Secure Linux Exists. You’re Probably Not Using It.

Summary

The video compares Linux distributions that build security into their design. It emphasizes that “secure” can mean different things: protecting the system from tampering, restricting compromised applications, reducing information leaks, or providing anonymity.

This is a qualitative survey, not a scientific ranking. The speaker prioritizes implemented, maintained protections over claims or lists of installed tools.

Distribution Highlights

Desktop Distributions

• Fedora Silverblue and Kinoite: Familiar desktop systems with SELinux enabled, atomic updates, and rollback support. Flatpak sandboxing adds another layer. The speaker recommends them as practical options for reasonable security with little extra administration. However, atomic updates do not prevent malware or protect everything in a user’s home directory.
• openSUSE Aeon: Automates system maintenance and uses transactional updates and Flatpak. On compatible hardware, it can combine disk encryption with TPM-based boot measurements. Its release-candidate status and hardware compatibility are worth considering. Tumbleweed is also noted for verified updates, Btrfs snapshots, and recovery features.
• Vanilla OS: Uses an image-based, atomic root and container-oriented application management. The speaker cautions that recoverability and reliability are not the same as protection from application exploits.
• Secureblue: Builds on Fedora Atomic and adds measures such as a hardened kernel configuration, protected malloc, SELinux restrictions, tighter Flatpak permissions, and the Chromium-based Trivalent browser. It reduces the attack surface and disables XWayland by default in its main desktop images, which may break some older applications. The speaker considers it a compelling secure desktop, while noting the usability trade-offs of restrictive choices.
• Maze Linux: An ambitious Arch-based desktop with tools and features including AppArmor, firewall and audit utilities, kernel hardening, Secure Boot support, encrypted storage options, Btrfs snapshots, and network monitoring. Its documented signed Unified Kernel Image (UKI) boot process is highlighted. The speaker warns that advertised components do not necessarily mean protections—such as ClamAV on-access scanning—are enabled or mature. The project also needs a longer maintenance and security track record.
• Cerberix: A young Arch-based XFCE system offering tools such as nftables, Fail2ban, auditing and integrity checks, sandboxing, and a desktop security-status indicator. The speaker distinguishes detection and monitoring from prevention and raises questions about the maturity of its infrastructure and update delivery.
• Kicksecure: A Debian-based system with layered hardening, including kernel and permission changes, reduced privileged functionality, AppArmor restrictions, USBGuard, and stronger separation between ordinary use and administration. Updates can be routed through Tor, but this does not mean every application’s traffic uses Tor. The speaker views it as a strong choice for a security-focused Debian environment, with some added complexity.
• Alpine Linux and Hardened Gentoo: Alpine’s small base, musl, BusyBox, OpenRC, and compiler protections can reduce complexity, but Alpine Desktop is not automatically a tightly restricted workstation. Hardened Gentoo offers extensive control over security-focused build settings and system components, but requires substantial expertise and maintenance.

Privacy and Compartmentalization

• Tails: A temporary USB-based system that routes network traffic through Tor and aims to leave minimal traces on the computer. Encrypted persistent storage is available for data users choose to retain. It suits temporary privacy and anonymity needs, but cannot make careless behavior anonymous or stop malicious software from accessing available information.
• Whonix: Typically uses separate virtual machines for a Tor-connected gateway and a workstation whose traffic must pass through it. This can help prevent a compromised workstation application from connecting directly to the internet, but the host operating system and virtualization environment remain important.
• Qubes OS: Uses the Xen hypervisor to isolate tasks into separate virtual environments, including disposable ones. Its focus is containing damage if an application is compromised, rather than assuming every application can be made invulnerable. It requires compatible hardware, significant resources, and careful administration.
• Umbra OS: Mentioned as an experimental project, but the speaker does not consider it established enough to recommend alongside more mature systems.

Overall Assessment and Recommendations

Recommendations depend on the user’s threat model:

• Familiar desktop with modest effort: Fedora Atomic. openSUSE Aeon is also promising, though its release-candidate status should be considered.
• More heavily hardened everyday desktop: Secureblue.
• Security-focused Debian base: Kicksecure.
• Anonymity: Tails for temporary sessions; Whonix for a persistent virtualized setup.
• Compartmentalizing sensitive activity: Qubes OS.
• Projects to watch: Maze Linux and Cerberix, pending stronger evidence of long-term maintenance and effectiveness.

The central argument is that security is not just a collection of packages, a firewall, or an “immutable” label. Protections need to be correctly configured, active by default, maintained over time, and usable enough that people do not disable them.

The speaker also rejects treating systemd as either a security requirement or a flaw in itself: implementation and maintenance matter more than allegiance to a particular init system.

Review or Guide Format

This is a comparative overview and recommendation guide, not a step-by-step installation or configuration tutorial. It evaluates each system’s security approach, practical trade-offs, maturity, and suitability for different risks.

Main Speaker and Source

• Main speaker: A single narrator from the YouTux Channel; no other speakers are identifiable in the subtitles.