Hello Puppy Linux Forums,
My question.
Why do Linux users on other forums tell me that using Puppy Linux running as root is a security risk and is unsafe.
I'm no Linux guru and I don't know very much about Linux.
I've used Linux since around 2014 and I've learned some of the basics of Linux.
I discovered Puppy Linux sometime around 2015 and my first Puppy was TahrPup.
I'm running Easy OS currently as a daily driver frugal install to a USB flash drive.
Thanks. 
@tammi806 First I can tell you that I have basically been running as root since the 1970's. Up to this minute I have never, as in not once, have I ever run into a "security" problem whilst operating a computer as the root user.
The fact that 95% of Puppy Linux's main components are in read only squash (SFS) files makes this operating system very difficult to infiltrate when using good habits. And even if there was any attempt to "root kit" or send malware payloads one deletion of the save file/save folder will solve that problem 100%.
Perhaps in the work place on systems that have multiple people using it is important to have separate user accounts and if you are working in a place that has lots of sensitive and private data that might be a target of sophisticated hacking attacks, security and keeping things separate is of far more importance.
I can tell you from personal experience of working with computers since 1974-75 that unless you store something that someone would want to steal for their gain, no one would put the effort in to break into your Puppy Linux system on some home computer.
It's like this in the end.....if you live a loose life and enjoy the company of many partners and your not that choosy and careful, the chances will increase that you'll be seeing a doctor soon.
EasyOS is designed from the ground up to be secure using the latest technology of containers, the same as any of the "big guys" and all of their bloat.
@tammi806
+1 and ditto what @rockedge said. Most giving that advice are just repeating what they have read somewhere else, which would apply to multi-user, networked and server systems.
Puppy as a single user, mostly standalone system running from read only core files can be more secure than the big distros running non--root. EasyOS is even better.
wizard
Big pile of OLD computers
@tammi1806 :-
Further to rockedges's reply, let me just add that you have to understand Puppy is essentially a distro for enthusiasts, who enjoy customizing their system in ways that users of the "big boys" can only dream about.
As such, most Puppians, even if not so in the early days, very soon learn to be much more aware of what their system is doing at any given moment. I - like Erik - have also never had a single malware-related issue in all the years I've run Puppy.
And anyway; in the early days of Linux, everybody "ran as root". The multi-user model didn't appear for some years, and it was probably RedHat, shortly followed by the first appearance of Ubuntu in 2004, when this began to become 'standard' fare for everyone.....
Mike. 
Edit: The following was being written while others posted.
Almost without exception, other than Puppys, Linux distros are designed to function as a Unitary System. That is, when you install or change something it is written immediately to your Storage media. And it is not just 'you'. Any hacker will have the same access as you, and any malware you inadvertently pickup is immediately preserved. When you run as 'root' = administrator, you have immediate access to all components, every file. So it's not only what gets installed. Root has complete authority to delete anything, to wipe your entire drive. They overcome these potential threats in a couple of ways. The main one is by requiring a 'User' to run as 'User' without Root-privileges. A mere 'User' can not install anything; and any changes (s)he makes can only be written to that User's own folder. [Unless, of course, the User provides the 'Root password': as if someone with sufficient skills to be a hacker couldn't find that password or a curious kid with access to the computer and knowledge of the password couldn't 'see what happens if...'.
The other ways they respond to that threat are 'firejails' -- which run web-browsers in a 'sandbox'; and containers [under various names] which also isolate applications from the 'system-as-a-whole'.
Puppys on the other hand are NOT a unitary system. They are designed to threat RAM and Storage as two separate systems. With the exception of any SaveFile or Folder a User creates the main components of a Puppy are READ-ONLY file-systems on Storage which are only copied into RAM. On reboot/shut-down, RAM is cleared. Except if you're operating under PupMode 12, any changes you or anyone else made evaporate unless you've chosen to execute a Save. See, https://www.forum.puppylinux.com/viewto ... 183#p97183. [PupMode 12 is only available when booting from a hard-drive. A majority of Users have reported that they've taken the necessary steps to change to PupMode 13 or operate under PupMode 5. Earlier posts on that threat explain how.] And even under PupMode 12, the only thing that can get screwed up is the SaveFile/Folder. Deleting it and/or reverting to an previous SaveFile/Folder returns you to an error free system].
