Devuan because it doesnt have any of that Systemd soykaf. It is pretty straightforward and not too bloated at the same time. Forget about all those Debian based distros, they are always just the same bullshit but with different appearance and security issues.

I've used much of distros, but finally comeback to Arch.

>>20326 Have you considered Endeavour with lts kernal? If you're already comfortable with Arch and need systemd, this serve your needs well enough while still being stable.

>>20338 > Not secure, arguably backdoored, too bloated to actually be energy efficient By default sure, but that is why I recommended that it is configured it to your needs. You asked for a distro that is stable and can run proprietary software like JetBrains IDE, don't complain when I suggest Ubuntu derivatives. > gentoo + openrc + dwm > being either laggy due to no GPU or draining my battery in a second due to a presence of GPU Enjoy it being laggy and draining your battery while compiling your software updates. Or if you don't, then you will be running unpatched software anyway, then don't say you want security.

>>20326 > I am working for a company that has close ties to a government that's in bad relations with the US government. is this relevant in choosing an OS?

Hijacking this thread: Given a corebooted/librebooted system with GRUB2 on ROM, I want to set up FDE with LUKS with a detached header. I cannot seem to find out how to specify that header on boot though. All the information I found was for FDE with everything on one disk. Any pointers?

>>20983 Clarification: I intend to use an SD-Card to put the header on, not a USB drive. It is mostly a consideration of practicality as it's easier to store.

>>20326 Been loving linux laptops made by the company Juno, have had two of them and they are great, they come with ubuntu but I switched the second one to mint.

>>20332 Lain, they literally said they are experienced with linux and have a High threat model. Ubuntu isnt exactly secure and pretty much everyone knows about ubuntu. If it was a solution to their needs, i highly doubt that they would be asking for distros.

Consider Whonix, or, if you are willing to use a bsd, look into openBSD or FreeBSD (openbsd has been toted as one of the most secure OS's for a long time now) Of course if you REALLY want security you can just use qubes with some openbsd vm's but you mentioned power efficiency so thats out the window. Its also worth asking if you are getting a new laptop for this or are you using old hardware? Along with this, are you going to be using arm architecture or x86?

Just use Fedora. IT just works. Other than I think it's pretty cool you can run Linux in your company's desktop, wish I could do the same.

>>20338 gentoo is literally the least energy efficient distro there is. You use more energy installing/compiling the browser than you would use installing 1000 packages in a binary based distro.

>>23328 distcc and friends help reduce that, but most people aren't compiling constantly. And thanks to USE flags, it ends up being more "efficient" for you while actually using it.

How to install a very lightweight, secure, systemd-less linux. ## download devuan stable netinstall iso and verify it: https://mirror.leaseweb.com/devuan/devuan_daedalus/installer-iso/ ## dd it to a usbstick and boot it. ## important: this is how you make the installation minimal: ## during install, in tasksel section, deselect everything except basic tools. ## boot the new installation, log in as the non-root user, ## and immediately set up a firewall (e.g. ufw): su - apt install ufw ufw default deny incoming ufw default allow outgoing ufw enable ## restrict root access: apt purge sudo delgroup sudo groupadd wheel usermod -a -G wheel $(logname) usermod -a -G wheel root nano /etc/pam.d/su ## uncomment the following line: #auth required pam_wheel.so ## set up alternative dns (e.g. cloudflare): apt install resolvconf dnsmasq ## append to /etc/dnsmasq.conf: no-resolv listen-address=127.0.0.1 server=1.1.1.1 server=1.0.0.1 ## append to /etc/dhcp/dhclient.conf: supersede domain-name-servers 127.0.0.1, 127.0.0.1; ## restart dnsmasq service: service dnsmasq restart ## if desired, turn off system logging: service rsyslog stop nano /etc/rsyslog.conf ## comment out the following line: #$IncludeConfig /etc/rsyslog.d/*.conf ## if desired, add backports repo to /etc/apt/sources.list so it looks like this: deb http://deb.devuan.org/merged daedalus main contrib non-free non-free-firmware deb http://deb.devuan.org/merged daedalus-updates main contrib non-free non-free-firmware deb http://deb.devuan.org/merged daedalus-security main contrib non-free non-free-firmware deb http://deb.devuan.org/merged daedalus-backports main contrib non-free non-free-firmware deb-src http://deb.devuan.org/merged daedalus main contrib non-free non-free-firmware deb-src http://deb.devuan.org/merged daedalus-updates main contrib non-free non-free-firmware deb-src http://deb.devuan.org/merged daedalus-security main contrib non-free non-free-firmware deb-src http://deb.devuan.org/merged daedalus-backports main contrib non-free non-free-firmware ## update system: apt update apt upgrade ## if desired, install x and a minimal desktop (e.g. mate-core) apt install xorg lightdm mate-core ## if desired, flesh-out mate with some mate utilities: apt install mate-applets mate-utils mate-media mate-power-manager mate-screensaver ## if desired, install some general utilities: apt install rsync fdisk screen tor ntpdate ntp cryptsetup bleachbit \ build-essential aircrack-ng hping3 hydra medusa nikto nmap ophcrack p0f tcpdump

>>23514 >systemd-less Is there security problems with systemd?

>>23514 that's one way to do it, not bad actually but if you're going that route, why not just use buildroot & busybox... build your own custom hardened kernel and system with the tools you need >>24279 I'll give you one critical sec issue I know off hand... Every time systemd wants to check the time, it pings google's servers. There is a ton of telemetry and sneaky bullsoy added to achieve something that doesn't need it in the first place (an init system).

>>24281 That sounds pretty bad when there is other time servers they could have chosen. I wonder if there is a way to use a radio clock instead which would be more secure than using a time server.

>>24279 The recent XZ backdoor[0] made use of Systemd features (systemd-notify). It also required a downstream patch for OpenSSH that enabled the systemd-notify feature. This clearly demonstrates that having a ton of unneeded dependencies and features is bad. Systemd project should be broken down into several independent components that run without Systemd (like you should be able to use systemd-oomd, systemd-boot and journald without systemd init but you can't because of design of systemD). [0] https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27 Moreover, SystemD is very complex program that's very hard or impossible to fully understand. And it keeps on gaining more functionality. This is also bad because, in time, systemd becomes so entrenched in Linux ecosystem that it becomes too big to fail. And very hard to replace. Luckily, there is OpenBSD and FreeBSD. Just in case... >https://without-systemd.org/wiki/index_php/Arguments_against_systemd/

>>24328 I see. Makes sense enough.

>>20328 >"heads", which is a systemd-less version of Tails smh

>>24328 >I don't understand this thing therefor I won't trust it or use it Smart. >I don't understand this thing therefor nobody should trust it or use it Dumb.

just use one of the artix community isos