That depends.
If this is a Linux guest on a Linux host and both are just your average distros, then it’s fine~ish. It’s not 100% safe as some malware is able to escape a VM, see this for a recent example of this.
Doing your shady stuff within a disposable air-gapped[1] VM on a RISC-V powered Sculpt OS host should be pretty safe, though.
In this context, I just mean it has only had the least amount of possible privileges/capabilities during its lifetime. ↩︎
in general: for my personal daily use pc. I download 🏴☠️ files and software for websites around the internet, so it would be nice have an antivirus
Aight. Understood. Thank you for the clarification!
So…, now it becomes a question of how paranoid security-sensitive you are 😅. I suppose relying on a distro with pretty decent security defaults (like e.g. Fedora or openSUSE) makes sense for a start. Furthermore, definitely commit to best practices[1]. As for the scanning part, other comments have already touched on that.
If the PC you’re doing this contains sensitive information OR you’re not satisfied with the provided “probably good enough” solution, then consider going “the extra mile”. Which would involve the use of specialized OSes, relying on VMs and whatnot. But I digress…
in specific: i want to self host services in my home server, so i want it to be secure and protected
Unfortunately, I’m not confident talking on servers specifically. It’s simply not something I’ve put serious thoughts to yet. I hope someone else will touch on that 😉.
A lot can be said on this, but it would dominate this text if I’d try to touch on it. ↩︎
OP, I’ll be honest with ya: if you’re looking for something akin to M$ Defender but on Desktop Linux (and free), you ain’t gonna find it.
A quick look at your Lemmy history suggests that you’re security-conscious. In that context, it’s worth noting that ‘Linux’ does provide you. However, depending on your situation and/or threat model, this might come at the cost of expertise.
If you never download random stuff from the internet, then your average distro might be sufficient as long as you commit to the most basic set of best practices.
However, if you do download random stuff from the internet OR if your situation and/or threat model warrants a more conscious approach, then things might change substantially.
But before subjecting you to Qubes OS, we’d have to know more about your situation. So, first of all, could you elaborate on your use case of ClamAV? Or, perhaps even what you intend to do in general?
FWIW, Lenspect is not capable of selecting a folder and scanning all of its contents[1] (yet). For that (and more), there is vt-cli (source); maintained by (more or less) the same people that brought us VirusTotal. List of repos in which it’s found.
Like what you’d probably want to do after extracting an archive. ↩︎
I’d argue it’s mostly polarizing; proponents love it, while detractors hate it. A nuanced discussion is what we’re missing…
It looks like the best options for immutable have a learning curve or time commitment attached (e.g. NixOS). For a daily driver computer it might be worth the trouble to learn, but in this case I decided to just go with standard Fedora XFCE for now.
Fam, don’t sleep on Endless OS.
VanillaOS and OpenSUSE immutable ones use BTRFS snapshots dont they?
For openSUSE’s atomic offerings, you’re correct. Vanilla OS is a bit more nuanced, though. I don’t quite recall how they did it on their original images. But since Orchid, there is a reliance on OCI images for its updates. Note that bootc is also contingent upon OCI images, which is why I made the comparison earlier. They behave so similar to one another, that Vanilla OS’ Vib can be used (without too much trouble) to create Fedora Atomic images.
As for the usage of Btrfs snapshots on Vanilla OS, I think it doesn’t quite need it because it relies on lvm thin provisioning instead for its ABRoot. However, an attempt to verify this by installing it within a VM failed spectacularly and I don’t think the blame is on me 😅…
Sorry, perhaps I should have been more clear.
It was meant strictly in the sense of how much it burdens the system performance-wise. So, in other words, using nix is easier on your system’s resources than rpm-ostree (or bootc) is; at least, that has been my experience.
In regards to breaking, I’m not sure whether one outdoes the other. Though, I suppose that nix -by design- would inch this out. But this is basically an ‘internal dispute’ between the crème de la crème; as rpm-ostree/bootc basically outdoes any other distro package manager that’s not named nix or guix.
While I absolutely adore everything rpm-ostree/bootc, I do think operations involving it are relatively heavy; at least compared to what else is out there.