'The Web is the Mother of all malware'. Puppys' web-browsers can be 'Run as Spot' -- a limited Users whose 'Spot Folder' is as efficient as firejails at isolating it from the rest of the System. By default Google-Chrome, Chromium and Chromium-Clones sandbox their activity. EasyOS --a puppy-like operating system you'll find on this Forum-- can run any application and even an entirely different operating system in a Container. Although its difficult to setup, every Puppy can run an entirely different operating system in a Chroot. Applications, operating systems in a Container or Chroot have no access to your MainOS. But your MainOS (which runs as Root) can access their content to transfer it.
Even though they are 'run-as-Root' Puppys under PupMode 5 or 13 are as, or more, secure than any other Linux. However, nothing prevents you or the curious Kid from deleting anything. But that's also true of any operating system. Just boot from any operating system on a USB-Key, start deleting things from your hard-drive and see what happens. 
I've used Puppy Linux since around 2015 as a home user only and never had any security problems either.
Love the analogy. 
Nope none of that kind of lifestyle will happen these days I'm 72 years old.
I try to use safe web searching habits and understand that the user is almost always going to be the weakest link if not always.
No I was mainly curious as to why everyone seems to criticize running as root.
Thanks @rockedge
mikeslr wrote: ↑Fri Sep 01, 2023 3:29 pmEdit: The following was being written while others posted.
Almost without exception, other than Puppys, Linux distros are designed to function as a Unitary System. That is, when you install or change something it is written immediately to your Storage media. And it is not just 'you'. Any hacker will have the same access as you, and any malware you inadvertently pickup is immediately preserved. When you run as 'root' = administrator, you have immediate access to all components, every file. So it's not only what gets installed. Root has complete authority to delete anything, to wipe your entire drive. They overcome these potential threats in a couple of ways. The main one is by requiring a 'User' to run as 'User' without Root-privileges. A mere 'User' can not install anything; and any changes (s)he makes can only be written to that User's own folder. [Unless, of course, the User provides the 'Root password': as if someone with sufficient skills to be a hacker couldn't find that password or a curious kid with access to the computer and knowledge of the password couldn't 'see what happens if...'.
The other ways they respond to that threat are 'firejails' -- which run web-browsers in a 'sandbox'; and containers [under various names] which also isolate applications from the 'system-as-a-whole'.
Puppys on the other hand are NOT a unitary system. They are designed to threat RAM and Storage as two separate systems. With the exception of any SaveFile or Folder a User creates the main components of a Puppy are READ-ONLY file-systems on Storage which are only copied into RAM. On reboot/shut-down, RAM is cleared. Except if you're operating under PupMode 12, any changes you or anyone else made evaporate unless you've chosen to execute a Save. See, https://www.forum.puppylinux.com/viewto ... 183#p97183. [PupMode 12 is only available when booting from a hard-drive. A majority of Users have reported that they've taken the necessary steps to change to PupMode 13 or operate under PupMode 5. Earlier posts on that threat explain how.] And even under PupMode 12, the only thing that can get screwed up is the SaveFile/Folder. Deleting it and/or reverting to an previous SaveFile/Folder returns you to an error free system].
'The Web is the Mother of all malware'. Puppys' web-browsers can be 'Run as Spot' -- a limited Users whose 'Spot Folder' is as efficient as firejails at isolating it from the rest of the System. By default Google-Chrome, Chromium and Chromium-Clones sandbox their activity. EasyOS --a puppy-like operating system you'll find on this Forum-- can run any application and even an entirely different operating system in a Container. Although its difficult to setup, every Puppy can run an entirely different operating system in a Chroot. Applications, operating systems in a Container or Chroot have no access to your MainOS. But your MainOS (which runs as Root) can access their content to transfer it.
