If anybody is interested: distros like Secureblue and Kicksecure (and Kicksecure-based ones like Whonix) reduce attack surface by disabling a bunch of kernel modules, and further harden the kernel via sysctl settings and kernel arguments. Secureblue also sends a notification whenever a system update fixes a vulnerability.
If anybody is interested: distros like Secureblue and Kicksecure (and Kicksecure-based ones like Whonix) reduce attack surface by disabling a bunch of kernel modules, and further harden the kernel via sysctl settings and kernel arguments. Secureblue also sends a notification whenever a system update fixes a vulnerability.
https://secureblue.dev/features
https://www.kicksecure.com/#security
So how many of the 900 are they vulnerable to?