Ranking install methods from best-to-worst in Linux/Debian (based on my threat model)

2 minutes read •


State-sponsored hackers aren't at my doorstep, I don't sail the high seas, and I don't have any open ports on my network. My threat model is defending against big-tech profiling me. Here are my install methods from best➡worst:

  1. Install system-wide w/o issue: Well-vetted FOSS from Debian repos (DigiKam, Calibre) - trust is implicit in using Debian
  2. Install locally w/o issue: Modern software that isn't available in the official Debian repositories but is on Github from a reputable source. Here are my ranking:
    1. Install via go install so that it's easy to upgrade such as go install github.com/hacel/jfsh@latest
    2. Install a linux binary (ie running curl -LO /path/to/link/url/from/github/releases/page)
    3. Install via uv tool install because python is popular, uv is the bee's knees, and easier to use than the pipx default on Debian
    4. Install via flatpak: Can be inefficient re: storage usage and I don't like how many maintainers run outdated runtimes or the privacy defaults they typically set. I do like that I can use kde-config-flatpak (KDE version of flatseal) to manage permissions
    5. Install via cargo is a last resort because most only my desktop is powered enough to compile rust packages easily
    6. Install via bun because it's better than npm/npx but still more vulnerable than the other alternatives IIRC. Not a lot of JS software that I use anywho
    7. Install via appImages/snap: I no longer use any of these apps. A tad too inefficient and/or closed source for me, so I can find alternatives above.
  3. Install w/ firejail restrictions: For-profit closed-source apps (ie: trading-related apps in my case) where the company has an incentive to collect your personal data, or FOSS software that is unvetted/brand new.
  4. Install w/ podman (or docker): Anything firejail is being finicky with.
  5. Install w/ nspawn container: Anything that podman is being finicky with. Lots of heavy lifting here that I already completed so heavy friction for someone new to nspawn containers initially.