Advanced Plus Security LinuxFan58's PC Security Config

[Sampei.Nihira]

@LinuxFan58

You always have 3 layers of download protection because you have the DownloadsRestrictions policy, even though it's set to 1, whereas I have it set to 4 (no FP):

Chrome Enterprise Policy List & Management | Documentation

 

[LinuxFan58]

Sampai-san I listened to your advice but this is part of Safe Browsing, so I stick to double download protection

 

[Sampei.Nihira]

But considering that the default policy value is 0 (No special restrictions) and that probably only 1–5% of users enable it, only those users (me + you + @7Oz-64 ) can rely on this type of protection against malicious downloads, as shown in the image below:



Look at the red arrow at the top.

Translation:

"Your organization has blocked this file because it did not comply with a security policy"

 

[7Oz-64]

@Sampei.Nihira
Thanks for remember me,
Yes download restriction set to 4 here and M Kees @LinuxFan58 i saw your policies and you should add more brave specific policies like these (i know you've already had some of them but not all :

  "TorDisabled": 1,
  "BraveRewardsDisabled": 1,
  "BraveWalletDisabled": 1,
  "BraveVPNDisabled": 1,
  "BraveAIChatEnabled": 0,
  "BraveNewsDisabled": 1,
  "BraveSpeedreaderEnabled": 0,
  "BraveWaybackMachineEnabled": 0,
  "BraveStatsPingEnabled": false,
  "BraveWebDiscoveryEnabled": 0,
  "BravePlaylistEnabled": 0,
  "BraveLocalAIEnabled": false,
  "BraveP3AEnabled": false,
  "BraveTalkDisabled": true

I'm back with brave-origin (External Ublock Origin (gorhill one) as UG-C is too slow for updating.
@Sampei.Nihira
MBG does a really good job to catch some fresh url haus bad url's, but it's slowdown browsing during my test.
And for Brave-Origin (still free on linux), i've disabled brave ad shields (just fingerprinting keeped).
@LinuxFan58
am still testing your extension package (uboS, matrix, ds, adshield), don't worry i think in near future i'm going to pass them in my production machine, DS is really a unique one, catch alls bad download 100%, for the others i think these needs more time to be completly mature.
And as you use Mint, you should try self hosted searxng + nginx + ca-https, no others search engine can protect you like this, if you're intersted i've a strong maintenance scripts pakaging (install, update, check, clean, renew cert, uninstall and hardened settings.yml, nginx.conf, searxng.service and limiter.toml)

 

[Sampei.Nihira]

@7Oz-64

For my Security setup,though I believe other Security setups could also do without this extension,a web filter extension is useless.
I already have NextDNS, Google Safe Browsing, excellent dynamic filtering, at least four consecutive layers of protection against malicious downloads, the most vulnerable software listed in the anti-exploit database with at least 13 or 14 overrides, and a hardened Brave sandbox that isn’t set to default......

P.S.

Why don't you start a thread with your own Security configuration?

 

[Sampei.Nihira]

@LinuxFan58

A question.
Do you think it's appropriate to enable this flag?

• Rust-based JPEG image handling

Keep in mind that it is disabled,not the default level.

 

[LinuxFan58]

@Sampei.Nihira

When you first told me about the new RUST features in flags (a few weeks ago), I typed in rust to see what is else available (Rust has memory integrity protection and C/C++ not).

I noticed RUST decoding was enabled for BMP but disabled for JPG and ICO (which are more complex than BMP), so assumed a phased migration and left it at the defaults (also my image/photo viewe/editor run sandboxed in Linux, and the old JPG meta data exploit was directed ar Windows and it was long ago, so I thought it was not a big deal).

 

[LinuxFan58]

am still testing your extension package (uboS, matrix, ds, adshield), don't worry i think in near future i'm going to pass them in my production machine, DS is really a unique one, catch alls bad download 100%, for the others i think these needs more time to be completly mature.

Thanks for the heads up 3P-Matrix-lite is complete matured.

AdShleld and uBS are nearing completion (added last useability features like saving/restoring settings and don´t know to optmize further in the code, from 9.5.1 for uBS and 1.3.1 for AdShield it will be bug fixing). There is not much use using uBS and AdShield side by side. Would be helpful when you focus on AdShield in combination with your favourite adblocker.

Thanks for the poliicy setting (maybe I had forgotten to tell you) I already added a few which you posted earlier (and not set myself)

Selfhosting search engines is a bit over the top for me, I pass on that