Advanced Plus Security LinuxFan58's PC Security Config

[Sampei.Nihira]

....So Chrome is faster than Brave.
Just as expected.

 

[LinuxFan58]

....So Chrome is faster than Brave.
Just as expected.

Yes but Flatpak (sandbox) is faster than Firejail (sandbox), so the benchmark difference is even more than the difference in posted results, but to put things in perspective ...

Firefox is 30 (Brave) to 40 (Chrome) percent slower in Speedometer benchmark, but that is usually only 0.1 second or less in website load time when testing with page speed insights (and that benchmark is written by Chrome, so probably gives Chrome a slight advantage over other browsers like Firefox and Safari). People probably don't notice a 0.1 second load difference, making Firefox feel as fast as Chrome and when you prefer Firefox you probably think Firefox is faster

 

[Sampei.Nihira]

Considering that you use only 3 filter lists in your surfing profile, but with uBoL,especially EasyList,the filters are updated only when the extension is updated, typically once a week, whereas EasyList is updated on the server side even several times a day, you might consider using the AdGuard Browser Extension in this profile and adding the 3 filter lists you use to the custom filters, while disabling all other filters.

In AG version 4.3.1.4, custom filters update independently of the extension:

Custom filters in MV3 can now update independently from extension updates again, so ad blocking stays accurate and responds to changes more quickly.

Release 5.4.1.3 · AdguardTeam/AdguardBrowserExtension

You would achieve greater efficiency, though you should consider the impact of the extension compared to uBoL.

P.S.

I discovered that in AG, you can only import custom filter lists that, in total, do not exceed 30,000 rules.

 

[LinuxFan58]

@Sampei.Nihira

Thanks for the AI model dowload prevention tip, I will add that to my Chrome policy when I am back.

These 30.000 are what Google calls dynamic rules and can be updated any time. The static rules are only updated when the extension is updated. So the EasyList still won't update on AG because they are static.

The thing with Kees1958 rules for uBol is that it is only 1 DNR rule which does not update often, so I have copied it in the custom DNR section in uBol by simoly copying and pasting.

 

[Sampei.Nihira]

@Sampei.Nihira

Thanks for the AI model dowload prevention tip, I will add that to my Chrome policy when I am back.

These 30.000 are what Google calls dynamic rules and can be updated any time. The static rules are only updated when the extension is updated. So the EasyList still won't update on AG because they are static.

The thing with Kees1958 rules for uBol is that it is only 1 DNR rule which does not update often, so I have copied it in the custom DNR section in uBol by simoly copying and pasting.

That’s not the case; take a look at these two images:





I deleted all the filter lists and added only these three filter lists to the custom filters.
Keep in mind that I also have 138 custom rules added to my rules.
But as you can see in the second image, there are 0 static rules.

So it seems that the filter lists added to the custom filters are treated as dynamic rules—that’s the trick that allows them to update independently.

The problem for you is that you can’t even add the Easylist Optimized, because that single filter list alone exceeds the allowed number of dynamic rules.

 

[LinuxFan58]

Custom filters are treated as dynamic rules, that is what I intended to explain, so we are talking about same thing

 

[Sampei.Nihira]

Does ShowWhatsNew=false work for you?
I can't find this policy in the list:

Chrome Enterprise Policy List & Management | Documentation

, so I just uncheck the box in Chrome's developer tools.

P.S.

The flags I use,some of which are identical to yours, while others are different,are listed here on MT in the thread about my Security Configuration.

 

[LinuxFan58]

@Sampei.Nihira You are right, I asked AI, but did not check, it is not working (FOUT = ERROR)

 

[Sampei.Nihira]

@Sampei.Nihira You are right, I asked AI, but did not check, it is not working (FOUT = ERROR)

View attachment 297640

Uncheck the box in the Chrome developer tools that performs the same function.

 

[LinuxFan58]

@Sampei.Nihira thanks found it

 

[LinuxFan58]

My wife went to visit some friends and it rained all day, so one friend after another whatsapped in our dynosaurus oldies (rugby) group-app that they cancelled the food truck / music event which was in our town, so I started a discussion with ChatGPT and Chat convinced me to move from X11 to Wayland, which meant switching desktop. Switching the desktop is a breeze, but resetting my tweak (to make it look like Windows 7) took me all afternoon, biut Wayland eperimental now supports international (dead) characters and seems to run well with all my applications. So I am no on Wayland (which has security advantages compared to X11).

