4

I am new to Linux and I love it. However, while I have been playing around with several flavours of Linux, only one question comes into my mind as a new user to the Linux systems: how can I ensure a Linux distro is safe, secure and trustworthy without any backdoors or malware codes within the OS?

I started using Deepin and I must say I love it. I gave Ubuntu, Zorin, Mint, Kubuntu, Linux Lite, Elementary OS and few others a try some time ago but they all needed too much tinkering to get it to the way I want; but Deepin fits the bills in many ways. Its simple, elegant and so far has been pretty responsive to what I want to use it for; but the big question in my mind is how can I trust this distro?

I use my computer to do things like online banking and create databases which holds sensitive information as I work for a public organisation and cannot compromise such data.

I have contacted the Linux Foundation however didn’t get any response.

I watched RMS talking about Ubuntu and how Ubuntu shares the Desktop search keywords with Amazon and I agree with him that this is a default spyware which I know can be turned off and disabled but the fact is it is still a spyware.

Please can someone tell me how I can ensure a Linux distro is safe, secure and have been scrutinised for any threats or malicious codes by a trustworthy Linux organisation? I have googled it however can’t find anything solid on how to check the integrity of a Linux based OS.

closed as too broad by G-Man, roaima, jimmij, Braiam, Archemar Sep 4 '15 at 4:30

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

11

Short answer: you can't.

Long answer: Linux distribution contains of several different programs that form whole Operating System - namely kernel, coreutils, some shell, and other utilities.

You have two ways of verifying if distribution is safe to use:


1. Read every source code yourself.

You will need to read through an awful lot of code: kernel is ~210K LOC(Lines of code) - now add drivers(also many LOC), coreutils, basic programs... This is job for many many years. And this still doesn't guarantee that it's not malicious - you might miss something, it might be obfuscated or rely on hardware bug.

Also, there's more to security than just being malicious. You might (kind of) get decent level of confidence about lack of malicious code, but you can (almost) never be sure that your program is really safe. Things like HeartBleed and ShellShock just happen; no one can prevent them.

2. Trust other people

This is saner attempt. You choose group of people to trust, and you use their programs believing in their good will. You can go to Free Software Foundation Page - these folks are serious about their privacy and freedom. They only approve limited distributions that are entirely Free and Open Software, so you can read its source code. There aren't a lot people who use them, so support might be limited - but it's nice bet.

You can also trust other people - like Gentoo or Debian or Fedora (or any other distro) developers. They get their distributions together, they bundle some programs, and release them - maybe they don't have bad intentions?


Personal note: I consider security, privacy and freedom important values. However; there's a line between being paranoid and caring for these values. RMS is being paranoid; this isn't necessarily a bad thing, because his voice is loud and what he's saying is clear. Many people start caring about freedom thanks to RMS.

However, still none of these guarantee safety. Linus's Law isn't this simple, and it's not always working. Many people think that because source is open, others are reading it - thus, there's no need for them to read source themselves. This leaves us with small group that have read the code, and even smaller of those who understood it. It's still better then properiarity, but not as safe as advertised.

If you want to be perfectly safe, turn off computer and disassemble it. That's the only way to be 100% sure.

  • 1
    And just an example of the problem: quite many people use sendmail. Quite many people have poked around in the source. Still an exploitable hole was there for almost 15 years and nobody mentioned it. – Sami Kuhmonen Sep 3 '15 at 19:37
  • "If you want to be perfectly safe, turn off computer and disassemble it. That's the only way to be 100% sure." - Then there's something about throwing a PSU over your shoulder and walking inland until a shepherd mistakes it for a toaster, sacrificing a mouse to Posixeidon, etc... – DeveloperInDevelopment Sep 3 '15 at 23:32
0

First and the easiest one is to search the web , forums for the security of that distro .

The second one that I also suggest it is to carefully monitor the distro check it's kernel version and some specific algorithms that are used by that version for example access control mechanisms, process management,... (I suggest you to patch the kernel with sth like pax or grsecurity to make sure ),other important things for example the browser, shell , ...

check it's default configurations for ssh , ... check how it reaches out the network for example check incoming and outgoing traffic with some command like netstat tcptrack and this.

check it's community activity, bug releases and updates.

  • @MatthewRock This is very complex subject I suppose, I agree with yr opinion however if we are to accept such opinion then surely we must also say MS is also secure with its millions of virus, malware, spyware . I am not paranoid however I want to ensure my data is safe as it possibly can be, I know nothing in life is 100%. I used Tails & I must say I was very impressed with the security however that security means limit. I used Ubuntu only due to its popularity thinking this is 1 way of ensuring its secure however I don’t like the UI, just cant get use to it. – Dexter Sep 3 '15 at 22:06
  • @Dexter if the UI is the problem, just switch to other distro, or customize it. In the end, distribution is (mostly) just some preinstalled packages and repositories that holds these packages. You can run Ubuntu with Openbox or Gnome or KDE too. – MatthewRock Sep 4 '15 at 7:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.