Depending on your (in)tolerance, you might therefore consider opting for something else, instead. Assuming that this list does a considerable job at presenting your options, I’ll try to provide input on some of the more mainstream ones:
nix does handle operations more gracefully than rpm-ostree/bootc on average, though.ostree only and thus doesn’t have the heavier operations from rpm-ostree/bootc. The goals of the foundation behind it align with enabling low-end hardware. This is reflected in their system reqs. Note that GNOME is still relatively heavy, but you should be served well even on just 4 GB of RAM.bootc ever since its Orchid release. So, it’s probably not that light. Furthermore, I got many questions regarding the health of its ecosystem. This used to be another serious contender, but I’m afraid it might have missed the boat…Having said all of that, the gist is basically that atomic distros are still relatively new. As such, I can only recommend Endless OS, Guix System and NixOS. Note that the latter two are rabbit holes, though.
A couple of years ago, I used both of them briefly and GNOME simply provided the more polished experience back then.
In time, I came to dislike the look/design of KDE apps.
So when the time came I wanted to ditch GNOME because I was sick of its extensions ecosystem, I didn’t even consider KDE Plasma. Instead, I tried out Sway and eventually settled on COSMIC.
Thank you for reply.
It has been my pleasure! Thank you for replying back :) .
Yes, I would be ok with A as well, but I am learning things slowly to get to that point.
While I absolutely respect that attitude, it’s worth noting that literally none of the hardened and respected distros are a one-man show. Which is my way of saying that unless you pursuit a career in cyber security, you’re probably better served elsewhere.
So B for now would be great.
Aight. Excellent.
But it seems like OpenBSD might not be great for running VMs
IIRC, it depends. If a TTY/terminal-interface is all you need, then vmm handles that pretty well. But if you’d like to run applications that have their own graphical interfaces, then OpenBSD’s solution might not be adequate. At least, it wasn’t the last time I did a thorough check on the distro.
Could not find much info for virtualization support on HardenedBSD though. Not sure how well bhyve work there, but it seems like VMs might not work well or be performant enough on either of them.
IIRC, bhyve is pretty good actually. Performance-wise, it is good enough to do gaming even. As HardenedBSD is simply hardened FreeBSD, I don’t have a serious reason to assume it ain’t able to do that.
On that note, I want to mention quBSD as an interesting project. It kinda aims to bridge the gap between Qubes OS and FreeBSD. Its developer hasn’t released anything yet, but it’s worth keeping in mind.
Having said all of that, I want to state clearly that there is a disconnect between what’s out there and what you want:
vmm doesn’t do GUIs.So…, what does that leave us with :P ?
Is an amalgamation between sixos and nix-mineral in which you try to port all systemd-related hardenings the best we can do?
However, I’d argue that a possible eventuality might yield us an actual winner.
Recently, Flatpak’s maintainers/developers noted work on Flatpak Next; a successor to Flatpak, if you will. The hope is that it’ll eliminate some of Flatpak’s glaring issues. However, they also announced that it will depend on systemd.
Granted, the eventual thing we’ll receive might not depend on systemd at all. Heck, even if it will, perhaps some distro maintainers will provide a workaround OR just keep on relying on the old flatpak that might get new maintainers. So, there’s absolutely no reason to go full-on FUD right now.
Yet, an out does exist that doesn’t depend on anything of the above; simply by not requiring flatpak support. In which case, HardenedBSD it is. FWIW, with access to VMs, you can also continue to enjoy your flatpaks through a VM. Which, literally happens to be the simplest fix to salvage an “almost”.
P.S. if you didn’t figure it out yet, your query is something I asked myself a couple of years ago 😅.
P.P.S. I forgot about Chimera Linux. I’m not well-versed into it, but perhaps another interesting one to consider. At least alongside Alpine, Artix, Gentoo and Void.
I suppose it’s a good time as any to try it out :) .
FWIW, I’ve been on (a derivative of) Fedora Atomic for over four years now. There’s a learning curve if you’d like to translate some of your existing workflows, but it has overall been a very smooth experience. Like, the last time something broke was with the mesa mess-ups over three years ago. And the beautiful thing with Bazzite is that it can protect its user base from such instances. The how-part would dwarf the existing text, so I digress (for now 😜).
Huh? Last time I checked, SteamOS literally removed user-installed (non-flatpak) packages.
I agree that it’s a pity that the first couple of flatpak packages take up a lot of space for what they are. But that shouldn’t bother most modern systems.
Ah okay, thanks for clarifying!