Even though they are 'run-as-Root' Puppys under PupMode 5 or 13 are as, or more, secure than any other Linux. However, nothing prevents you or the curious Kid from deleting anything. But that's also true of any operating system. Just boot from any operating system on a USB-Key, start deleting things from your hard-drive and see what happens.
@mikeslr Excellent explanation
Over the years of using Puppy Linux I've done a lot of reading of the Puppy Linux forum and apparently have learned more than I gave myself credit for because I really understand what you posted.
@tammi806 :-
In conjunction with what's been said - and if you haven't already done so - have a read of this blog post from IgnorantGuru:-
https://igurublog.wordpress.com/2010/01 ... -not-root/
Of course, most Linux users of mainstream distros have had it drummed into them for years, "Root is BAD. Never do anything as 'root'. Always be JUST a 'user'...." It's quite an eye-opener, and makes a mockery of the revered "sudo" system.......even going so far as to explain how Ubuntu's implementation actually makes it less secure, not more so..!
Also, bear this in mind; ever since Mark Shuttleworth declared, nearly a decade ago, that he was henceforth pitching Ubuntu as a direct competitor to Windows, the whole thing has been "dumbed-down" for the type of folks that typically use Microsoft's OS........people who just want to power-on, and simply "use"it, and who don't have a clue what the system is actually doing in the background (nor the slightest interest in finding out). And most of the re-spins based on Ubuntu have followed suit.....and there's a lot of them. It's ALL about attracting new users.
The net result being that, today, there is a lower percentage of Linux users - in real terms - that actually understand what's going on at anything other than a purely "user-interface" level, than at any time in the past. And that's kinda sad.
Very few Linux users would care to dig around in the file system the way we do, nor would they have the confidence to do so. In all honesty, I don't think you'll ever look at mainstream distros in quite the same way again.....these days, they're nowhere near as special as they once used to be.
Mike.
If you run your browser as root, your Puppy is very outdated (misses years of fixes for known security vulnerabilities), anyone who can fool your browser to run malicious code can do whatever they want and even replace the read-only parts of Puppy with ones infected with malware.
As long as you apply security updates, don't run sensitive applications (especially those what access the network) as root, use things like Flatpak to run applications you don't trust, have a firewall enabled (in recent Puppy releases it supports IPv6, previously it left your computer fully exposed), don't run untrusted code and have sandboxing where needed (for example: spot in Vanilla Dpup can't write to /root even if you give it full permissions or run a SUID root executable), logging in as root should not be a big security risk.
dimkr wrote: ↑Fri Sep 01, 2023 8:38 pmAs long as you apply security updates, don't run sensitive applications (especially those what access the network) as root, use things like Flatpak to run applications you don't trust, have a firewall enabled (in recent Puppy releases it supports IPv6, previously it left your computer fully exposed), don't run untrusted code and have sandboxing where needed (for example: spot in Vanilla Dpup can't write to /root even if you give it full permissions or run a SUID root executable), logging in as root should not be a big security risk.
Mm. Interesting. Which "older" firewall are we talking about....which left you completely exposed? The one in use at the time of the 5-series.....or the "AlienBob" one, which came in around the time of Tahrpup?
What firewall would you recommend for current best security?
Mike. 
The foregoing assumes the existence of a hacker so dedicated to infesting your system that he (or she) will build either a READ-ONLY component containing thousands of files then serially, divide it into many small components and surreptitiously download its components and assemble it on your computer without your noticing; your system being unique among the thousands of possible Linuxes making up less than 5% of the personal computing market.
dimkr wrote: ↑Fri Sep 01, 2023 8:38 pmAs long as you apply security updates, don't run sensitive applications (especially those what access the network) as root, use things like Flatpak to run applications you don't trust, have a firewall enabled (in recent Puppy releases it supports IPv6, previously it left your computer fully exposed), don't run untrusted code and have sandboxing where needed (for example: spot in Vanilla Dpup can't write to /root even if you give it full permissions or run a SUID root executable), logging in as root should not be a big security risk.
