Advanced Security Linux Mint Cinnamon Wayland setup

[7Oz-64]

Yes, although that doesn't prevent new inactive search engines from being added.
Only Edge has a policy that prevents such automatic additions.
I used this policy successfully in 2024 to ensure that only DDG appeared in the search engine list.
It worked perfectly.

If any forum members are interested, just ask.

and this one

Serious Discussion Post in thread 'uBlock Origin Lite - General Discussions'

Mar 19, 2026

Oups!!

• 7Oz-64

• 

 

[7Oz-64]

I ended up with chrome://flags and switch, these flags are mostly experimental and more you tweak them more you 're unique in fingerprinting, now i just use templates in a json and use regular chromium : ON DEBIAN

 

[LinuxFan58]

I ended up with chrome://flags and switch, these flags are mostly experimental and more you tweak them more you 're unique in fingerprinting, now i just use templates in a json and use regular chromium : ON DEBIAN
View attachment 298230

Thanks for joining, care to explain your mysterious nickname? I think the 64 is your year of birth, but now Idea what 7Oz stands for

7 oz stands for 7 ounces, a unit of measurement in the US Customary System that can refer to either weight (for solids) or volume (for liquids),
Common items that weigh or contain approximately 7 oz include a medium apple, a medium cooked chicken breast, a small can of soda, or a standard smartphone.

 

[7Oz-64]

Thanks for joining, care to explain your mysterious nickname? I think the 64 is your year of birth, but now Idea what 7Oz stands for

7 oz stands for 7 ounces, a unit of measurement in the US Customary System that can refer to either weight (for solids) or volume (for liquids),
Common items that weigh or contain approximately 7 oz include a medium apple, a medium cooked chicken breast, a small can of soda, or a standard smartphone.

You're most Welcome
You just find a new Thread to create if not already!!!

Ah you give two bad answers, some hints :
64 refer to something in my avatar (soup), and the second one is from India.(solid)
Good Luck!!!

 

[LinuxFan58]

You're most Welcome
You just find a new Thread to create if not already!!!

Ah you give two bad answers, some hints :
64 refer to something in my avatar (soup), and the second one is from India.(solid)
Good Luck!!!

Okay I see a Linux cannibal who has Ubuntu on a stick and boils a pot of soup from windows.

In India, the number 64 (Hindi: चौसठ or चौंसठ) is culturally significant primarily for the 64 Arts (Chausat Kala), a classical catalog of skills including singing, dancing, painting, and playing instruments.

7Oz is also the weight of a hamster, so you are the mysterious dancing hipster from india, who magically can brew windows functionality into his ubuntu setup


That explains it all, how could I miss that

 

[lokamoka820]

And now my mind is spinning.

 

[Victor M]

I read that avatar's picture as native of the Ubuntu tribe boiling Windows soup for dinner.

 

[7Oz-64]

@LinuxFan58
I see you're using NextDNS cli, you can install this applet for always see if it's active or deactivate by something else.
Work ONLY on Cinnamon Flavor :

/home/$USR$/.local/share/cinnamon/applets/nextdns@local

Two files to put in folder

file applet.js :

const Applet = imports.ui.applet;
const PopupMenu = imports.ui.popupMenu;
const Util = imports.misc.util;
const GLib = imports.gi.GLib;

class NextDNSApplet extends Applet.TextIconApplet {
    constructor(metadata, orientation, panelHeight, instanceId) {
        super(orientation, panelHeight, instanceId);

        this.set_applet_tooltip("NextDNS");

        this.menuManager = new PopupMenu.PopupMenuManager(this);
        this.menu = new Applet.AppletPopupMenu(this, orientation);
        this.menuManager.addMenu(this.menu);

        this._buildMenu();
        this._updateStatus();
        this._startTimer();
    }

    _buildMenu() {
        this.menu.removeAll();

        this.menu.addAction("Ouvrir les logs", () => {
            Util.spawnCommandLine("gnome-terminal -- journalctl -u nextdns.service -f");
        });

        this.menu.addAction("Démarrer", () => Util.spawnCommandLine("systemctl start nextdns.service"));
        this.menu.addAction("Arrêter", () => Util.spawnCommandLine("systemctl stop nextdns.service"));
        this.menu.addAction("Redémarrer", () => Util.spawnCommandLine("systemctl restart nextdns.service"));
    }

