Well everything has weaknesses, and nothing is perfect. I still trust xen over linux and Qubes OS over any other operating system. It is “a reasonably secure operating system” and doesn’t claim to be anything else. But you are definitely correct to point out that we should not put blind trust into something as if it cannot fail.

• I’m not sure Android belongs in the bottom tier. Or at least not yet. As of right now, you can still use it as an open OS, and it’s great for devices such as handheld gaming consoles. I’ve also never seen age verification in Android yet.

Google’s Android is in the Malware row because google is a nefarious surveillance advertising corporation, and their android offering is known for having trackers/spyware built-in. From what I’ve read, Android Open Source Project (AOSP) is to Android as Chromium is to Chrome, in that it’s not as infested with google trackers/spyware while still being generally googled in the way that it phones home for ntp and dns connectivity checks.

You are correct that android does not yet require age-verification, and I’m kinda surprised you’re the only one to have pointed this out so far. I simply didn’t feel like waiting to share this tier list meme thing and didn’t want to make it seem as though apple is the only one implementing age-verification.

• Why is LineageOS ‘borderline’? I’m not aware of anything dangerous about it. It’s not far from Graphene, just for a lot more devices.

LineageOS is not degoogled and will connect to google unless properly firewalled, which afaik cannot be done properly on-device. LineageOS is googled android, and google is a nefarious surveillance advertising corporation. So LineageOS is borderline malware in my eyes.

In contrast, GrapheneOS is fully degoogled and is also maximally secured, which is why I placed it in a much higher rank. Though, it is ultimately still android, so it’s not for me. Android is under google’s control and doesn’t look like it will last indefinitely. I feel that android itself is a dead-end. Projects like GrapheneOS will have to do a hard fork away from android one day, or they will cease to exist as an option.

• Why are Artix Linux and Waydroid ‘dubious’? Especially Waydroid, as it’s not an operating system.

Waydroid is basically a containerized LineageOS which can at least be firewalled from the host os, but that’s sub-optimal, which is why I have it one notch above LineageOS.

I had tried Waydroid on my linux phone, and the OpenSnitch firewall running in the host linux system flagged multiple google connections that Waydroid was attempting to make upon starting. Basic connectivity stuff, but googled nonetheless. I hadn’t seen any disclaimers on their site about it, but I also hadn’t seen anything about LineageOS advertising itself as degoogled in the first place. I view degoogled android as generally acceptable (though it’s not for me), but googled android is unacceptable (in my view). So I placed Waydroid in the Dubious row to represent my unwillingness to recommend it.

As for Artix Linux, this repo, made in response to another repo, has this bit:

Artix Linux | Developers are openly transphobic

When attempting to click the link to see for myself, I still find that the artix forums are inaccessible, and so I can’t see for myself. I remember seeing something mentioned on a reddit post or forum somewhere about the same sort of thing, which makes me think it’s true. So I placed Artix in the Dubious row to represent my unwillingness to recommend it.

The other two I’m unfamiliar with, or at least the logos.

The other two distros in the Dubious row are Omarchy and OpenMandriva.

When researching Omarchy, I came across articles like this, this, and this detailing the many unpleasant aspects of the dev’s character, including racism and transmisia. So I placed Omarchy in the Dubious row to represent my unwillingness to recommend it.

When researching OpenMandriva, I came across lots of links referring to it as “the non-woke linux distro” and their forum, which was and is accessible, was what I’d expected to see. Basically “non-political” politics, which tends to mean anti-<group>. It was an unpleasant place, and I think the intention is to make it unpleasant for the types of people they hate so as to keep them away. So I placed OpenMandriva in the Dubious row to represent my unwillingness to recommend it.

This might be the best looking and most comprehensive tier list of anything I’ve ever seen.

tyvm 🩷

I prefer the term “fool” for this use-case. Similar to this 🏳️‍⚧️ meme:

LineageOS is not degoogled and will connect to google unless properly firewalled, which afaik cannot be done properly on-device. LineageOS is googled android, and google is a nefarious surveillance advertising corporation. So LineageOS is borderline malware in my eyes.

/e/OS is not in any of the gray rows that denote a failing grade. It is in the red “Corporate” row, because it is owned/controlled by a corporate entity, and it has a passing grade from me. I trust it for my parents and other “normal” people who need a phone that works without issues. MicroG is installed and enabled by default, but if it is disabled, then /e/OS becomes fully degoogled.

However, as I said in another comment:

android is under google’s control and doesn’t look like it will last indefinitely. I feel that android itself is a dead-end. Projects like GrapheneOS will have to do a hard fork away from android one day, or they will cease to exist as an option.

Why does LFS have its own group? Honestly, it’s mainly just so that the logo stands out better in the dark-mode version of this tier list. I also felt it made sense to single it out as special.

Why are there groups for Secure Fedora and Secure Android? Since there are already groups for Red Hat distros (which includes Fedora) and Android, I thought it made sense to make it obvious that the secure fedora/android distros were part of those other groups, similar to my reasoning for making a Secure Debian group. Those distros being optimally secured grants them higher rank than all the rest of the distros from those groups. All the other distros stay where they are because I don’t see them as different enough to rise in the list. The secured ones, I do see as having reason to rise, and so they are placed higher, but I want it to be obvious that they are in fact Debian/Fedora/Android at their core.