FYI, DistroWatch isn’t a very reliable metric for gauging the user base of any given distro. Heck, strictly speaking, I’m unaware of any metric that does this any justice besides the opt-out DNF Count Me found on Fedora-based distros. And we will use exactly that to discredit DistroWatch!
So, Fedora (1112[1]) has put out a number (relatively) recently; 961k users. And Bazzite (770) outright displays it on their website; 90.8k users. Like, Fedora is roughly 10 times as big as Bazzite. But their respective DistroWatch rankings don’t quite reflect that.
As per DistroWatch’s 12 months, I’ll use the same table for Bazzite*. ↩︎
I don’t agree with the sentiment that Linux Mint is underrated either. As you note, it is quite popular and is mentioned a lot in the discourse.
However, I don’t think that CachyOS and Linux Mint are the most popular distros; that undoubtedly goes to Ubuntu. And, if anything, I’d think that Linux Mint is more popular than CachyOS.
Yet, if we’d limit it to the distros used by gamers, then CachyOS probably does take the crown for most used distro (aside from SteamOS). At least, there are metrics that suggest as such.
Sorry for the late reply
No worries fam 🙂.
thank you for taking your time!
It has been my pleasure 🙂.
I have “defaulted” back to Artix, having fixed the NIC issue.
Glad to hear that you were able to return back to your home.
And I agree, Gentoo is what I dream of being able to handle, but all the USE flags KILLED me when I set it up for the first time a month or so ago. xD I do want to get back to it at some point though.
Good mindset! I’m sure you’ll manage whenever you get back to it 😉.
If it isn’t broken and does what you need, why update, you know what I mean? Especially if it isn’t connected to the internet in some cases. 😁
I agree with that assessment whenever it’s not connected to the internet. But, if it is, I actually find it hard to justify for myself to not (at least) receive the security updates. Which, in the case of non-frozen packages, suggests applying regular updates.
But yeah, more than anything, I think this touches on threat models. Which are very subjective by themselves and thus probably not very interesting to discuss 😜.
Regarding what you linked to paccache, which setting(s) were you referring to specifically? I don’t think I was able to understand that it is directly suggesting or indirectly insinuating any type of update frequency. But I probably am just too tired to process. 😅
My apologies, perhaps I should have been more elaborate. So, paccache’s man page mentions a systemd timer it refers to as paccache.timer. With it, package cache can be cleaned periodically. And, by default, it does so weekly.
As to why this suggests weekly updates as a lower bound, paccache removes old packages. Thus, from my understanding, paccache goes hand in hand with updates; updates yield the old packages which will be deleted by paccache. As such, for two consecutive paccaches to do anything, an update has to have occurred in between. Thus, if paccache.timer defaults to weekly cleanups, then it has to be accompanied with at least a weekly update.
Of course, paccache will handle higher update frequencies without any problem. Thus, updating only once a week becomes a lower bound for paccache.timer’s default functionality.
To be clear, I only said “suggest” :P . I can’t do any stronger claims 😅.
Thank you for sharing that!
Your approach to updating contains only a subset of what was found on the wiki, but I’m glad to hear that it has proven to be sufficient 🙂.
Ubuntu broke loads of times for me back in the day. Had to reinstall it several times. And all I did was issue the command for upgrading to a new Ubuntu point release. 😅
I’ve heard many horror stories of upgrading on Ubuntu 🤣🤣🤣. Thankfully, Arch has been good to ya 🙂.
If I see an Arch user recommend updating daily, I would definitely question their experience. 😅
Interesting.
So, as I kinda alluded to elsewhere, I don’t daily Arch nor have I ever done so in the past. I did have it as a dual boot earlier in my Linux journey. However, after breaking it for the second time, I just called it quits 😅.
Anyhow, with that out of the way, I am interested in your perspective w.r.t update frequency on Arch.
It has basically been my head canon that updating daily is (at least) reasonable on Arch. And while its excellent wiki doesn’t dictate any number, I’m inclined to believe that -by updating once a week- one is acting by the lower bound in terms of frequency; I’d argue the default settings of paccache suggest as such.
Yup! It’s basically a slimmed down version of how Bazzite achieves ‘immutability’ - allowing it be very robust and pleasant to work with. And while it does sport GNOME, their optimizations enable it to run gracefully on a laptop with just 4 GB of RAM.