Embed Notice

@lispi314 @lanodan @phnt it truly is. opensuse ships somewhat hardened systemd units (namespace isolation, syscall restrictions and so on and so forth) plus apparmor by default, and it has a yast module for some rudimentary privilege tweaking/hardening. it can also work as a transactional system where every change is done to a new copy-on-write snapshot of the filesystem.

but the way i see it all this crap is no better than windows users and their real-time antiviruses in that these are measures to limit the damage that can be done to a system that simply lacks secure user-space APIs and on the kernel level has never seriously been designed to provide a secure environment (which would make it incompatible with UNIX/POSIX)