    _updateStatus() {
        let [ok, out] = GLib.spawn_command_line_sync("systemctl is-active nextdns.service");
        let status = out.toString().trim();

        if (status === "active") {
            this.set_applet_icon_path(GLib.get_home_dir() + "/.local/share/YOUR PNG ICON PATH");
            this.set_applet_tooltip("NextDNS actif");
        } else {
            this.set_applet_icon_path(GLib.get_home_dir() + "/.local/share/icons/YOUR PNG ICON PATH");
            this.set_applet_tooltip("NextDNS inactif");
        }
    }

    _startTimer() {
        GLib.timeout_add_seconds(GLib.PRIORITY_DEFAULT, 2, () => {
            this._updateStatus();
            return true;
        });
    }
}

function main(metadata, orientation, panelHeight, instanceId) {
    return new NextDNSApplet(metadata, orientation, panelHeight, instanceId);
}

File metadata.json :

{
    "uuid": "nextdns@local",
    "name": "NextDNS Status",
    "description": "Indicateur d'état du service NextDNS",
    "version": 1
}

 

[7Oz-64]

For Browsing, IMHO, i found Brave really good for security, speed and outside privacy, but too much things on board, this is why i use Chromium without any flags or switch just pass a long time to setup granular policies for the best result in privacy and security and most important surfing without problem (banking..........).
See my set of policies if you're interested, i am also curious about how did you set your kernel's parameters if you do.

{
  "AIModeSettings": 1,
  "BuiltInAIAPIsEnabled": false,
  "GeminiActOnWebSettings": 1,
  "GenAILocalFoundationalModelSettings": 1,
  "HelpMeWriteSettings": 2,
  "DevToolsGenAiSettings": 2,
  "BlockThirdPartyCookies": true,
  "BrowserAddPersonEnabled": false,
  "BrowserGuestModeEnabled": false,
  "BrowserGuestModeEnforced": false,
  "BuiltInDnsClientEnabled": false,
  "DnsOverHttpsMode": "off",
  "EnableMediaRouter": false,
  "ShowCastIconInToolbar": false,
  "MediaRouterCastAllowAllIPs": false,
  "PasswordManagerEnabled": false,
  "PaymentMethodQueryEnabled": false,
  "SpellCheckServiceEnabled": false,
  "SyncDisabled": true,
  "SafeBrowsingDeepScanningEnabled": false,
  "SafeBrowsingExtendedReportingEnabled": false,
  "MetricsReportingEnabled": false,
  "UserFeedbackAllowed": false,
  "UrlKeyedAnonymizedDataCollectionEnabled": false,
  "DomainReliabilityAllowed": false,
  "SearchSuggestEnabled": false,
  "GoogleSearchSidePanelEnabled": false,
  "NetworkPredictionOptions": 2,
  "QuicAllowed": false,
  "HardwareAccelerationModeEnabled": true,
  "ClearBrowsingDataOnExitList": [
    "browsing_history",
    "download_history",
    "cookies_and_other_site_data",
    "cached_images_and_files",
    "password_signin",
    "autofill",
    "site_settings",
    "hosted_app_data"
  ],
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "jobpjnhlpobhgdddaeifllnbbleopibe",
    "ddkjiahejlhfcafbddmgiahcphecmpfh",
    "oboonakemofpalcgghocfoadofidjkkk",
    "aghfnjkcakhmadgdomlmlhhaocbkloab",
    "icpgjfneehieebagbmdbhnlpiopdcmna"
  ],
  "DefaultSearchProviderEnabled": true,
  "DefaultSearchProviderKeyword": "search",
  "DefaultSearchProviderName": "StartPage",
  "DefaultSearchProviderSearchURL": "https://www.startpage.com/do/search?query={searchTerms}&prfe=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
  "DefaultSearchProviderSuggestURL": "https://www.startpage.com/osuggestions?q=%s&prfe=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
  "HomepageIsNewTabPage": false,
  "HomepageLocation": "https://www.startpage.com/do/mypage.pl?prfe=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
  "NewTabPageLocation": "https://www.startpage.com/do/mypage.pl?prfe=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
  "ShowHomeButton": true,
  "DownloadDirectory": "/home/$USER$/Bureau",
  "DefaultDownloadDirectory": "/home/$USER$/Bureau",
  "AutoplayAllowed": false,
  "DefaultGeolocationSetting": 3,
  "DefaultSensorsSetting": 2,
  "OriginKeyedProcessesEnabled": true,
  "SandboxExternalProtocolBlocked": true,
  "NetworkServiceSandboxEnabled": true,
  "AudioSandboxEnabled": true,
  "TLS13EarlyDataEnabled": false,
  "RemoteAccessHostAllowRemoteAccessConnections": false,
  "RemoteAccessHostAllowRemoteSupportConnections": false,
  "RemoteAccessHostAllowClientPairing": false,
  "RemoteAccessHostAllowFileTransfer": false,
  "RemoteAccessHostAllowUrlForwarding": false,
  "RemoteAccessHostFirewallTraversal": false,
  "RemoteAccessHostAllowPinAuthentication": false,
  "RemoteAccessHostRequireCurtain": false,
  "SafeBrowsingSurveysEnabled": false,
  "SafeBrowsingProxiedRealTimeChecksAllowed": false,
  "QRCodeGeneratorEnabled": false,
  "PromotionsEnabled": false,
  "MediaRecommendationsEnabled": false,
  "AutofillAddressEnabled": false,
  "AllowDinosaurEasterEgg": false,
  "AutofillCreditCardEnabled": false,
  "AutofillPredictionSettings": 2,
  "BatterySaverModeAvailability": 0,
  "SitePerProcess": true,
  "DefaultFileSystemWriteGuardSetting": 2,
  "DefaultWebBluetoothGuardSetting": 2,
  "DefaultWebUsbGuardSetting": 2,
  "DefaultWebHidGuardSetting": 2,
  "DefaultSerialGuardSetting": 2,
  "DefaultNotificationsSetting": 2,
  "DefaultClipboardSetting": 2
}

