Advanced Plus Security LinuxFan58's PC Security Config

[Sampei.Nihira]

@LinuxFan58

You always have 3 layers of download protection because you have the DownloadsRestrictions policy, even though it's set to 1, whereas I have it set to 4 (no FP):

Chrome Enterprise Policy List & Management | Documentation

 

[LinuxFan58]

Sampai-san I listened to your advice but this is part of Safe Browsing, so I stick to double download protection

 

[Sampei.Nihira]

But considering that the default policy value is 0 (No special restrictions) and that probably only 1–5% of users enable it, only those users (me + you + @7Oz-64 ) can rely on this type of protection against malicious downloads, as shown in the image below:



Look at the red arrow at the top.

Translation:

"Your organization has blocked this file because it did not comply with a security policy"

 

[7Oz-64]

@Sampei.Nihira
Thanks for remember me,
Yes download restriction set to 4 here and M Kees @LinuxFan58 i saw your policies and you should add more brave specific policies like these (i know you've already had some of them but not all :

  "TorDisabled": 1,
  "BraveRewardsDisabled": 1,
  "BraveWalletDisabled": 1,
  "BraveVPNDisabled": 1,
  "BraveAIChatEnabled": 0,
  "BraveNewsDisabled": 1,
  "BraveSpeedreaderEnabled": 0,
  "BraveWaybackMachineEnabled": 0,
  "BraveStatsPingEnabled": false,
  "BraveWebDiscoveryEnabled": 0,
  "BravePlaylistEnabled": 0,
  "BraveLocalAIEnabled": false,
  "BraveP3AEnabled": false,
  "BraveTalkDisabled": true

I'm back with brave-origin (External Ublock Origin (gorhill one) as UG-C is too slow for updating.
@Sampei.Nihira
MBG does a really good job to catch some fresh url haus bad url's, but it's slowdown browsing during my test.
And for Brave-Origin (still free on linux), i've disabled brave ad shields (just fingerprinting keeped).
@LinuxFan58
am still testing your extension package (uboS, matrix, ds, adshield), don't worry i think in near future i'm going to pass them in my production machine, DS is really a unique one, catch alls bad download 100%, for the others i think these needs more time to be completly mature.
And as you use Mint, you should try self hosted searxng + nginx + ca-https, no others search engine can protect you like this, if you're intersted i've a strong maintenance scripts pakaging (install, update, check, clean, renew cert, uninstall and hardened settings.yml, nginx.conf, searxng.service and limiter.toml)

 

[Sampei.Nihira]

@7Oz-64

For my Security setup,though I believe other Security setups could also do without this extension,a web filter extension is useless.
I already have NextDNS, Google Safe Browsing, excellent dynamic filtering, at least four consecutive layers of protection against malicious downloads, the most vulnerable software listed in the anti-exploit database with at least 13 or 14 overrides, and a hardened Brave sandbox that isn’t set to default......

P.S.

Why don't you start a thread with your own Security configuration?

 

[Sampei.Nihira]

@LinuxFan58

A question.
Do you think it's appropriate to enable this flag?

• Rust-based JPEG image handling

Keep in mind that it is disabled,not the default level.

 

[LinuxFan58]

@Sampei.Nihira

When you first told me about the new RUST features in flags (a few weeks ago), I typed in rust to see what is else available (Rust has memory integrity protection and C/C++ not).

I noticed RUST decoding was enabled for BMP but disabled for JPG and ICO (which are more complex than BMP), so assumed a phased migration and left it at the defaults (also my image/photo viewe/editor run sandboxed in Linux, and the old JPG meta data exploit was directed ar Windows and it was long ago, so I thought it was not a big deal).

 

[LinuxFan58]

am still testing your extension package (uboS, matrix, ds, adshield), don't worry i think in near future i'm going to pass them in my production machine, DS is really a unique one, catch alls bad download 100%, for the others i think these needs more time to be completly mature.

Thanks for the heads up 3P-Matrix-lite is complete matured.

AdShleld and uBS are nearing completion (added last useability features like saving/restoring settings and don´t know to optmize further in the code, from 9.5.1 for uBS and 1.3.1 for AdShield it will be bug fixing). There is not much use using uBS and AdShield side by side. Would be helpful when you focus on AdShield in combination with your favourite adblocker.

Thanks for the poliicy setting (maybe I had forgotten to tell you) I already added a few which you posted earlier (and not set myself)

Selfhosting search engines is a bit over the top for me, I pass on that

 

[LinuxFan58]

@Mods from Advanced Plus to Unverified? What happened?

