Besides the already mentioned Star Labs and System76, there's also Insurgo, Nitropad and NovaCustom.

As for an exhaustive list on the matter, unfortunately, I don't think something like that is out there. Though both Canoeboot (formerly known as Libreboot) and Dasharo do have their own respective lists.

The simple virtue of being able to genuinely express these words; "I don't know", "Sorry" and "Thank you" (or any derivative of these*).

Am I wrong to assume that this doesn't add anything beyond what uBlock on medium mode does already? Except (perhaps) ease-of-use and the blocking of first-party trackers; if those even exist*.

Don't get me wrong; I love EFF's work and their commitment to digital privacy. I just want to understand if I, personally, would need it.

Again an association is made between butt plugs and Arch users. I wonder if moving forward showing a collection of butt plugs will become the next "I use Arch, btw".

“compile pretty much every command your distro has in exchange for a measly half a second faster boot times!”

I don't deny the existence of people with such motivations, but I'd argue the sheer amount of freedom that Gentoo allows is its defining feature. And for that, even though I don't use it on my main device, I'd argue it's actually one of the primary contenders for best distro.

In terms of privacy, I believe Windows collects a ton of data even if all telemetry is disabled; granted this is an older article, so it might have changed since*.

Your best option is probably running Windows inside a qube in Qubes OS and ensuring that the qube doesn't have direct access to internet. But, at that point, why not consider switching to Linux instead? Because, you'd have to run at least another qube (with either Linux or *BSD on it) to grab the files off the internet from in the first place.

EDIT: lol, I just noticed it said "window" in the post and not "Windows". I thought the mentions of "blackout curtains" and "storm shutters" was OP either making a joke or some reference I didn't get. LMFAO, I didn't even notice the "Thank me in advance". Guess I should probably go to sleep after this. Good shit-post OP!

Pop!_OS is definitely worth considering as it's one of the few distros that goes as far as providing a recovery partition and offers one of the best experiences for those with Nvidia GPUs. Furthermore, Pop!_OS' maintainers (read: System76) are actually financially incentivized to make their distro very polished and newbie-friendly as their distro is used on the hardware they sell.

On the flip side, Pop!_OS is currently in a major overhaul to replace GNOME with COSMIC; their own homebuilt Desktop Environment. As the Desktop Environment is arguably the most important contributor to how one experiences their Linux system, the eventual change might disrupt your workflow and you might even be too accustomed to GNOME to consider COSMIC at that point. The ongoing work on COSMIC has even meant that Pop!_OS has missed three major releases and are still clinging on their release from April 2022; thankfully it's based on Ubuntu's LTS (read: Long Term Support) release, so they aren't particularly in rush to get a new release out and can rely on Ubuntu for security updates.

Regardless, COSMIC's unsure future does leave a lot to be desired and does pose the question if perhaps other options should be considered more seriously instead.

Therefore, my personal recommendation would be either one of the following:

• If you just really like what you see from Pop!_OS, then just install its 22.04 release and you should be good until April 2027. As time goes on, you might be deprived from new developments and features; but at least updates etc will not be able to (potentially) corrupt/break your system in the meantime.
• Wait until April next year; when they're supposed to release a new version. If you like what you see and the update and the changes are well-received by the community, then consider installing that one instead. It should be supported for 5 years, which is plenty to not worry about your system in the mean time.
• Go look elsewhere. There are hundreds of actively maintained distros out there. While not all of them are worth considering, there are at least a dozen of them that are worthy contenders. In case you're interested to get the community's help in finding a distro, consider answering the following questions:
  • Do you use an Nvidia GPU?
  • How would you rate your tech savviness on other operating systems?
  • How eager are you to learn and/or invest time to use your Linux system?
  • Do you prefer to have up-to-date software at all times even if that means daily/weekly updates that might potentially break some functionality?
  • Security or convenience?
  • Opinionated or blank slate?

A shortlist of distros worth considering for a beginner (from easiest to hardest): Linux Mint, Ubuntu, Debian/Fedora/openSUSE and Arch.

Star Labs' take on the matter.

Furthermore, if one is sensitive regarding their cybersecurity, then one is likely to adhere to the zero trust security model and thus choose to simply not trust; which would include the closed source BIOS. coreboot, on the other hand, at least allows one to audit it themselves. As Linus Torvalds has been approached for implementing backdoors, it should surprise nobody that (some) of the vendors we buy our devices from have been as well and thus our BIOSes might not have been as safe as one would like to believe. Qubes OS, the most secure OS on desktop, shares the view that coreboot is preferred over closed source BIOSes due to reasons related to trust.

a few commenters pointed out that the highest rated VPN providers in this table just happen to be the ones that advertise most aggressively and are well-known for buying positive reviews from tech blogs, which are pretty clearly designed to be misleading

Exactly. This is unfortunately common practice, so this breakdown can be dismissed as they're obviously biased due to monetary motivations.

