1

What would be the most appropriate to use for as much security as possible? TENS looks very simple and straightforward, which is why I like it. However I have barely seen anyone suggesting it, I suppose they don't trust its devs (USAF Research Lab). Most seem to recommend Qubes OS or Tails.

Note that I'm not interested in a Tor or I2P distro, I'd like to know what is the optimal distro to use on a computer that could be potentially infected and that no matter how many bad links or files I open, nothing would be affected after a reboot.

Also I've seen many people say that Qubes OS is very hard to properly set up and it is a bad idea for a Linux beginner. What does that even mean?

closed as primarily opinion-based by forest, Steffen Ullrich, kasperd, Daisetsu, LvB Dec 11 '18 at 16:41

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    "...a total beginner?" - beginner in what? Computers in general, Security in general, Linux in general ... . "... what is the optimal distro to use on a computer that could be potentially infected and that no matter how many bad links or files I open, nothing would be affected after a reboot." - use a system you boot from a physically read-only medium (i.e. CD-ROM) and have no permanent storage on your computer. There are several system too choose from, a classic one is Knoppix. – Steffen Ullrich Nov 28 '18 at 6:28
  • Depends on the usage you want the computer for. If you want to play games, Qubes is not your OS. That was the reason I abandoned qubes. Qubes as all OS's does have a learning curve, but I did not find it complicated. You have docs about backups, vpn's and things like that and they try to make it a consumer desktop distro. Besides the lack of gaming I think they made a good job at it. – bradbury9 Nov 28 '18 at 14:52
0

Summary

I think you want Qubes. I really enjoyed using it (and I miss it a lot while writing this up!). Expect that you'll need to sink a fair amount of time and energy following guides on the Qubes Docs page to do linux-wizard-y stuff like editing config files on the command-line (the price you pay for a hardened OS!).


My experience using Qubes for a year

I've been a linux-only user since about 2006. Last year I put Qubes on my laptop and used it as my primary OS for about a year - everything from web browsing to software development.

Out of the box it worked great for web browsing and basic tasks like opening PDFs, but trying to do more involved tasks like installing new software, connecting to the NAS on my home network, plugging in a USB stick, etc quickly became very complicated and forced me to learn a lot about the internals of linux, networking, and virtualization - Despite being a 10 year linux veteran. That said, for me learning Qubes was a really fun experience and I learned a lot!

My opinion is if you just want a secure way to web-browse then out-of-the-box Qubes will be straight-forward enough. If you want an every-day OS to do all the things you currently do on Windows / Mac, then you're in for a learning-curve (hopefully a fun one :)


Head-to-head comparison Qubes vs Tails vs TENS

I've never personally used Tails or TENS, but here goes at an attempt to compare the three head-to-head.

Qubes OS

TL;DR: Qubes aims at being an everyday OS where you isolate different apps from each other by giving each its own full virtual machine. It gives a nice balance of usability (your data and installed applications persist across reboots, for example) and security (things are isolated from each other, and it's quick and easy to for example, create a clean VM, paste in some sketchy links that you didn't want to open in your banking VM, and then destroy the VM).

Definitely designed to be an every-day OS. It's based around the core idea that you run multiple VMs which (through some clever linux wizardry!) all co-exist in the same desktop so you can interact with them all at the same time, but each VM is unaware of the existence of the others. In the following image the green window and the yellow window belong to separate VMs.

Qubes OS desktop - image from wikipedia

That means that each application can have its own complete complete computer - a pretty good security barrier! For example I gave facebook its own VM (which I set to be destroyed on laptop reboot). Casual web browsing, banking, and each work project also each had their own VM. Qubes supports running different OSes in each VM, so if you want an Ubuntu and, a Debian, and a Fedora, you can do that. In theory, Qubes even supports Windows as a guest VM if you want to keep using Windows apps.


Tails

I have no direct experience, so from its wikipedia page:

Tails or The Amnesic Incognito Live System is a security-focused Debian-based Linux distribution aimed at preserving privacy and anonymity. All its outgoing connections are forced to go through Tor, and non-anonymous connections are blocked. The system is designed to be booted as a live DVD or live USB, and will leave no digital footprint on the machine unless explicitly told to do so.

The list of software that comes pre-installed seems all security and privacy focused. So if you wanted to install your favourite web browser, or a spreadsheet program, or wtv, you'd probably have to jump through some hoops (and of course do it again on each reboot). From quick googling, it looks like Tails can be configured to have persistent storage, but it's definitely designed to wipe itself back to the factory state on reboot, which I would personally find very frustrating.

Because it's designed to use Tor at the network-driver level, I suspect "everyday" things like connecting to a network printer, or your Chromecast, or maybe even streaming youtube or netflix would be very frustrating.


TENS

I have no direct experience, so from its wikipedia page:

Lightweight Portable Security (LPS) is a Linux LiveCD, (or LiveUSB), developed and publicly distributed by the United States Department of Defense’s Software Protection Initiative that is designed to serve as a secure end node. LPS boots only in RAM, creating a pristine, non-persistent end node. It supports DoD-approved Common Access Card (CAC) readers, as required for authenticating users on DoD networks.

As of version 1.7, the distribution was rebranded as Trusted End Node Security, or TENS.

So this is very similar to Tails in that you'll lose all your data on reboot and probably have a fair amount of frustration at installing software that doesn't come pre-installed (which seems limited to DoD internal tools). The networking (streaming, connecting to other devices on your home network, etc) might be easier that Tails.


Summary (same as above)

I think you want Qubes. I really enjoyed using it (and I miss it a lot while writing this up!). Expect that you'll need to sink a fair amount of time and energy following guides on the Qubes Docs page to do linux-wizard-y stuff like editing config files on the command-line (the price you pay for a hardened OS!).

Not the answer you're looking for? Browse other questions tagged or ask your own question.