See my critique of Flatpak. https://www.forum.puppylinux.com/viewto ... 295#p87295. It has only two "saving graces": The first is that most Puppys won't be able to install its framework. The 2nd is that it runs the application in a container. What really would be of value is if someone were to modify the 'spot' mechanism for 'Puppys in general' as dimkr has done for VanillaDpup. 
dimkr.
Until then, I suggest that web-accessing applications be run-as-spot. MikeWalsh's portable Google-Chrome and Chromium Clones run-as-spot by default. Bookmark their download folders for easy transference of the things you've downloaded. Install extensions to clear them of cache, downloads, pretty-much everything without having to restart. And configure them to clear almost everything when you close them. Oh yah. Know what you're downloading, and only download from trusted web-sites.
If you can afford it, employ a trusted VPN. If you can't afford a paid VPN, sign up for Protonmail and use their free (albeit few and slow) ProtonVPN service. There are others. But you'll have to search. Many --including Opera's-- do not provide 'end-to-end' encryption.
That said, what precautions you take really depends on how paranoid you are. I've been running Puppys for about 12 years. I don't always know where a search has taken me before I open the link. But in those cases while my web-browser may be run as 'root', my Puppy is run under PupMode 5. There are some really good and recommended Addons/Extensions for security and privacy. And despite those if I still find it's opened a tab to some questionable site, the tab is closed and everything is cleared. Never had a problem.
I actually found that article awhile back and thought it was interesting and sure puts things in to perspective.
mikewalsh wrote: ↑Fri Sep 01, 2023 5:31 pmOf course, most Linux users of mainstream distros have had it drummed into them for years, "Root is BAD. Never do anything as 'root'. Always be JUST a 'user'...." It's quite an eye-opener, and makes a mockery of the revered "sudo" system.......even going so far as to explain how Ubuntu's implementation actually makes it less secure, not more so..!
Also, bear this in mind; ever since Mark Shuttleworth declared, nearly a decade ago, that he was henceforth pitching Ubuntu as a direct competitor to Windows, the whole thing has been "dumbed-down" for the type of folks that typically use Microsoft's OS........people who just want to power-on, and simply "use"it, and who don't have a clue what the system is actually doing in the background (nor the slightest interest in finding out). And most of the re-spins based on Ubuntu have followed suit.....and there's a lot of them. It's ALL about attracting new users.
The net result being that, today, there is a lower percentage of Linux users - in real terms - that actually understand what's going on at anything other than a purely "user-interface" level, than at any time in the past. And that's kinda sad.
Very few Linux users would care to dig around in the file system the way we do, nor would they have the confidence to do so. In all honesty, I don't think you'll ever look at mainstream distros in quite the same way again.....these days, they're nowhere near as special as they once used to be.
Mike.
I have a very basic understanding of Linux and somewhat understand why it's more secure than Windows OS.
Unfortunately I'm one of those users who want to install and update and use and do the necessary OS maintenance.
I haven't used a mainstream Linux distro in years but have read some not good articles about some of them.
Thanks for the reply.
It's late and there is a lot to absorb and read over and the late hour and strain on the brain is beating me down.
I really appreciate the replies and sharing the knowledge you guys have.
I'm going to have to investigate some of the things posted.
Thanks to everyone for your help and advice.
It's 1:00 AM where I'm at so Good night to all.
