Vs stock secureblue
We phone home less. The locks stay.
Stock is already a privacy-respecting security OS. Unwoke does not replace their kernel or Trivalent jail. We turn off leftover census, LAN identifiers, and Google extras they still ship, and we default more radios and stores off. If a change would weaken Safe Browsing, firmware updates, or SELinux, it is not a default — it is optional and warned.
Security first Every line reverts Not a fork
One sentence. Same signed secureblue image. Fewer conversations with Fedora, the LAN, and Google. Same firewall, same USBGuard, malware lists still on. Recommended flavor: *-trivalent.
Four quiet rooms
01 · Fedora
No machine census
Stock runs rpm-ostree-countme.timer: a bi-weekly “how many of us are there” ping to mirrors. We mask it. Fedora does not get a unique-ish count of your box. Revert: ujust set-countme on.
02 · Online check
No “am I online?” GET
GNOME/NetworkManager fetches a Fedora/GNOME URL whenever you join a network. That is how they learn you came online. We disable it. Hotel captive-portal pages may need ujust set-connectivity-check on.
03 · Disk leftovers
Less leftover on disk
Not Tails. The ostree still exists. We stop writing the usual forensic buckets: persistent journals, hibernate RAM images, crash dumps, file indexers, GTK “recent files.” Revert: ujust set-disk-traces on if you need journalctl -b -1 or hibernate.
04 · The LAN
No hostname on DHCP
Stock randomizes MAC, then still announces your hostname and a stable DHCPv6 DUID. We do not send hostname, use MAC-based DHCP ids, IPv6 stable-privacy, and turn off LLMNR/mDNS registration. Their own ticket for this was never shipped. Revert: ujust set-dhcp-hostname on.
05 · The browser
No Google extras. Safe Browsing stays.
Hardening pack: no metrics, sync, autofill, saved passwords, translate, hyperlink ping, Privacy Sandbox (Topics/ads), Cast beacon, or Chrome-to-Google time. Prefetch off. WebRTC does not leak local IPs. Safe Browsing stays on — turning it off is a security cut, so it is not a default.
Anonymity (hide the IP) is Anonymity — Whonix KVM, not host Tor. This page is phone-home and disk leftovers.
Stock still does this. We default it off.
| What leaks or talks | Stock secureblue | Unwoke default | If you need it |
|---|---|---|---|
| rpm-ostree countme | Timer on | Masked every boot | ujust set-countme on |
| Connectivity HTTP check | On (Fedora/GNOME URI) | Off | ujust set-connectivity-check on |
| DHCP hostname / DUID / LLMNR | Sent; MAC random only | Not sent; stable-privacy; no LLMNR/mDNS register | ujust set-dhcp-hostname on |
| File thumbnails | On (FAQ says turn them off) | Off (GNOME Files + Dolphin) | ujust set-thumbnails on |
| Disk leftovers (forensics) | Persistent journal, hibernate-to-disk, coredumps, Tracker/LocalSearch, GTK recent files | Volatile journal, hibernate denied, cores none, indexer masked, recent-files off | ujust set-disk-traces on |
| Avahi / ModemManager | Typically left on | Masked | ujust set-extra-daemons on |
| Bluetooth | Modules available | Service masked + rfkill | ujust set-bluetooth on |
| Camera / mic hardware | Present | Modules + udev locked; speakers stay | ujust set-camera-mic on |
| App store / Flathub / brew | Bazaar + verified Flathub; brew on PATH | No store; remotes off | ujust set-flathub verified / set-brew on |
| Chromium metrics, sync, ping, Privacy Sandbox, Cast, Google time | Stock Trivalent compile defaults | Hardening pack forces them off | ujust set-brave-hardening off (warned loosen) |
| GNOME “remember app usage” | On | Off | GNOME Settings (user override) |
| Chrony / NTP | ISO used fedora pool in the clear | NTS (Cloudflare + nts.ntp.se) on ISO and installed OS | ujust set-nts off |
| systemd-resolved extra privacy drop-in | Stock defaults | Shipped under /usr/share/unwoke/resolved-privacy.conf, applied on boot unless you loosened DHCP/privacy stamps |
ujust set-dhcp-hostname on (same family) |
| Safe Browsing (malware/phishing lists) | On | On — we will not default this off | Do not ask us to kill it “for privacy” |
| fwupd / LVFS firmware | On | On — firmware vulns are security | — |
The honest fingerprint paragraph
Quieter Fedora and LAN is not a website fingerprint. Extra browser security packs (JIT-less, WebGL off, no extensions, site camera blocked) are. We still ship those packs: security first. Stock Trivalent is already a small crowd; our packs make it smaller. Best crowd on Unwoke is still *-trivalent (same binary and jail as stock). Origin is a smaller crowd and a fatter SELinux domain.
If you choose to look closer to stock Trivalent: one pack, then restart the browser. Setup warns. Full text: Fingerprinting vs locks.
ujust set-brave-jitless off # security down for that pack
ujust set-brave-isolation off
ujust set-brave-devices offThere is no overlay that is both “stricter than stock Trivalent” and “as anonymous as Chrome.” We will not install an anti-detect browser, turn off Safe Browsing, or add extra Cloudflare DoH on top of ujust dns-selector to pretend otherwise.
It stays off
Every boot, privacy.sh apply-boot remasks countme and rewrites NetworkManager / resolved drop-ins unless you stamped /etc/unwoke/allow-*. Inspect fails the image bake if those files vanish. Same pattern as Bluetooth and Avahi.
Get Unwoke SecureBlue Compared · Features · Fingerprint tutorial