chevy9294

Hi, I'm in a process of making fast, (extrenely) secure, and modern laptop. Currently I have Arch Linux with encrypted root partition (unlocked with Nitrokey or long password), secure boot, linux-hardened, firewalld, etc.

I'm running linux-hardened with custom config. I enabled AMD SME, kernel lockdown, added some xanmod patch for more specific cpus, and disabled some unnedded drivers (only those that I'm 100% sure I don't need - Intel, NVidia, Microsoft, Google, Amazon, Virtio). Currently it takes ~50 minutes to recompile the kernel. Are there any tutorials what drivers to disable to speed up this process? After doing that I will try to compile it with -O3 and LTO. Do you know any patches for performance?

I'm planning to enable encrypted swap, install ClaimAV and install flatpak versions for every non open-source app I have.

I also want to have SELinux. Does anyone know where can I learn it? I had it on Fedora and it was not fun using it.

What are other ways I can make my laptop more secure?

I have Arch Linux on Ryzen 7 3700X, 32gb of ram, and some Gigabyte motherboard with updated bios.

Few weeks ago my computer would startet crashing (screen would freeze) soon after login or even at boot about 50% of the time. I was lazy so when it crashed I just forced rebooted it (the power button). Then crashes became more common untill my system wouldn't even boot.

So I reinstalled and I had some trouble generating dracut bundles, because some zstd copression was corrupted. After booting freshly installed os it would crash again right before the login should show up. Switching kernel (from hardened to zen) fixed the problem. Then I installed basic apps (browsers, office, crypto stuff, steam, etc.) I rebooted and when I typed the password for my encrypted root it was wrong (Im sure I typed it correctly).

I have no idea wtf went wrong with my system. I have almost the same everthing on my laptop (hardened, btrfs, luks encrytped drives, systemd boot, etc.) and it works great. And I never experienced any crashes on live usb on my pc.

I ran some random test (its passmark memtest86 v9.3 pro) on my medicat usb. Right now its 92% finished with 1070 errors. This just can't be good :(

Now I will play with some bios settings (like disable xmp), reflash other version, maybe switch a ssd... I will also try other distro, but I can't daily drive them. Arch gives me a ton of flexibility and I don't want to lose it. Maybe NixOS or Gentoo, but gentoo doesnt have systemd (I want to use Mullvad as my vpn and their app reqires it).

Do you maybe know what could be wrong and how to fix it. Thank you for reading this post and thank you very much for answering.

I don't know if this is arch bug or its something wrong with my system. If this is not right community to ask this, plese direct me to the right one (just please not reddit).

Edit: I ran memtest again without one ramstick and it gave me no errors! Thank you for all help and suggestions :)

Edit: I also tried only the faulty ram stick and the PC wouldn't even boot.

Edit: Booting PC with only the faulty ram stick corrupted my bios... I guess I will have to reflash bios anyway.

I want to make my own website, like a blog where I talk about tech and tutorials and such. Something like https://kerkour.com and https://lukesmith.xyz. Any ideas for simple but modern design?

Hi, I'm looking for a distro for my laptop. My first distro was Pop!_OS, then I switched to Fedora, then Arch for a year and 2 months ago I switched to Fedora Silverblue, because I wanted to try immutable distro that relies on containers and flatpaks to be usefull. Silverblue is great but not so much for me, its not flexible enough.

I'm thinking of switching to Arch but maybe it's time for something else. Maybe NixOS or Void, Gentoo probably not, I don't have time for compiling everything. What do you recommend?

It must support full disk encryption, secure boot with signing with YOUR OWN KEYS, systemd (because of MullvadVPN), everything else I think can work on any distro (Gnome, podman, kvm, etc.).

Hi, Im searching for a secure distro for normal daily use for my laptop. Currently Im running arch linux with full disk encryption, secure boot, linux hardened, firewalld and most apps as flatpaks (with some disabled permissions using flatseal). I think its pretty secure laptop but it could be more secure.

Tails and Whonix are the most secure but they are not ment for normal daily use...

There is a lot of new immutable distros. Getting (system) malware is harder to get on them. Im most interested in blendOS, because its based. Does anyone know if it has full disk encryption, secure boot, etc. or can it be done by the user? What about other distros like Fedora Silverblue?

Any other recommendations?

Thank you :)