@zakazak, I'm interested to know if you're willing to test Leopard Flower. It was made for Ubuntu 10.10, though, so you might have to do some tricks to get it working for Arch (like reviewing the source code and adapting libraries).
@amarildojr have you seen -http://www.in.techradar.com/news/software/security-software/10-of-the-best-Linux-distros-for-privacy-fiends-and-security-buffs/articleshow/47211893.cms- ? May it make more sense using such distros?
vasa1, that techradar article is a year old... and is essentially just clickbait. The article doesn't even try to justify/qualify why those 10 are featured. If you search "Distribution category = Security" http://distrowatch.com/search.php only 19 total are listed. So, it's kinda senseless to pick, rank "the best 10". (btw: 19 "listed"... but, of those, only 5 or so have issued a fresh release during the past 12mos) I've booted DEFT and CAINE. Wow (blech). Chockablock, fill-in-the-blanks, forensic case management For Dummies(TM). IMO, the others, collectively, fit into 2 categories: -- provides toys for scriptkiddies -- invites a false sense of security
Whoops, re-reading my post a day later, it seems too disrespectful, too dismissive. Specific to geoclue and similar data leakage, my point was that the "security" distros do nothing special to prevent such leakage.
Security and Privacy are two different things. I'm not sure I follow the author's line of though. Penetration Testing distros are not necessarily privacy-aware distros. If the author meant that these distros can be used to see how is the privacy of OTHER systems, than I agree. Honestly, I see no advantage of using (almost) any of these distros. Some only have forensic tools, which can be installed on any distro. Others make it possible to use the Tor network, which also can be done on any other distro. Some have a form of encryption, which can also be done on any other distro. What I personally recommend is: Tails and JonDo. Not for day-to-day use, but only if the user (which should have a spare common-brand notebook that was bought used and is only used for this purpose) needs to use these live systems on a public place where more people are also connected with notebooks. For home/day-to-day use I just prefer using regular Arch/Debian with a few privacy packages such as Tor, OpenVPN, Firejail, and etc.
Not sure if it has been posted yet bu on my Arch there also exists geoclue.service which I just stopped & disabled (actually I had to "mask" it).
whew, thanks for posting this. I didnt even have any idea that these sorts of things existed in the Linux world. I had explicitly disabled geolocation support in Firefox. Fortunately, I also dont have any of the packages you mentioned installed. I run a pretty lean Openbox setup though so not too surprising. Free bump for other Linux users so they make sure they consider whether these should be installed.
This is an old thread but I wonder if I should create fake packages for those as well? geoip geopip-database So far I created fake pkgbuilds for: geoclue2, geocode-glib and libgweather. Else several parts of GNOME would be broken. Just as I also need webkit2gtk and yelp installed for GNOME to work.
I would definitely do so. That's one of the reasons I completely dropped GNOME and GNOME-Based DE's like MATE. On KDE the only fake package I need to create is libkgapi. No webkit, zeinity (removed it from Steam's package and created my own Steam package), geoclue, etc. None of these are installed by default, not even for programs such as Libreoffice, GIMP, Iceweasel/Firefox, and others that use the GTK engine.
Update: "Faking" libgweather will break GDM/GNOME. So it is installed again. geoip is required by "bind-tools". Will faking geoip cause troubles?
Because errors might not be noticed immediately but after some weeks/months wheen I had completely forgotten about those packages and won't think of them as the root-cause of a problem. And because I thought someone had tried it already. Dummy-Packages are not as easy as a per-app firewall with notifications and everything ;-)
