• Not all distros ship SELinux and the ones that do, don’t actually configure it securely.

  • New users are expected to keep copying and pasting commands from their browsers to their terminal which compromises some Linux security defenses.

  • KDE, GNOME and Sway are the only functional Desktop Environments/Window Managers that support Wayland all, while the Other DEs are not even close to shipping with Wayland.

  • Most if not all of the Linux Distros in 2025 ship with Grub bootloader, which suffers from a lot of problems, instead of using the bootloaders that does not support BIOS and will improve the reliability of booting and provide a more stable experience.

  • mormund@feddit.org
    2·
    1 day ago

    No. You can edit the Kernel command line directly from GRUB before booting into anything else. That is the default behavior (with Debian).

    Yes, it is more aimed towards “casual” users that want something that just works. But auto-updating policy is not really the point of the blog. Every distro is deciding that by themselves and will always be able to.

    • Sprocketfree@sh.itjust.worksEnglish
      4·
      1 day ago

      Why would I care about someone having physical access and able to modify grub even? Full disk encryption blocks any actual access to the data on the machine and if they already have physical access they can put a nail in the HDD. Point being they aren’t accessing the data. Not sure what more you’d want.

      • nous@programming.devEnglish
        3·
        23 hours ago

        The attack is known as the evil maid attack. It requires repeated access to the device. Basically if you can compromise the bootloader you can inject a keylogger to sniff out the encryption key the next time someone unlocks the device. This is what secure boot is meant to help protect against (though I believe that has also been compromised as well).

        But realistically very few people need to worry about that type of attack. Encryption is good enough for most people. And if you don’t have your system encrypted then it does not matter what bootloader you use as anyone can boot any live usb to read your data.

      • mormund@feddit.org
        1·
        21 hours ago

        Full disk encryption is non standard and a PITA without a secure boot chain where the disk can be unlocked by the OS itself. If you have fun tinkering with your OS go nuts, but I want something that works every time even if install it for my mom. The current distro offerings aren’t that.