3

Maybe a broad question, but I would like to know if is there any difference between those distros regarding security and privacy.

For instance, I was not able to find an official privacy policy for linux mint and I read ubuntu shares dash typed info with third-parties if not opt-out.

  • Which respects user privacy more?
  • Are both source codes fully and publicly available for scrutiny?
  • Are rolling release distros safer?

Thanks in advance.

closed as primarily opinion-based by Michael Homer, mdpc, Jeff Schaller, Julie Pelletier, sam Aug 23 '16 at 4:49

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • You are considering installing Ubuntu or Mint, but you want your operating system to have fully public source code and to prioritise privacy and security? You should probably consider Trisquel. Trisquel is based on Ubuntu, but unlike Ubuntu & Mint, Trisquel meets the Free System Distribution Guidelines. If, in addition to your operating system, you also want your BIOS to have fully public source code and to prioritise privacy and security, check out Libreboot. – sampablokuper Aug 22 '16 at 23:34
  • I tried trisquel, but it does not work with my wifi card (because of firmware incompatibility). Any workaround? And how could I change to libreboot? – user122024 Aug 22 '16 at 23:45
  • 1
    The workaround is to stop using that WiFi card & instead use a wireless card that doesn't require non-free drivers/firmware. Easy option: get this USB one from ThinkPenguin & just ignore your old WiFi card thereafter. Or if you like DIY you could remove your current card & replace it with pretty much any compatible card that has one of these chipsets, e.g. one of these. – sampablokuper Aug 23 '16 at 0:06
  • For Libreboot, you need a compatible PC. Unfortunately, only a dozen or so models are currently supported. Fortunately, many of these are available new or second-hand. The 2nd-hand ones are often cheap on eBay/etc. Or if you want one with Libreboot already installed, the devs sell them. Another option is the EOMA68, which needs backers and is expected to be Libreboot compatible. – sampablokuper Aug 23 '16 at 0:18
2

Which respects user privacy more?

Mint uses Ubuntu repositories. Depending on what you install they're pretty much the same.

But moreover, you cannot expect that the developers of a distro as big as Mint/Ubuntu are aware of the privacy concerns of every package. OK, that is pretty subjective so I'll add an example:

Some people consider Firefox's (and Chromium's) OSCP certificate verification to be an invasion of privacy. That is because you never asked Firefox to check the certificate against the OSCP database, and that database gets to know your browsing habits.

Still Firefox is in the official repositories of pretty much every Linux distro and with OSCP enabled. Hell, it comes by default with most of them.

There are also the APP repositories, which can carter any software. The APP repositories are policed to some extent, just like, for example, Arch's AUR, but there may be a considerable amount of time until a problematic piece of software is removed.

Are both source codes fully and publicly available for scrutiny?

Several pieces of firmware (notably drivers) are closed source.

Flash player, Skype, are other examples of software that is closed source and that can be installed.

Again, it depends whether you actually use these things.

caveat emptor

Are rolling release distros safer?

The moral of the story above is that privacy is not something that is maintained by a distro, but depends on what software you run. And, to be on a decent level of privacy (but without going paranoid) you need to be somewhat aware of the software you run.

Of course, pretty much any Linux/*BSD distro is never as bad as the privacy tragedies sold by Microsoft or Banana Corp (cannot say the name explicitly, I'm afraid of performing a trademark infringement :) ).

  • Nice taught. Banana's company is watching us. Thank you for your answer :) – user122024 Aug 22 '16 at 23:46
1

These are really separate questions. Privacy is a holistic concern that touches much more than the core security of the operating system. The security of a general-purpose operating system should be mostly unobtrustive whereas privacy very quickly involves compromises between privacy and usability.

Which respects user privacy more?

Ubuntu's default interface (with Unity) makes online searches, which is obviously not good for privacy. However you don't have to use the default interface (and I don't recommend it anyway, because it isn't very usable and it isn't very stable).

If privacy is an important goal, you may want to use Tails instead of a general-purpose distribution. Tails insists on privacy by default, which comes with its share of lack of comfort when using. If you want to save data from one session to the next, you need to activate this explicitly — forget this and you'll lose all your work when you shut down the computer. All Internet traffic goes via Tor which has a significant cost in latency and bandwidth.

Are both source codes fully and publicly available for scrutiny?

Most distributions use mostly open source code but include some closed-source software and closed-source firmware (firmware is software that runs on a processor other than the main processor, e.g. the graphics card).

Debian, Ubuntu and Mint all track non-free software separately: in Debian it's in the non-free repository, in Ubuntu it's in the restricted and multiverse repositories. You can choose not to install any non-free software.

Avoiding non-free firmware is unfortunately difficult. You have to shop for hardware very carefully.

The availability of source code is not a guarantee of additional security anyway. Having source code makes it easier to discover security flaws, but that only matters if someone is looking. Having open source code also helps to some extent with potential backdoors but you still need to trust some of the system.

Are rolling release distros safer?

This one actually has a fairly clear, unlike the previous two… No, rather the opposite. A rolling release means that you get all the latest bugs. Sure, you get all the latest bug fixes as well, but so does a release-based distribution. Release-based distributions apply security patches to the existing versions of their packages. So a release-based distribution gets as many security fixes as a rolling release distribution, and has fewer unknown bugs. Rolling releases are for people who like living dangerously.

  • Eeeyup, as an arch user I do like to live dangerously :). I need to add that quote to my profile. – grochmal Aug 23 '16 at 1:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.