The thing called firewall_ng, which comes preinstalled in Puppy. Until https://github.com/puppylinux-woof-CE/w ... 28871c8002, it ignored the concept of IPv6, so if you have IPv6 in the LAN (and you probably do, for many years), it blocked incoming connections over IPv4 but left you 100% exposed over IPv6. Most servers that run on your computer listen dual-stack, on both IPv4 and IPv6, so blocking access to these ports only over IPv4 while leaving everything wide open over IPv6 doesn't do much in terms of security. A firewall is supposed to protect you against incoming connections in the LAN, after all.
Today's firewall_ng, I use it without any exceptions: all incoming connections are blocked (both IPv4 and IPv6), and this works for me because I don't use my laptop as a server.
mikeslr wrote: ↑Sat Sep 02, 2023 12:08 amThe foregoing assumes the existence of a hacker so dedicated to infesting your system that he (or she) will build either a READ-ONLY component containing thousands of files then serially, divide it into many small components and surreptitiously download its components and assemble it on your computer without your noticing
I disagree, malware for Linux exists. If somebody develops a piece of malware that uses a browser-based code execution attack to spread, and implements a persistency method for the most popular distros (say, a sysvinit init script for distros a or b, a systemd service unit for c or d ... plus something that finds adrv_*.sfs in /initrd/mnt/dev_save, adds the malware and re-packs it with -comp lzo, so fast you won't notice), I don't see how the read-only nature of SFSs makes Puppy more secure. If you assume malware infections happen when somebody else is running a shell on your computer without you knowing it, this assumption is wrong: it's probably automated, silent and fast: if you're not seeing it, this doesn't mean it doesn't happen; maybe you're just not looking. Without digital signatures and proper verification, you don't know if an application you're running (or remotely executed malicious code that ran inside an application) has modified any of your SFSs, don't you? The SFS itself is read-only, but it's easy to unpack a SFS, re-pack it with changes and write it back to a partition that is either already mounted read+write, or can be mounted read+write (using the root permissions gained by the attacker).
mikeslr wrote: ↑Sat Sep 02, 2023 12:08 amThe first is that most Puppys won't be able to install its framework. The 2nd is that it runs the application in a container. What really would be of value is if someone were to modify the 'spot' mechanism for 'Puppys in general' as dimkr has done for VanillaDpup.
Vanilla Dpup doens't have anything special, to be honest. spot works the same way as in any other Puppy, but with extra restrictions to protect against faulty .pet packages that change the permissions of /root, accidental chmod 777 and things like this. Plus, everything is part of upstream woof-CE and not secret sauce specific to Vanilla Dpup, so you can verify my statements. For Flatpak to function, you don't need this extra layer of sandboxing. "Containers" (a very broad term, podman containers and Flatpak applications are not the same) work just fine without it, and Flatpak uses user namespaces to prevent privilege escalation to root, making applications running inside Flatpak's sandbox inherently more secure.
mikeslr wrote: ↑Sat Sep 02, 2023 12:08 amIf you can afford it, employ a trusted VPN. If you can't afford a paid VPN, sign up for Protonmail and use their free (albeit few and slow) ProtonVPN service. There are others. But you'll have to search. Many --including Opera's-- do not provide 'end-to-end' encryption.
If a site triggers a remote code execution flaw in your browser, it doesn't matter how you reached that site, if the traffic was encrypted or not. A VPN can help disguise your identity or location (assuming all other methods of user fingerprinting are inapplicable, which is probably not the case), but doesn't make you more 'secure' unless this VPN also blocks sites that are known to be malicious or inspects the traffic in some way.
The computer is generally a nasty thing. Even turning it on is already a risk, suddenly a short circuit and a fire. And if it breaks? It will spoil the mood.
Horror. That's it, I've decided. I'm urgently stopping playing iQPuzzle. I'll make pentamino figures out of thick cardboard and solve puzzles on the table I have already done this without a computer, these puzzles were published in the Soviet magazine "Science and Life". Someone did it right in his mind, but I'm afraid I'm not capable of such feats now
Fossapup OS, Ryzen 5 3600 CPU, 64 GB RAM, GeForce GTX 1050 Ti 4 GB, Sound Blaster Audigy Rx with amplifier + Yamaha speakers for loud sound, USB Sound Blaster X-Fi Surround 5.1 Pro V3 + headphones for quiet sound.
