I used PopOS, but once they announced they’ll start focusing on their Cosmic desktop, I switched to Fedora KDE it worked to some degree until it crashed and I lost some data, now I’m on Ultramarine GNOME and it doesn’t seem to like my hardware ( fans are spinning fast )
my threat model involves someone trying to physically unlock my device, so I always enable disk encryption, but I wonder why Linux doesn’t support secure boot and TPM based encryption ( I know that Ubuntu has plans for the later that’s why I’m considering it rn )
I need something that keeps things updated and adobts newer standards fast ( that’s why I picked Fedora KDE in the first place ), I also use lots of graphical tools and video editing software, so I need the proprietary Nvidia drivers
Idk what to choose ಥ_ಥ ? the only one that seem to care about using hardware based encryption is Ubuntu, while other distros doesn’t support that… the problem with Ubuntu is there push for snaps ( but that can be avoided by the user )
security heads say: if you care about security, you shouldn’t be using systemd, use something like Gentoo or Alpine… yeah but do you expect me to compile my software after ? hell no
use something like Gentoo or Alpine… yeah but do you expect me to compile my software after ? hell no
There are more systemd-free distros like Artix Linux (which is just Arch without systemd), Devuan (which is the same thing but for Debian) and Void Linux. Btw Alpine doesn’t require you to compile anything.
I heard from people who have tried both Void and Alpine, that Void is much more easier to use as a desktop OS while Alpine is more suited as a server OS…
Listening to this podcast might be helpful along with the links in the show notes: https://linuxunplugged.com/572
Here’s another option: https://fedoramagazine.org/automatically-decrypt-your-disk-using-tpm2/
I found these on a hacker news comment: https://fedoramagazine.org/automatically-decrypt-your-disk-using-tpm2/
TPMs can be extracted with physical access
You could use a security key
security heads say: if you care about security, you shouldn’t be using systemd
Yah, ignore that bullshit.
Yeah, no kidding. The same systemd that enables the very things OP is trying to enable…
systemdboot + sbctl + systemd-cryptenroll and voila. TPM backed disk encryption with a PIN or FIDO2 token.
AFAIK this should be doable in Ubuntu, it just requires some command-line-fu.
Last I heard the Fedora installer was aiming to better support this type of thing - not so sure about Ubuntu.