 

[lokamoka820]

My wife went to visit some friends and it rained all day, so one friend after another whatsapped in our dynosaurus oldies (rugby) group-app that they cancelled the food truck / music event which was in our town, so I started a discussion with ChatGPT and Chat convinced me to move from X11 to Wayland, which meant switching desktop. Switching the desktop is a breeze, but resetting my tweak (to make it look like Windows 7) took me all afternoon, biut Wayland eperimental now supports international (dead) characters and seems to run well with all my applications. So I am no on Wayland (which has security advantages compared to X11).

Which desktop environment did you install?

 

[Victor M]

which has security advantages compared to X11

The primary Wayland security advantage that won me over is that wayland windows now can't communicate with one another. So no more keylogging like in Windows.

 

[simmerskool]

My wife went to visit some friends and it rained all day, so one friend after another whatsapped in our dynosaurus oldies (rugby) group-app that they cancelled the food truck / music event which was in our town, so I started a discussion with ChatGPT and Chat convinced me to move from X11 to Wayland, which meant switching desktop. Switching the desktop is a breeze, but resetting my tweak (to make it look like Windows 7) took me all afternoon, biut Wayland eperimental now supports international (dead) characters and seems to run well with all my applications. So I am no on Wayland (which has security advantages compared to X11).

funny because I installed fedora kinoite atomic KDE Plasma last night, and chatGPT was trying to get me off Wayland and onto X11 but my isp was having issues last night. funny copy / paste only worked from Host to Guest but not from the Guest to Host. Expect to tweak Kinoite when my isp settles down.

 

[LinuxFan58]

Which desktop environment did you install?

Cinnamon

 

[Victor M]

chatGPT was trying to get me off Wayland and onto X11

What was ChatGPT's reasoning ?

 

[lokamoka820]

Cinnamon

I thought you had installed GNOME or KDE Plasma because they support Wayland, while Cinnamon and XFCE support is still in experimental stage.

 

[LinuxFan58]

I thought you had installed GNOME or KDE Plasma because they support Wayland, while Cinnamon and XFCE support is still in experimental stage.

It is experimental fase, but everything seems to run nicely. Although yesterday I watched a movie on my laptop and at the end the system froze (could not escape the browser anymore, but luckily the movie kept playing, so I watched it to the, before using Alt+F2 & xkill ).

I have to develop a few courses (retired but still teaching sales for fun) so I am curious how Wayland handles 2 heavy PowerPoint open at the same tie while reading large PDF's and having opened many browser tabs). I will allow calling home in Opensnitch for problem reporting, so maybe my "edge case" usage might help developers to iron out some bugs (unless it becomes undo-able).

I already found a minor bug, it seems that (on battery) after 10 minutes the monitor goes black. After changing time out to 3 hours (in power management) that is gone. Apparently due to Wayland separation either screensaver or powermanagement are not aware of activity and think I am doing nothing.

 

[LinuxFan58]

What was ChatGPT's reasoning ?

A really valid and interesting question indeed and controversial to the info it provided me

As you posted Wayland prevents windows to communicate with each other. Zypack (in flatpak) weakens the internal sandbox ¨vertical" (between tabs seperation), but adds a strong "horizontal" layer (between browser and OS). Firejail on the other hand applies a ¨loosened/weaker" sandbox with fully functional internal Chrome sandbox. On X11 firejail clearly has the upper-hand (compared to flatpak), but due to Waylandś security benefits the weakened internal sandbox ¨vertical" seperation between tabs has less impact, making flatpak a good alternative because of its better horizontal protection layer (between browser and OS). ChatGPT still gives firejail a little advantage over flatpak in Wayland, but states that the real world use case scenario's (of flatpak) are probably as good as firejail.

I really dug into the pro's and con's over firejail versus flatpak and decided security benefits of firejail were not large enough for the ease of use flatpak offered (ChatGPT helped me to further tighten the flatpak sandbox). In Xfce I had switched to firejail because of the recent flatpak vulnability. But since this was backported, I am confident that the older flatpak version (which is used by Mint 22.3 LTS) will get security updates in the future. ChatGPT explained that flatpak bubblewrap runs as standard user and is much simpler and cleaner than Firejail mechanisms.

Why Wayland is safer than X11​

• Wayland isolates applications by default, preventing apps from reading other apps’ keyboard input, mouse events, or window contents.
• Wayland blocks most fake input injection (keyboard/mouse simulation), reducing risks like clickjacking and malicious automation.
• Wayland works much better with sandboxing systems such as Flatpak because apps cannot freely access the entire desktop

 

[Sampei.Nihira]

What does “Brave is free on Linux” mean?
Have you installed Brave Origin?