@dimkr :-
dimkr wrote: ↑Sat Sep 02, 2023 7:42 amThe thing called firewall_ng, which comes preinstalled in Puppy. Until https://github.com/puppylinux-woof-CE/w ... 28871c8002, it ignored the concept of IPv6, so if you have IPv6 in the LAN (and you probably do, for many years), it blocked incoming connections over IPv4 but left you 100% exposed over IPv6. Most servers that run on your computer listen dual-stack, on both IPv4 and IPv6, so blocking access to these ports only over IPv4 while leaving everything wide open over IPv6 doesn't do much in terms of security. A firewall is supposed to protect you against incoming connections in the LAN, after all.
Today's firewall_ng, I use it without any exceptions: all incoming connections are blocked (both IPv4 and IPv6), and this works for me because I don't use my laptop as a server.
Ah. Okay. So; let me ask a couple of questions (if I may)..?
Is the uprated firewall_ng 'transplantable' with the old one? I guess what I'm asking is, can it be retrofitted to any Puppy prior to the date of the commit? AFAIK, this thing is essentially just a script - manipulates the kernel's NetFilter thing, and iptables, yes? It's not arch-specific, or reliant on specific dependencies? Would it function OK with Puppies that originally came with the old variant preinstalled.......i.e., it's 'standalone', & self-contained? That being the case, what's the simplest way to obtain the uprated firewall_ng?
Doing a bit of digging, I see that even as far back as Tahrpup64, iptables AND ip6tables are present, symlinked into /sbin/xtables-multi. Do I take away from this that, although present, the firewall script wasn't in fact doing anything with the latter?
Your comments will be appreciated on this stuff...
Mike.
Should be, yes. But this won't help with other risk factors, like using an old kernel, old glibc, old openssl, old CA certificates and so on.
AFAIK yes, feel free to verify this. ip6tables -nvL INPUT will show 0 rules, while iptables -nvL INPUT won't.
That depends on what "disabling" means. If this means the router doesn't assign IPv6 addresses (so devices can still use SLAAC or static addresses) but doesn't drop IPv6 packets, this is probably not enough, because a compromised IPv6-capable device (pretty much any device) can still talk to your computer over IPv6.
If your firewall doesn't support IPv6 but you want better security, maybe you should disable IPv6 support in your computer instead (and deal with the consequences), so your computer has no IPv6 address at all and it's 100% unreachable over IPv6.
You're such a big security specialist Can you advise me what to do with my phobia? Recently, it seems to me that the authors of Ubuntu are Mossad, the authors of Debian are the CIA, and of course the GRU is behind ROSA Linux. All libraries are spyware ALREADY initially. What should I do, how to check all this? Help to restore peace of mind and balance
Fossapup OS, Ryzen 5 3600 CPU, 64 GB RAM, GeForce GTX 1050 Ti 4 GB, Sound Blaster Audigy Rx with amplifier + Yamaha speakers for loud sound, USB Sound Blaster X-Fi Surround 5.1 Pro V3 + headphones for quiet sound.
@dimkr - seems I have ipv6 disabled by default. The output of
Code: Select all
ip ais only inet - no inet6. /proc/sys/net only has ipv4. All my kernel configs have ipv6=m . If I modprobe ipv6, then run 'ip a' , inet6 appears. In the router, as you suspected, DHCP is disabled for ipv6 (as is ipv6 tunnel).
If ipv6 had been running, I could disable it by appending the linux/kernel line of grub.cfg with: ipv6.disable=1
AND
to ensure even modprobe won't activate it, rename /lib/modules/(kernelname)/kernel/net/ipv6/ipv6.ko by adding .no to the filename
Good for you, I guess. One thing less to worry about, if your firewall doesn't support IPv6
Yes, I advise you to be quiet if you have nothing wise to say. OP asked a serious question and I did my best to contribute to this discussion by challenging the assumption the that Puppy is secure by design (because it's not Windows, because squashfs is read-only, etc').
