• 63 Posts
  • 1.35K Comments
Joined 3 years ago
cake
Cake day: July 7th, 2023

help-circle

  • The distro doesn’t matter, the Desktop Environment does.

    If they are used to MacOS and want something simple and “out of the way”, go with Gnome.

    If they are used to Windows, go with KDE.

    Fedora is probably the most straightforward to install and manage right now. You won’t need to “lock down” anything if you don’t give them sudo credentials.and just a regular user account.





  • The security model skews towards convenience versus absolute security, meaning automation is it’s goal, not perfect security. They use a reasonable amount of security to protect unauthorized access, meaning untrusted apps can’t access keys by default, and container apps only have selective access. AppArmor is supposed to be handling some DBUS interactions in the background to prevent any old app from grabbing everything, but again, automation is the purpose here.

    If you don’t have a reasonably trusted system, then sure, it’s about as secure as any other password manager. I remember reading some time ago there was a plan to make a global framework for trusted application.accessnto things like this, but it was shot down for being “oppressive” in the same way as Microsoft’s trust app mess.

    Ideally there would be an advanced mode where each app is granted access to specific keys, and that interaction is controlled by the user. This would never be the default obviously as the user interaction would be an insane annoyance to people who don’t care.






  • Same as you would on MacOS :

    • ditch the .deb package because it’s the wrong tool for the job here.
    • Squashfs image with encryption
    • Set keyring entries and a wrapper script to manage lock/unlock. If you already know the hardware platform of all users, this can even be improved upon

    I have no idea why someone would be using Debian packages to distribute something like this though, if that’s the question. Absolutely not going to work well.




  • You’ll still be running into frequent issues if you go with R-V, so be warned.

    That being said, the Framework R-V board only comes for the 13" format, so you can buy a cheap Framework 13 refurb from their store (fully warranted and everything), and swap the board out for the R-V for $200.

    There are other R-V laptops out there, but I think the build quality is nowhere near the Framework, AND if you feel like it sucks, just swap that board back with the one it shipped with.