I'm worried about security, would switching to OpenSUSE TW help me use my PC more securely?

English Open Chat
1

I posted this initially on reddit, but one of the more knowledgable sounding users suggested i post it here, and it won’t be too dumb for the forum!

I’ve been using CachyOS with 0 Cachy-Specific Problems for a few months now and i’m pretty happy with the performance and day-to-day use.

But yesterday at 2 Am the AUR debacle from June came back to my mind.

This is my main PC, it has everything archived for the entire family, dating back to 2006. (with back ups on some SSDs but i could do a better job syncing…)

OpenSuse has been intruiging me for a while, and i’m considering swapping now before i’m too dug in in CachyOs. My main concern is security and stability. the AUR story and the daily updates on CachyOs

Based on my concerns about Security, would it be recommended to swap to OpenSuse? Thanks in Advance!

I don’t game much these days, maybe a few days a month at most, I have Windows on a separate NVME in case i want to play something.

I mostly do general stuff on the pc. Browsing the internet, using Calibre, managing family files/media, printing/scanning ■■■■■ reading and basic editting of PDFs. I guess i am in the zone where professionals see me as a - slightly - informed casual user, and non-users look at me like a wizard because i memorized some hotkeys and created some macros and know fancy words like administrator permissions.

2

I fear this is too sweeping and too general to give any useful answer.

1 Like
3

Hi, welcome

I was going to write ~the same

2 Likes
4

I have never had any security problems using openSUSE. As long as you have everything in your /home folder backed up, you should be able to install openSUSE and then restore your backups easily if the user and group configuration is one which openSUSE understands and with a little more work if it isn’t.

2 Likes
5

hey! thanks for taking the time.to read and answer.

I just want to know, given the same usage, am I safer on OpenSUSE tw than on cachyOS?

after typing that it occurred to me that I’m making it even more ambiguous, for some reason I’m drawn into trying it out anyway.

6

I never used cachyOS, but in general I tend to think that in terms of security different Linux distros are not too far apart from each other. The important components like the kernel, systemd, base tools like shells and file utilities are very much the same (maybe different slightly in version numbers), also the desktops. Some default settings may be different, but the impact on security will largely depend on your individual usage patterns.

2 Likes
7

This is a very complex question, and as others have noted, difficult to answer. But there are no “dumb” questions, because asking questions is one important way to learn.

There are no guarantees when it comes to security. Something like the AUR issue you mentioned from June can certainly happen to anyone, because new threat vectors are always exposed, and the “bad guys” are always looking for ways to compromise systems in new and novel ways.

That doesn’t mean that infrastructure security isn’t treated as a serious issue, but it would be naive to think it can’t happen to any given project, especially with AI systems being used to find vulnerabilities that can be exploited at an even more rapid pace.

Security is also largely down to following best practices as a user, and understanding the risks of various types of behavior. For example, nobody could guarantee any given system is going to protect you against phishing if one has a tendency to follow links in e-mails they receive from unknown senders or visiting questionable and risky sites. Exercising what’s often described as “good digital hygiene” is essential to operating a secure system.

But even then, the system could be compromised. It’s a game of probabilities.

For example, on my main system (which runs Tumbleweed), I have a number of services exposed to the Internet through a reverse proxy that provides authentication. That means I have ports open to my main system that get probed by bots regularly (and by “regularly”, I mean constantly. When I am doing maintenance on the system, I stand up a temporary web server service that logs all attempts to access anything, and while it isn’t a fast-running stream of attacks, it is frequently more than 1 attempt per second.

I’ve had a system logging these attempts when the system isn’t undergoing active maintenance (when I have the services and proxy shut down), and even right now, I’m seeing a request every 2-3 seconds trying to exploit something related to a Remote Code Execution tracked as CVE-2023-27997 (called “XORtigate”, something to do with FortiGate SSL VPN interfaces, which I don’t use). 39 attempts mostly from different IP addresses just in the last 5 minutes.