Goodies

1. Cloudflare Zero Triust DNS with all security firewall policies enabled
2. NIDS and exploit protection in the router using all features (NAT, SPI, IP-MAC binding)
3. GuFW inbound firewall
4. HIDS (logcheck)
5. Linux sandboxing (AppArmor, Firejail, Flatpak)
6. Downloads are checked both in mail & browser
7. Fapolicyd application whitelisting
8. Wayland with strong application seperation
9. LittleSnitch application Firewall (outbound)
10. Linux running standard user
    
    On-demand VPN and half yearly (second) data backups are checked by M$ Defender

 

[harlan4096]

This is due to the changes @Jack is making these days in the Configuration sections...

 

[LinuxFan58]

This is due to the changes @Jack is making these days in the Configuration sections...

Thanks for the explanation

 

[harlan4096]

Also, and now, with the new system, I'm guessing that if You make a modification in the config, I think the previous assigned tag becomes again to Unverified...

 

[Victor M]

What have you applied Apparmor to ? On Ubuntu, only a few daemons, firefox snap and brave snap ( and maybe thunderbird too, dont know) have an enforcing policy. The majority of the profiles say explicitly that they are placeholders and not enforcing policies. They serve to fill up aa-status. So I think Mint would be at most, the same.

You should at least craft apparmor policies for your internet based apps. They are the most at risk. Just my 2 cents.

 

[LinuxFan58]

What have you applied Apparmor to ? On Ubuntu, only a few daemons, firefox snap and brave snap ( and maybe thunderbird too, dont know) have an enforcing policy. The majority of the profiles say explicitly that they are placeholders and not enforcing policies. They serve to fill up aa-status. So I think Mint would be at most, the same.

You should at least craft apparmor policies for your internet based apps. They are the most at risk. Just my 2 cents.

Only for print. I got desktop accesoires running in firejail and applications in flatpak. Downside of running apps in apparmor is not apparmor related, but LTS related.

For example libre office in packamanager is v24 while flatpak is v26. Flatpak sandbox runs in user land, so when running standard user I consider it enough layers of protection
1. Chrome sandbox
2. Flatpak sandbox
3. Standard user + fapolicyd (which I started using because you mentioned it)

@oldschool quote "stay safe not paranoid" is already a grey line with those three layers

 

[LinuxFan58]

Replaced NextDNS in the router by Quad9, our ziggo app on android (for TV on 2.4 Ghx network) had problems connecting. Also replaced Cloudflare Zero Trust for NextDNS in Brave (DoH).

 

[LinuxFan58]

Added NextDNS as DOH again, now NextDNS also blocks Youtube ads (and without delay), I am testing it out (other members reported website breakage), but ..

Now I don't need AG Base (for blocking youtube in video ads) anymore and I enabled Hagezi light in next DNS together with new option in NextDNS to block invideo ads on youtube. So back to LESS IS MORE again. Keeping annoyances, anti-adblock and anti-admiral because they are all website specific (no generic which might cause website breakage) to increase the seamless surfing experience (together with worry-free auto decline and cookie consent clicker).

 

[Sampei.Nihira]

Added NextDNS as DOH again, now NextDNS also blocks Youtube ads (and without delay), I am testing it out (other members reported website breakage), but ..

Now I don't need AG Base (for blocking youtube in video ads) anymore and I enabled Hagezi light in next DNS together with new option in NextDNS to block invideo ads on youtube. So back to LESS IS MORE again. Keeping annoyances, anti-adblock and anti-admiral because they are all website specific (no generic which might cause website breakage) to increase the seamless surfing experience (together with worry-free auto decline and cookie consent clicker).


View attachment 301171

HaGeZi DNS Blocklists - SOURCES

https://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&mimetype=plaintext&useip=0.0.0.0

https://camo.githubusercontent.com/...8742f696e636c7573696f6e2d6d61747269782e737667

PL list could theoretically be included.
You could run a test to see if HaGeZI Light includes most of Peter Lowe's domains.
And then, if necessary, uncheck the PL list in uBlock Dynamic.

 

[LinuxFan58]

HaGeZi DNS Blocklists - SOURCES



https://camo.githubusercontent.com/...8742f696e636c7573696f6e2d6d61747269782e737667

PL list could theoretically be included.
You could run a test to see if HaGeZI Light includes most of Peter Lowe's domains.
And then, if necessary, uncheck the PL list in uBlock Dynamic.

Thanks FYI

In uBlock Dynamic I only use the 250.000 Top N of Hagezi Lite (so less than half the rules). The Hagezi list has around (by head) 1365 of the Peter Low ads & tracking server. Peter Low's is old and established has a fair share of dead domains when you use the trackers from 2000 and onward (but stale domains costs nothing anymore in DNR contrary to old ABP rules), but it has an North America Focus, mine an West EU focus and AG and East EU focus, so they compliment each other nicely. They are only 3 Mv3 DNR rules, so for Chromium based browser not a problem (processing difference between 4 and 4K DNR rules is miliseconds on my laptop).

What I like about OISD and Hagezi lite is their low (no) website breakage, so it is okay to use them at DNS level.