Consider to read Privacy Guides' take on the matter instead.

(Perhaps personal) TL;DR would be that Mullvad VPN in combination with Mullvad Browser offers the most private internet browsing experience for people who don't desire to connect to the Tor Network. Furthermore, Proton offers a suite of privacy-friendly services for mail, drive, password manager etc. Therefore, for the sake of trusting the least amount of parties for these services (at the cost of putting all eggs in one basket), one might consider Proton VPN instead; additionally it includes a free tier and some support to port forwarding (read: allows the use of torrent applications).

In general, consider setting up any kind of rollback functionality; this will enable you to get right back to action without any downtime when you're time-restricted. This can be achieved by configuring your system with (GRUB-)Btrfs+TImeshift/Snapper. Please bear in mind that it's likely that you have to come back to solve it eventually, though*. (Perhaps it's worth thinking about what can be done to ensure that you don't end up with a broken system in the first place. *cough* 'immutable' distro *cough*)

If this seems too troublesome to setup, then consider using distros that have this properly setup from the get-go by default; like (in alphabetical order) Garuda Linux, Manjaro, Nobara, openSUSE Aeon/Kalpa/Leap/Slowroll/Tumbleweed, siduction and SpiralLinux. Furthermore, so-called 'immutable' distros also have rollback functionality while not relying on aforementioned (GRUB-)Btrfs+TImeshift/Snapper; this applies to e.g. blendOS, Fedora Kinoite/Sericea/Silverblue, Guix, NixOS and Vanilla OS.

If you feel absolutely overwhelmed by the amount of choice, then you should probably consider the bold ones; not because I think they're necessarily better but:

• openSUSE's offerings are generally speaking very polished, therefore being highly suitable to replace Linux Mint or Ubuntu. It's its own thing though, therefore you might not be able to access packages that are exclusively found in Debian's/Ubuntu's repos (though Distrobox solves that trivially). Tumbleweed if you like rolling release, Slowroll if you prefer updates only once every 1-2 months and finally Leap if you lean more towards Stable/LTS releases.
• siduction for being based on Debian; but it's strictly on the Unstable(/Sid) branch.
• SpiralLinux for being based on Debian; this one -however- has proper support for switching branches.
• Vanilla OS for being based on Debian; this one is very ambitious. But, because it's an 'immutable' distro, it might require the biggest changes to your workflow.

nvidia drivers are absent

While any of the aforementioned distros do a decent job at 'supporting' Nvidia, perhaps you might be best off with uBlue's Nvidia images. As these are images relying on the same technology that Fedora's immutable distros do, rollback functionality and all the other good stuff we've come to love -like automatic upgrades in the background- are present as well. In case you're interested to know how these actually provide improved Nvidia support:

"We've slipstreamed the Nvidia drivers right onto the operating system image. Steps that once took place on your local laptop are now done in a continuous integration system in GitHub. Once they are complete, the system stamps out an image which then makes its way to your PC.

No more building drivers on your laptop, dealing with signing, akmods, third party repo conflicts, or any of that. We've fully automated it so that if there's an issue, we fix it in GitHub, for everyone.

But it's not just installation and configuration: We provide Nvidia driver versions 525, 520, and 470 for each of these. You can atomically switch between any of these, so if your driver worked perfectly on a certain day and you find a regression you just rebase to that image.

Or switch to another desktop entirely.

No other desktop Linux does this, and we're just getting started."

Source

Distrobox is directly inspired from Toolbx and was created because of limitations of Toolbx and how Toolbx' maintainers didn't want to implement some features at that moment in time.

Currently, Distrobox is almost a superset of Toolbx. Though, I've come to the understanding that Toolbx does better at some tasks.

If you would like to stick to just one of them, then Distrobox is probably still the better one and should be preferred. However, if its added functionality doesn't do it for you, then please feel free to continue using Toolbx.

Why is toolbox preinstalled and not distrobox?

Because Toolbx predates Distrobox and is developed by developers that are associated with Fedora and even specifically designed in hopes of solving some issues pertaining to Fedora's Atomic distros.

is there any reason why I should even care about the freedom of init system?

Freedom of choice! It's troublesome if distros and/or DEs rely so heavily on systemd to do their bidding. So much so, that some combinations of distro + DE don't allow any differentiation in init or make it very cumbersome and unwieldy at best. I'm not interested in making systemd a necessary part of Linux. Therefore other inits not only have to exist, but should be 'competitive' as well. Which, to be frank, is currently not the case.

Another concern is that systemd is by no means a minimalist approach. Which beyond bloat, also has security implications. More information can be found in this (infamous) guide by Madaidan; security researcher on multiple distros known for taking security and privacy very seriously like e.g. Kicksecure and Whonix. Interestingly, while Madaidan discourages the use of systemd in that guide, it's still heavily relied on in Kicksecure; one of the distros he works on. I think this is a perfect illustration of how systemd has become so good that even opponents can't deny its merits and continue to make use of it for the time being out of necessity.