Obviously, if you’re not hosting services and your router isn’t forwarding ports to your machine, you’ll be more secure, but many security incidents happen not because of an active probe, but because of user action (or inaction).

Tools like AppArmor or SELinux are certainly helpful, but understanding how they work and what they do and don’t do is also very important.

3 Likes
8

Thank you very much for taking the time to answer.

I’ve spent a huge chunk of my life sitting in front of a computer since i was a kid. and luckily, as far as i’m aware, I haven’t been a victim of any serious threats. so i hope i have developed the basic habits that ensure security.

I’m worried about vulnerabilities stemming from the system itself. I had a gut feeling that openSUSE places security as a higher priority than CachyOS (a performance OS), so i was intruiged about switching.

As @shundhammer said though, the biggest contributor to my system’s security is me, not doing anything risky. So i’ll just be careful with my back ups.

Still, I flashed a USB drive with OpenSuse and will be giving it a try, if it doesn’t give me any problems i’ll likely switch. The whole Arch thing seems too “wackelig” or too unstable for me.

again, i appreciate taking the time to answer. If i do switch, there will be more questions from me!

Have a nice day/night

1 Like
9

Give openSUSE a try. I think you’ll like it.

But be aware that there are several different flavors of openSUSE:

  • Leap (current version 16.0), the “point release”; its emphasis is on stability, not on “bleeding edge” technology. There is a new release about once a year, and then you should upgrade to that newer one. Until that time, you’ll get bugfix and security updates, but usually no new versions of any packages.

  • Tumbleweed, the rolling release. The emphasis is on “bleeding edge”; the latest of all packages as they come in from the upstream projects, i.e. the original authors of that piece of software. Sometimes there may be rough edges. And you do get version updates - LOTS of version updates. Every day or at least every few days.

  • Slowroll - a rolling release based on Tumbleweed, but rolling a bit slower; with a delay of 2 or 3 weeks. Anything that was broken in Tumbleweed 2 or 3 weeks ago is usuallly already fixed by the time it reaches Slowroll. It’s bleeding edge without doing the bleeding yourself.

    This is my favorite flavor.

  • MicroOS, an “immutable” distro. This is not for tinkering, it’s a platform for running container workloads (docker, podman).

  • Aeon, an immutable GNOME desktop. See here.

  • Kalpa, an immutable KDE Plasma desktop. See here.

3 Likes
10

Thanks for the overview!

I’ll give the slow roll a try then, seems like what I’d want to have as my system.

1 Like
11

First – Welcome to the openSUSE Forums!

I went searching for the CachyOS AUR issue and found this: <https://discuss.cachyos.org/t/aur-compromised-almost-2000-packages-affected-20260611/31040>

As recently discussed on the Arch Mailing list there appears to have been a large coordinated attack on the AUR some time within the last 24 hours that seems to have resulted in a rather sizable amount of packages being contaminated with malware.

This is a good reminder that the AUR is open, unofficial, user-produced, content.

The only secure way to use the Arch User Repository is by reviewing every PKGBUILD.

  • AUR → “Arch User Repository”

In other words, the issue in question wasn’t with the OS as such but, with an open repository for user-produced content – without any checking or review by the people responsible for the OS as such.

Does openSUSE have something similar to the AUR?

  • Yes it does → the “openSUSE Build Service” which is a public instance of the “Open Build Service” (which is a project managed by openSUSE and SUSE).
    The Security statement is here: <Security Policies and Procedures>

Now, the 64 dollar question: “Is OBS more secure than AUR?”

  • There are more than few opinions around this topic to be found on the Internet.

My personal view:

  • It depends on the management and administration of the open repositories for user-produced code.
    And, trust.

Why do I prefer to use openSUSE?

  • Trust.
    Based on experience and, personal contact via the openSUSE Conference. <openSUSE Events>
  • <Welcome to openQA> → without an open Quality Assurance and testing environment, trust is difficult and for someone like myself – impossible …
3 Likes