Thoughts on madaidans?

I've recently actually read through his article about the security holes in the Linux kernel[1], and the issues he brings up seem very serious. If i don't want to use windows or mac for privacy reasons, what OS should I use instead? Or are those issues not relevant for the average user? He recommends QubesOS as an alternative, but is it actually stable and usable today? I'm particularly interested in OpenBSD, but I'm afraid they have the same issues that Linux has. [1] https://madaidans-insecurities.github.io/linux.html

Madaidan is a fearmongerer. Most of the stuff he lists is either not actually that serious or is entirely hypothetical (for instance, his criticism of firejail is "it's a setuid executable"). He has a tendency to just take Microsoft's word at face value. The only big, valid criticism he makes of linux is that privilege escalation is far too easy. >He recommends QubesOS as an alternative, but is it actually stable and usable today? Yes. >I'm particularly interested in OpenBSD, but I'm afraid they have the same issues that Linux has. OpenBSD is completely different

>>20795 Nah, they are not relevant, and generally they are at local level and not remote. Windows is obviously far more worse than Linux in sec, and Linux is worse than OpenBSD in sec. Just make sure to not install weird programs on your PC. I will say the best way to secure your system is 1. Encrypting the drive, so if someone steals your PC they can't do anything without the password 2. Use a password on the BIOS so they cannot boot into a Flash Drive 3. Idk what more lol

>>20795 >He recommends QubesOS as an alternative, but is it actually stable and usable today? QubesOS is a Linux distro. It's stable but not very usable. >>20799 this. >1. Encrypting the drive, so if someone steals your PC they can't do anything without the password >2. Use a password on the BIOS so they cannot boot into a Flash Drive >3. Idk what more lol Read https://wiki.archlinux.org/title/Security Some ideas: * Upgrade your OS and programs/ports often. * Avoid installing bad software (for example, don't use proprietary password managers. Just use keepass/keepassxc). * Don't run random shell scripts, without reading them first (and understanding what they do). * (cont.) Do not pipe curl into sh (curl ... | sh) * Check what daemons you are running (disable the ones you don't need) * Disable the local socket on Xorg: https://wiki.archlinux.org/title/xinit#xserverrc * Don't run Xorg as root (if you don't use Logind/Elogind, you can still start it without root: startx -- vt1 (Assuming you are logged in vt1)). * (cont.) You can alternatively use Sway + seatd. * Use firewall (like ufw) * Look into Bubblewrap or FreeBSD jails (there is a book about them by Michael W. Lucas). * Use MAC (like AppArmor). * If you visit suspicious sites or like privacy, use Tor or i2p. * Use uBlock Origin and NoScript (on Chromium, use uBlock Origin to block JS). * There are some Linux kernel cmdline options that can be enabled (in /etc/default/grub): ** nosmt ipv6.disable=1 mitigations=auto sysctl.kernel.unprivileged_userns_clone=0 ** page_alloc.shuffle=1 init_on_alloc=1 ** module_blacklist=pcspkr,bluetooth,btusb,btrtl,btintel,btbcm,uvcvideo,vivid ** apparmor=1 security=apparmor lsm=capability,landlock,yama,apparmor" If you want to compile the kernel yourself, then I highly recommend you install Gentoo (to get updates automatically). On *BSD, compiling kernel yourself doesn't have many benefits (on Linux there are some hardening options that are often disabled). tl;dr version of configuring, building and installing the Linux kernel: USE="symlink initramfs" emerge sys-kernel/gentoo-sources sys-kernel/linux-firmware sys-kernel/genkernel # /usr/src/linux should be symlink to the latest version of kernel sources. # you can use symlink USE flag (automatic) or eselect kernel (semi-manual) to manage the symlink cd /usr/src/linux # if you are upgrading, copy the old .config file from the old kernel src dir and run: # make oldconfig # use hwinfo, dmesg, lspci, Gentoo wiki pages, emerge output, etc. to select the required config options. # Pro Tip: it is recommended to select display drivers as modules. # Pro Tip: press ? to get help on the highlighted config option. # Pro Tip: press / to search for config options (You can use number keys to jump to a search result) # Pro Tip: you don't have to (or shouldn't) enable NTFS write support in the kernel. you should use sys-fs/ntfs3g instead. make menuconfig # build and install the kernel and the modules: make -j4 make modules_install make install # rebuild initramfs and update Grub # Important: https://wiki.gentoo.org/wiki/Microcode genkernel --microcode --install initramfs # you could also use dracut grub-mkconfig -o /boot/grub/grub.cfg

>>20800 >QubesOS is a Linux distro. It's stable but not very usable. Arguably this is not true. It's a Xen hypervisor running Linux guests.

>>20800 I really appreciate you putting the effort to make this post. Lots of important info that I didn't knew about.

>>20795 Madaidan's blog posts are written for digital security researchers to read--people who primarily work with computers in the context of pure security and implementing said security or theorizing it. Their various posts are examples of both of these. However, users seem to interpret said posts as tutorials or guidelines that all should specifically follow, despite that never being said and Madaidan themself (if I remember correctly) stating that the posts are not definitive guides everyone needs to follow in chatrooms in the past. If Madaidan's posts were meant for everyone to follow and read, surely they would include simple details such as threat modeling.

I only really care for his Linux hardening page because I'm too lazy to just write down all the kernel option myself in a txt file which I should probably do eventually Never quite liked the Windows dicksucking, Linux isn't without fault but telling someone to use Windows 11 S mode is cruel lol

>>20859 i dont have link here on this machine but there is a openbsd hardening guide book freely available as a website. Used to be shared around like the bible. It goes through all steps to harden openbds.

I believe that OpenBSD is better than Linux when it comes to security, but should be used as guest systems or you should have different computers for different purposes

You should take note that he is NOT an actual security researcher. I don't know what's happening nowadays that people call themselves "security researchers" because they follow some security news sites. Although he also calls himself a Whonix developer, meanwhile his whole work is a couple of "fix typo" commits until this day. Also the hardening guide is pretty much a copy from something called theprivacyguide1.