 

[LinuxFan58]

@7Oz-64

I only mildly hardened Linux by disabling P2P, remote access, old TLS versions and enabling ASLR system wide. I made a few changes from a website which claimed what to do when first installation linux Mint, but onyl the ones that made sense to me (e.g. reduce swapiness, I think I have set it to 10)).

My policies
{
"SitePerProcess": true,
"SandboxExternalProtocolBlocked": true,
"AudioSandboxEnabled": true,

"SafeBrowsingProtectionLevel": 1,
"DownloadRestrictions": 1,
"PromptForDownloadLocation": false,
"DownloadDirectory": "my download folder¨

"DnsOverHttpsMode": "secure",
"DnsOverHttpsTemplates": "my free Cloudflare Zero Trust ",
"HttpsOnlyMode": "force_enabled",
"DefaultBraveHttpsUpgradeSetting": 2,

"DefaultInsecureContentSetting": 2,
"DefaultFileSystemWriteGuardSetting": 2,
"DefaultWebBluetoothGuardSetting": 2,
"DefaultWebUsbGuardSetting": 2,
"DefaultWebHidGuardSetting": 2,
"DefaultSerialGuardSetting": 2,
"JavaScriptBlockedForUrls": [ "FILE:///*" ],
"JavaScriptOptimizerBlockedForSites": [ "HTTP://*" ],

"RemoteAccessHostAllowRemoteAccessConnections": false,
"RemoteAccessHostAllowRemoteSupportConnections": false,
"RemoteAccessHostAllowClientPairing": false,
"RemoteAccessHostAllowFileTransfer": false,
"RemoteAccessHostAllowUrlForwarding": false,
"RemoteAccessHostFirewallTraversal": false,
"RemoteAccessHostAllowPinAuthentication": false,
"RemoteAccessHostRequireCurtain": false,

"PasswordManagerEnabled": false,
"AutofillAddressEnabled": false,
"AutofillCreditCardEnabled": false,

"BrowserGuestModeEnabled": false,
"BrowserAddPersonEnabled": false,
"BackgroundModeEnabled": false,

"MetricsReportingEnabled": false,
"SearchSuggestEnabled": false,
"GenAILocalFoundationalModelSettings": 1,
"PromotionsEnabled": false,

"BraveRewardsDisabled": true,
"BraveWalletDisabled": true,
"BraveNewsDisabled": true,
"BraveVPNDisabled": true,

"BraveShieldsDisabledForUrls": [
¨Lots of websites +20
]

}

 

[Sampei.Nihira]

Is the “MetricsReportingEnabled” policy useful in Linux?

In Windows, not at all:

Chrome Enterprise Policy List & Management | Documentation

In addition, Brave uses the BraveP3AEnabled policy:

https://support.brave.app/hc/en-us/articles/360039248271-Group-Policy