Field Notes

source

Kicksecure vs secureblue development comparison

StatusStableUpdatedStands on1 sourceSupportsnotes

Saved copy.

A Kicksecure wiki page providing a side-by-side comparison of secureblue and Kicksecure security features, development decisions, and implementation rationale. It is written from the Kicksecure project’s perspective and includes TODO notes for future Kicksecure improvements.

Key points of convergence: both apply KSPP-aligned kernel hardening via sysctl, both install USBGuard, both restrict unprivileged user namespaces, and both harden SSH defaults.

Key points of divergence: secureblue uses hardened_malloc globally while Kicksecure deprecated it; secureblue uses SELinux while Kicksecure uses AppArmor; secureblue ships Trivalent (Chromium-based) while Kicksecure provides a browser choice tool; secureblue is sudoless via run0 while Kicksecure uses user-sysmaint-split with separate accounts; secureblue uses NTS for time while Kicksecure uses sdwdate; secureblue uses systemd-resolved optionally while Kicksecure avoids it due to security concerns.

The page also documents a disagreement on fusermount: Kicksecure whitelists SUID for fusermount, while secureblue sets cap_sys_admin, which Kicksecure’s developers consider dangerous.

This is a valuable comparative primary source but reflects one project’s perspective. The secureblue project does not maintain an equivalent comparison page.

Built on 1 source (1 external).

Working out connections…