As I said in another comment:

I did initially have CachyOS in the gaming group, but after looking a little closer, it appears to be a general-purpose distro optimized for performance, which happens to be useful for gaming. So it doesn’t seem to be specifically made for gaming, which is why I pulled it out of that group but kept it right next to it (and next to the “popular” group, since it’s one of the most popular distros).

It’s definitely not for everyone, but it’s very good at what it sets out to do and be, for those who want or need such a thing. It compliments my ocd nicely, especially the concept of disposable qubes. It’s just perfect for me. The optimal security also gives me peace of mind, a calm mind. It’s lovely. But yeah, I understand that it’s not for everyone. It’s cool that you tried it though. Most people don’t even know it exists.

I haven’t actually tried them all, not even most of them. The spider one is Slitaz. There’s a spoilered list in the main post btw.

💕

Serious reply: That’s understandable. Fun reply: Imagine how useless the emoji version would be to you :p

One problem is that some of the distro names are so long that I’d either have to shrink the text for all names or do it selectively, neither of which feels good to me, so I opted to just not list the names in the image itself (at least not yet). Another thing is that it took so long to align all the other text in the image, and it would devour my time to try adding all of the distro names. Yet another thing, I’m pretty sure I’d have to shrink all of the logos in order to properly fit the distro names, and even slightly altering the size of any logo would mean that I’d have to spend a lot of time realligning them. Did I mention that I made this in a text editor?

I kinda disappeared from fedi for a long time when I switched to using matrix, but I eventually started browsing again and only recently decided to actually interact. Idk how long this will last for me though, since I generally feel disconnected from this platform and its people. Most people really. I used to see these platforms as possibilities for finding people and building communities, but they all seem more like outlets than anything else. Some users meme, others rant or rage, and it feels like such an emptiness. idk, count this as one of my mini-rants. 🩷

While that can be a valid concern, that’s not my reason for placing Artix in the Dubious row. See my other response here.

(can someone remind me how to properly format links to comments so they bring the user to the instance being used?)

This repo, made in response to another repo, has this bit:

Artix Linux | Developers are openly transphobic

When attempting to click the link to see for myself, I still find that the artix forums are inaccessible, and so I can’t see for myself. I remember seeing something mentioned on a reddit post or forum somewhere about the same sort of thing, which makes me think it’s true. So I placed Artix in the Dubious row to represent my unwillingness to recommend it.

Very good points, but I wanna add that since MicroG does make connections to google, I don’t see MicroG as usable either and would place it alongside LineageOS as borderline malware. Phoning home to a nefarious surveillance advertising corporation with bad history is not acceptable to me. The main issue I have with /e/OS (besides being android) is that it has MicroG installed and enabled by default, requiring the user to disable it in order to complete the degoogling of the device. And it’s also annoying that it cannot be removed. There should be 100% degoogled murena devices which do not ship with that shit installed. Though I’d much prefer to see new Fairphones shipped with postmarketOS as an option, and bonus points for optionally shipping without a cellular modem.

“Possibly” denotes the fact that it depends on the user’s sensibilities.

LineageOS is not degoogled and will connect to google unless properly firewalled, which afaik cannot be done properly on-device. And as another user pointed out, android is under google’s control and doesn’t look like it will last indefinitely. I feel that android itself is a dead-end. Projects like GrapheneOS will have to do a hard fork away from android one day, or they will cease to exist as an option.

But anyway, LineageOS is googled android, and google is a nefarious surveillance advertising corporation. So LineageOS is borderline malware in my eyes.

Feel free to disagree of course. I don’t really care either way. You do you.

I had initially considered that but ultimately decided it would be easier and more similar to other tier lists to keep it left-aligned. But yeah, I know it’s a lot and might be too complicated to easily understand. Good enough for a meme though, I figure.

If the “one job” involves networking, then the machine is already doing more than one job, since it’s also managing network connection and firewalling. I’m not saying that such a thing can’t be very well-optimized for security, just that networking complicates things.

While I don’t doubt that those options can be made very secure, I don’t think they can reach the level of security offered by Qubes OS, as it’s not just a linux distro but is actually a xen-based type 1 hypervisor. The core of Qubes OS is security by compartmentalization, which includes hardware and software isolation. Disposable service qubes based on minimal templates with only the necessary packages installed, all managed by a type 1 hypervisor, seems out of the scope for what can reasonably be accomplished in a linux distro, whether LFS, Gentoo, or Slackware Linux. But idk, I’m just a user, not a dev.

I think you mean hardware isolation. By leveraging a type 1 hypervisor, Qubes OS does have hardware isolation, in addition to software-based isolation. For instance, physical devices like ethernet, wireless, and usb, are all capable of being isolated from the rest of the system (and from each other) and managed by dedicated service qubes. You can also have dedicated minimal templates for each service qube to reduce attack surface and increase efficiency of the service qubes. And then you can also configure the service qubes to be disposable, which is very nice.

Being open source doesn’t negate their control over the project. Mullvad ultimately controls the project and the branding for it, as well as advertising for their vpn service within the browser by way of their addon. Some users will continue to use the browser, and that’s fine. Some users will stop using the browser, and that’s also fine. I understand both perspectives. I just can’t recommend it anymore, like how I don’t recommend anything coming from GAFAM. There are alternatives. There always are. Tor Browser remains the best browser anyway.