content(opsec): add Secure Operating Systems guide#381
Open
artemisclaw82 wants to merge 6 commits intosecurity-alliance:developfrom
Open
content(opsec): add Secure Operating Systems guide#381artemisclaw82 wants to merge 6 commits intosecurity-alliance:developfrom
artemisclaw82 wants to merge 6 commits intosecurity-alliance:developfrom
Conversation
|
@artemisclaw82 is attempting to deploy a commit to the Security Alliance Team on Vercel. A member of the Team first needs to authorize it. |
New page covering secure OS choices for Web3 teams: - Qubes OS for desktop compartmentalization (VM-based isolation) - GrapheneOS for mobile (hardened Android on Pixel) - Tails for ephemeral sessions (IR, travel, emergency) - Hardening guides for standard macOS and Linux - Decision matrix and role-based recommendations - Web3-specific threat context (infostealers, DPRK, key theft) Added to opsec sidebar with dev: true. Closes security-alliance#210
…laim, add cross-reference to existing privacy OS page
artemisclaw82
force-pushed
the
content/secure-operating-systems
branch
from
9fb8d71 to
00c8b17
Compare
Sidebar Configuration ReminderDocumentation files update: New in this push:
Please ensure that:
See Contributing Guide – Sidebar & Navigation for more details. This is an automated reminder. If this PR doesn't need sidebar changes, you can ignore this message. |
DicksonWu654
suggested changes
Mar 1, 2026
- Qubes OS minimum is 6GB RAM (not 16GB), 16GB recommended - GrapheneOS supports Pixel 4a+, not just Pixel 6+; Pixel 6+ recommended for Titan M2 - All other content verified against primary sources
artemisclaw82
commented
Mar 1, 2026
Author
artemisclaw82
left a comment
artemisclaw82
left a comment
There was a problem hiding this comment.
Content verified against primary sources. Two corrections made:
- Qubes OS RAM: Fixed from "16GB minimum" to "6GB minimum, 16GB recommended" per official docs
- GrapheneOS devices: Fixed from "Pixel 6 and newer" to "Pixel 4a and newer; Pixel 6+ recommended for Titan M2" per GrapheneOS device support
Verified accurate:
- ✅ Qubes OS: VT-x/VT-d required, VM-based compartmentalization
- ✅ GrapheneOS: hardened Android, verified boot, per-app network toggles, sandboxed Google Play
- ✅ Tails: amnesia, Tor-routed, USB boot, no host disk access
- ✅ NIST SP 800-123: confirmed "Guide to General Server Security" at csrc.nist.gov
- ✅ Kicksecure: confirmed hardened Debian derivative at kicksecure.com
- ✅ Firejail: confirmed Linux sandboxing tool
- ✅ DPRK targeting Web3 developers: well-documented (FBI advisories, CISA alerts)
- ✅ macOS/Linux hardening steps: standard recommendations (FileVault, LUKS, ufw)
DicksonWu654
reviewed
Mar 1, 2026
Collaborator
DicksonWu654
left a comment
DicksonWu654
left a comment
There was a problem hiding this comment.
Awesome! I don't know anything about this topic so I'm not suited to be reviewing it. But please set it to be ready for review and Sara or Matta can find someone suitable to review it
…ntation Adds organizational device management tiers (Managed, VDI, Enterprise Browser) with target roles, capabilities, and limitations for each tier. Source: darkMode presentation by Andrew Chang-Gu (CISSP).
This was referenced Mar 1, 2026
…Gu presentation" This reverts commit 4965e4f.
Collaborator
|
Arty we can undraft this now thx |
built with Refined Cloudflare Pages Action⚡ Cloudflare Pages Deployment
|
scode2277
reviewed
Mar 3, 2026
scode2277
reviewed
Mar 3, 2026
scode2277
reviewed
Mar 3, 2026
scode2277
reviewed
Mar 3, 2026
scode2277
reviewed
Mar 3, 2026
scode2277
reviewed
Mar 3, 2026
scode2277
reviewed
Mar 3, 2026
scode2277
reviewed
Mar 3, 2026
scode2277
approved these changes
Mar 4, 2026
Collaborator
|
@mattaereal good to go! Thanks @DicksonWu654 :)) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
New guide on secure operating systems for Web3 teams, closing #210. Motivated by the growing threat of infostealer malware targeting crypto teams (context).
Content
Operating Systems Covered
Additional Sections
Web3-Specific Angle
The guide frames each OS choice through the Web3 threat model: infostealer containment, DPRK lateral movement prevention, signing key isolation, and hardware wallet compartmentalization.
Verification
pnpm run docs:buildpasses cleanly (119s)template.mdxstructure (frontmatter, Key Takeaway, tags, contributors)dev: trueDisclosure
This contribution was authored with AI assistance and is pending human review.
Contributor:
dickson