Enterprise open source Toolkit

Story: Secure open source desktop gets public funding

• 
• 

Easy. Don't use Intel. Mount all writeable partitions noexec and all partitions with executables read-only. Use a restricted shell by default and run KDE (or fluxbox) in kiosk mode. Maintenance is done using sudo, and if necessary calling a non-restricted shell or temporarily re-mounting the partitions with new options. Some compact flash units even have a hardware based r/w switch - use that.

If the CPU is sufficiently powerful, then you can also encrypt directories or partitions.

For kiosks, make sure the user is not the owner of their home directory or key configuration files.

• 
• 

• 
• 
• 

Full Talkback thread