I don't like Cosmic, because it doesn't have a Switch User feature. I have to logout and lose my work in progress when I need to go over to my admin account temporarily. But I do like it's GUI, the blue halo windows frame is pretty. Configuration wise it is mostly the same as Fedora KDE. There are differences in PAM, but Yubikey worked the same way. I find that in Linux, having a Yubikey when sudo'ing is a key requirement, because sudo passwords can be keylogged. And the attacker can impersonate you when sudo does not require a Yubikey. It's the same as your fingerprint mech. An additional safeguard is having more accounts which ain't admin. RBAC has other benefits, but part of it is that the attacker cannot use sudo in those non-admin accounts. And when you use a secondary account to surf, then you confine the attacker to that account without sudo, when he successfully attacks your browser - the major attack vector. The killer is javascript - the language for hackers which you can't turn off if you want usability. (partly joking) And the Javascript optimizer, be sure to turn that dang feature off. Whatever little speed improvement is not worth it. The browser is the major vector because if you check, you will see critical vulnerabilities in Every version they release. They patch some, and more appears with the next release. It is great that Fedora releases patches quick or else you will have multiple vulnerabilities for a length of time. Speaking of which, I am sure that the red team have a hack tool or two attacking my browser ( very strange things happen ) and it is fapolicyd App Control that is keeping them in check because it restricts foreign code from running. You say that you don't like default deny, well fapolicyd works without extra effort because it restricts all other code that is not installed via dnf. You use dnf and you are safe. I'd like to hear your opinion of default deny.