Feel free to deny the existence of cyber security issues and things like credit card theft, identity theft or cyber attacks that shut down hospitals (all of which are real things, as far as I'm aware), but please don't disrespect others.
So I also say that there is a risk with ANY user name and level of rights Another thing is that the conversation went into the orbit of "what level of fear". Then we should advise everyone not to use a computer. And use only cash. You cannot guarantee and advise your version of the system for conducting banking operations. If a person loses money, then he will blame your security advice. And he will do the right thing, because you have raised the topic to a high level of seriousness.
Fossapup OS, Ryzen 5 3600 CPU, 64 GB RAM, GeForce GTX 1050 Ti 4 GB, Sound Blaster Audigy Rx with amplifier + Yamaha speakers for loud sound, USB Sound Blaster X-Fi Surround 5.1 Pro V3 + headphones for quiet sound.
@ozsouth :-
Looks like the same for me, ATM, here in my customized Tahrpup64.
Code: Select all
ip a...returns:-
Code: Select all
root# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
2: tunl0@NONE: <NOARP> mtu 1480 qdisc noop qlen 1
link/ipip 0.0.0.0 brd 0.0.0.0
3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000
link/ether 04:0e:3c:11:53:ce brd ff:ff:ff:ff:ff:ff
inet 192.168.1.60/24 brd 192.168.1.255 scope global eth0
valid_lft forever preferred_lft foreverSo it looks like the original firewall_ng - as it came OOTB in this first 64-bit Puppy from Phil B - may perhaps be up to the job after all. Hm...
-------------------------------------
I'm toying with the idea of building a newer, 'static' openssl v1.1.1 in a more modern Puppy that will support doing so, then transplanting this backwards into older Puppies along with an up-to-date CA-certs package from Debian, and utilising the newer firewall_ng. I doubt it would be quite that straightforward, somehow..! 
Mike.
I have a mortgage and don't want my credit card stolen, what can I say. Everybody has their own balance between security and ease of use, and no answer is 'right' for everyone. However, I have good reasons to believe that running absolutely everything as root can only add risk (for example, risk of you deleting all your files by mistake), not the opposite.
I once saw an interview with some sort of computer security specialist. Towards the end of the interview they asked him "So what is a genuinely 100% secure computer?" to which he replied "One that's sealed in a lead case and has never, ever been switched on".
They also asked him what is a genuinely fast computer, to which he replied "One with no software on it". But that's another issue entirely.
@dimkr Admittedly, using root also brings some inconveniences. Running programs is one thing, but recently I had to do a lot of chown in order for two systems to get along on the same computer.
The example of the hospital can also be evaluated in different ways. If we provide the security of the institution for money, then all responsibility is on us. And in the case of an amateur OS, the agreement states that it is delivered "as is". No responsibility (they will scold us, but most likely they will not beat us with their feet and in the face ). BUT. They will scold, yes.
Fossapup OS, Ryzen 5 3600 CPU, 64 GB RAM, GeForce GTX 1050 Ti 4 GB, Sound Blaster Audigy Rx with amplifier + Yamaha speakers for loud sound, USB Sound Blaster X-Fi Surround 5.1 Pro V3 + headphones for quiet sound.
Responsibility is one thing, risk is another. Yes, AFAIK we have the usual "no warranty bla bla" legal disclaimer somewhere in the documentation, but sometimes users develop unhealthy expectations when others tell them "yes, it's Linux and only Windows has malware" or "yes, it's read-only so it's immune to persistent malware". Users need to know they're in risk when they use an outdated OS or an OS without any kind of security updates, so they can make informed decisions when they type their credit card information or enter their credentials, even if they blame the developer instead of blaming themselves afterwards.