Most distros are somewhat equal when it comes to privacy, anonymity and security; with the likes of Fedora and openSUSE known for taking it more seriously out of the box than the other 'big bois', while some smaller distros like Kicksecure are known for their best-in-class^[1]^ hardening that they offer by default.

As for NixOS, it's really its own thing (together with Guix), and thus very different from any other distros. If you conquer it, you would be delightfully met by a system that enables you to do things unheard of in other distros. However, the learning curve is very steep. And perhaps even hardening it to the level that Fedora or openSUSE provide by default might not be trivial.

1. Qubes OS is technically not a Linux distro. But it's worth mentioning as one generally tends to run Linux within a qube (read: VM), and in regards to security and privacy; Qubes OS is simply unmatched, period.

Wouldn't it be fun to have "a ready-to-game Arch Linux based OCI designed for use exclusively in distrobox"?

Lots of great answers here already so I will only address a couple of things that haven't been mentioned:

Regarding Fedora Silverblue:

• Currently, Fedora Atomic Desktops are in a major shift to accept OCI container images for delivery of packages. This means that the built image becomes one compliant to OCI and that we boot into an OCI container as our system. As OCI images are relatively declarative (not to the extent that NixOS does (yet)), it becomes possible to have a set of config files (most importantly, the so-called Containerfile) in which your system is 'declared'/'configd'. In case you're interested into how this looks/works, consider taking a look at uBlue's startingpoint or if you're more interested in the scope of configuration into Bazzite and/or Bluefin.
• apx is available as a COPR on Fedora Atomic Desktops.
• Nix can be installed on Fedora Atomic Desktops using Determinate Systems' installer.

Regarding Vanilla OS:

• They're also moving to a model that's very close to where Fedora Atomic Desktops is heading towards. So, expect a similar way to config/'declare' your system.

What are your thoughts on the three four distros mentioned above?

It's a question of polish if you'd ask me. With Fedora Atomic Desktops and NixOS being advantageous due to being more established and better funded. I wouldn't write off Vanilla OS yet as they seem to know what they're doing. Though, I wouldn't keep my hopes up for blendOS as its main developer was unaware of which MAC was configured by default on blendOS (spoiler alert: none, at least at the time).

Furthermore, NixOS is literally its own thing and unfortunately infamous for its steep learning curve. If you can afford to learn and conquer NixOS, then NixOS should be the recommendation; unless (like me) you seek SELinux on your systems.

Between Fedora Atomic Desktops and Vanilla OS; Vanilla OS is still in its major rewrite/revamp. The alpha builds are there, but I wouldn't recommend using those on production machines. Fedora Atomic Desktops, on the other hand, has been going strong for a while now and the uBlue-team has even succeeded in making the OCI-stuff accessible for the general (Linux) public. So if you want to switch now and NixOS is/seems too hard; then Fedora Atomic Desktops it is. On that note, I recommend to check out the uBlue project.

Which ones are the most interesting, and for what reasons?

Honestly, all of them are really interesting, but NixOS does the most unique stuff; with only Guix doing something similar within the Linux landscape. To give you a taste of some of the wild stuff found on NixOS; there's the so-called Impermanence module which -to my knowledge- happens to be the closest thing to a usable stateless system we've got; period. Consider reading this excellent blog post in case you're interested to know what this entails.

I don't know if it even works, but have you considered relying on their Stealth protocol? While its absence on Linux (and Windows) means that you might not even be able to make use of it in the first place, I'm still interested to know if it makes any difference.

Basically, you want to not disable kernel.unprivileged_userns_clone.

For a temporary solution that has to be redone after reboot, there is sysctl kernel.unprivileged_userns_clone=1.

For a lasting solution, consider echo kernel.unprivileged_userns_clone=1 | sudo tee /etc/sysctl.d/99-enable-unpriv-userns.conf.

In either case you're foregoing security for the sake of convenience/functionality, so I understand why you would rather not act upon either of them.

I don't know what the solution is that would be analogous to installing bubblewrap-suid. Perhaps, it's worth exploring the projects found within the github page of Awesome Fedora Security for some pointers.

I don't understand how people break it.

It's probably related to installing packages through the AUR, even though it's known to be unsupported on Manjaro specifically due to their policy of holding back packages.

to use as a media centre and multiplayer gaming system in my living room

Based on this, you're basically looking for the 'game console experience on your couch'. If that's the case, honestly you shouldn't look beyond^[1]^ Bazzite.

If, instead, you actually wanted to play retro games primarily, then please let us know.

1. While ChimeraOS and HoloISO also offer the 'game console experience', they don't support Nvidia GPUs. So you would be on your own at best; which would be a horrible experience for a new user. If you feel particularly adventurous, then Jovian-NixOS is actually another option. But arguably less newbie-friendly compared to Bazzite.

I cannot wait to get home and try it out!

Please consider reporting back after you've tried it; I'd love to read your experiences.