I am not the creator of the video but amazed what it all makes it into the stable branch.

download some unknown exe or sideload some dll with admin rights sound like good idea.

agree. you mention debian and arch. I have also tried both of them. the problem with arch (rolling distribution) is that you are forever updating and you never know what exactly has changed in the system and you have to look. You can still have so much experience and solve problems, but they always cost time. all this from a daily user perspective is crap.

from a security point of view, new software can contain security loopholes just like old software. i’d rather have a stable base where i can easily keep an eye on changes than daily updates.

Debian support it too. The kernel is secure boot ready and it’s very easy to sign nvidia kernel module with the default shipped key via mok.

as far as i know umatrix is unmaintained. so the default ublock + noscript seems the best combination.

Would you please let me know how do i get the same “all scripts are blocked” and allowlist specific domains only like in noscript? As far as i know ublock enable/disable javascript for whole website not subdomains. I could be wrong. And noscript have xss protection.

Ublock [1] and Noscript [2] are must have. you could also checkout Privacy Badger [3].

If you use arkenfox user.js [4] you could also use I still don’t care about cookies [5]

• [1] https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/
• [2] https://addons.mozilla.org/en-US/firefox/addon/noscript/
• [3] https://addons.mozilla.org/en-US/firefox/addon/privacy-badger17/
• [4] https://github.com/arkenfox/user.js/
• [5] https://addons.mozilla.org/en-US/firefox/addon/istilldontcareaboutcookies

100% because i have javascript disabled.

This is a very nice guide with encryption support where you can learn a lot: https://gist.github.com/orhun/02102b3af3acfdaf9a5a2164bea7c3d6 . Please note i’m not the author.