diff --git a/_includes/nav.html b/_includes/nav.html index a649fe92e..5db86462a 100644 --- a/_includes/nav.html +++ b/_includes/nav.html @@ -87,7 +87,7 @@ PC OS - PC Live OS + Tor focused distributions Mobile OS Android Privacy Add-ons Router Firmware diff --git a/_includes/sections/mobile-operating-systems.html b/_includes/sections/android-operating-systems.html similarity index 57% rename from _includes/sections/mobile-operating-systems.html rename to _includes/sections/android-operating-systems.html index 1b1de836d..6825a1bf6 100644 --- a/_includes/sections/mobile-operating-systems.html +++ b/_includes/sections/android-operating-systems.html @@ -1,16 +1,26 @@

Mobile Operating Systems

+

Android-based Operating Systems

+ +{% include cardv2.html + title="CalyxOS" + image="/assets/img/svg/3rd-party/calyxos.svg" + description='CalyxOS is a custom ROM based on the Android Open Source Project with Pixel phones. It aims to be secure and private by default including a number of good choices for default applications. It also supports verified boot.' + badges="info:AOSP" + website="https://calyxos.org" + gitlab="https://gitlab.com/calyxos" +%} + {% include cardv2.html title="GrapheneOS" image="/assets/img/svg/3rd-party/grapheneos.svg" image-dark="/assets/img/svg/3rd-party/grapheneos-dark.svg" description='GrapheneOS (formerly known as CopperheadOS) is a free and open-source security- and privacy-focused mobile operating system built on top of the Android Open Source Project. It currently specifically targets devices offering strong hardware security.' badges="info:AOSP" - labels="color==warning::text==contrib::tooltip==This software may depend on or recommend non-free software." website="https://grapheneos.org/" github="https://github.com/GrapheneOS/" %} @@ -20,49 +30,14 @@

Worth Mentioning

-

Remember to check CPU vulnerability mitigations

+{% include sections/tor-operating-systems.html %} -

This also affects Windows 10, but it doesn't expose this information or mitigation instructions as easily. MacOS users check How to enable full mitigation for Microarchitectural Data Sampling (MDS) vulnerabilities on Apple Support.

- -

When running a recent enough Linux kernel, you can check the CPU vulnerabilities it detects by tail -n +1 /sys/devices/system/cpu/vulnerabilities/*. By using tail -n +1 instead of cat, the file names are also visible.

- -

- In case you have an Intel CPU, you may notice "SMT vulnerable" display after running the tail command. To mitigate this, disable hyper-threading from the UEFI/BIOS. You can also take the following mitigation steps below if your system/distribution uses GRUB and supports /etc/default/grub.d/: -

- -
    -
  1. sudo mkdir /etc/default/grub.d/ to create a directory for additional grub configuration
    2. -
  2. echo GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT l1tf=full,force mds=full,nosmt mitigations=auto,nosmt nosmt=force" | sudo tee /etc/default/grub.d/mitigations.cfg to create a new grub config file source with the echoed content
    3. -
  3. sudo grub-mkconfig -o /boot/grub/grub.cfg to generate a new grub config file including these new kernel boot flags
    4. -
  4. sudo reboot to reboot
    5. -
  5. after the reboot, check tail -n +1 /sys/devices/system/cpu/vulnerabilities/* again to see that everything referring to SMT now says "SMT disabled."
    6. -
- -
Further reading
- - - -{% include sections/live-operating-systems.html %} - -{% include sections/mobile-operating-systems.html %} +{% include sections/android-operating-systems.html %} {% include sections/android-addons.html %} +{% include sections/other-mobile-operating-systems.html %} + {% include sections/router-firmware.html %} {% include sections/windows10.html %}