Desktop Linux is insecure
&gt; <i>It’s interesting to consider a Linux distribution that fixes these problems. I’ve thought a little bit about a secure linux desktop. But alas, what a waste of time that would be, right?</i><p>It&#x27;s called QubesOS.<p><a href="https:&#x2F;&#x2F;www.qubes-os.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.qubes-os.org&#x2F;</a><p>It&#x27;s, if not an operating system directly, then a meta-operating-system and set of tools to allow you to easily interopreate a range of siloed VMs on top of a stripped Xen hypervisor.  You can easily create, destroy, and use VMs, which can either be fully standalone, fully disposable (no disk state persists past the reboot), or, in the usual configuration, have a persistent home directory and template-based ephemeral root directory.  Perks of that, you can update the template VM (via some reasonably thought out methods) and update all the software in the derived VMs as well.<p>I&#x27;ve been using it as my primary desktop OS now for... oh, two years and change, perhaps?  It&#x27;s a bit like a virus, in a way - you install it on some random test machine, get a feel for it, and then install it on more machines, and it just kind of spreads around your network until you realize you&#x27;ve been working in Qubes for some while now and it&#x27;s fine.<p>The security model is basically, &quot;Anything in a VM can be assumed to access anything else in that VM.&quot;  So you silo things off, and if you&#x27;re doing anything with unknown data (random PDFs, perhaps), you open it in a disposable VM (and there are some neat &quot;render safe&quot; capabilities that will then provide, back in your trusted VM, an image based version of a PDF file minus any bonus capabilities it might have come with).  So you silo things.  For instance, I do most of my &quot;casual web browsing&quot; in a disposable VM and I reboot that regularly.  A full compromise of that browser stack gets you... the other tabs I have open, and perhaps a random file or two I downloaded.  It doesn&#x27;t get you anything of interest, as I also don&#x27;t log into core accounts in that browser (I have another VM for core web activities that doesn&#x27;t visit random sites).<p>The main downside is no GPU acceleration of anything (framebuffer only), but it&#x27;s somewhat less limiting than I&#x27;d assumed, and most of my machines maintain a dual boot of Ubuntu for anything GPU intensive, though I honestly use it a lot less than I&#x27;d assumed.<p>And while it sounds like it would be resource intensive, and it can be, it&#x27;s worth trying if you have less RAM than you might think.  My &quot;daily driver laptop&quot; is a 2C&#x2F;4T 5th Gen i7, with 16GB RAM.  Gutless wonder, and I didn&#x27;t expect much out of Qubes on it, but it actually works just fine (though I admit I&#x27;m not nearly as hard on computers as I used to be in terms of what I expect out of them).<p>Clipboards are mentioned, and Qubes neatly solves that too, because you have separate keyboard shortcuts to move clipboard contents around - it&#x27;s not hard to copy&#x2F;paste between VMs (or move files between them), but &quot;root in a VM&quot; only gets you things pasted into that VM (unless you pop Xen and migrate to dom0, at which point it&#x27;s rather game over, but... theoretically, that&#x27;s a harder exploit chain than getting out of a browser).<p>Also, as far as browser go, <i>disable your Javascript JIT engine.</i>  No, I did <i>not</i> say &quot;Disable Javascript.&quot;  I said, &quot;Disable your Javascript JIT engine.&quot;  There are ways to do it on most browsers, and in exchange for slightly reduced daily performance and slaughtered Javascript benchmark performance, you remove an awful lot of complex attack surface in the browsers.<p>My problem with containers and sandboxes is that they rely an awful lot (entirely?) on the Linux kernel not being able to be exploited, and my general assumption for years now is that a local root exploit is worth about $0, because they&#x27;re reasonably common and easy to find.  It&#x27;s not exactly true, but it&#x27;s closer to true than not, so I assume any arbitrary code running on my machines, if it so desires, can compromise the kernel.  Sandboxing and containers are convenient to prevent well behaved application deployments from interfering with each other, but they&#x27;re not sufficient against potentially malicious applications.  It&#x27;s a pessimistic view, but the last decade of computer security is pretty clear that the pessimists a decade ago were far, <i>far</i> too optimistic.<p>Anyway, long post, short summary, &quot;We probably shouldn&#x27;t have put computers in everything.&quot;