While it is outside of the scope of most people’s abilities, the bios is on a flash chip that can be removed, read, and disassembled. I’m no expert here by any stretch. That said, my usual check with software is to simply check for http
in strings. Even with a binary like a bios ROM, I can pass it through the $ strings
command to look for any addresses. No matter what kind of malicious nonsense the software is doing, it has very low value unless it can dial out.
My lack of a complete understanding in this area is why I use a whitelist firewall for most of my devices. It is also the ultimate ad and tracker blocker as I only visit the places I chose to access. I don’t conform to the lowest developer’s ethics and will simply stop using any site or service that fails to be direct and transparent.
The thing is, even most whitelist firewalls are inadequate. They only filter incoming packets. That is really an inadequate model in most cases now, especially with local large language models where it is impossible to verify their capabilities. My reason for all thus bla bla bla is to say, a whitelist on a trusted 3rd party device is a PITA but an effective low barrier way to prevent any bad actor from communicating with the questionable device. It still leaves you open to a potential situation where the device could be sending a packet stream to the outside world over something like UDP.
Otherwise, the main thing I would be concerned with, if it is a UEFI device, are the UEFI secure boot keys. Whomever holds these keys has a lower ring access than the operating system kernel. Anything happening in kernel or user space is effectively under their control.
Anyways, the main way to monitor and check the device is a trusted 3rd party router that blocks any unauthorized connections. This can be challenging to setup with something like OpenWRT. There is a forked OpenWRT device running a version that makes a lot of this easier called PC WRT. That can make a whitelist fw a little easier than sorting out NF Tables and scripting a whitelist firewall.
TBH: tl;dr (…but read ~1/4 and skimmed the rest.)
Emacs can likely do most, if not all, of what you’re looking for.
As far as distros, go with either Fedora Workstation or Silverblue. If you can run SB, try to avoid messing with the base system as much as possible, skip using the toolbox containers system and just use distrobox. With distrobox, you have almost all Linux distros available as containers, so you build on them. The only exception I know of is NIX. You can’t run NIX in distrobox. You probably could run the NIX package manager, but that involves this weird setup where a under owned directory exists in
/
root. Personally, this is just too weird for me to use it. I expect all user activity and configuration files to be confined to/home/$USER/
Fedora just works, but try and lag behind the release cycle a little bit. Like right now F40 is pretty solid, but there were some issues in the first month or so after F40 first came out. I have lagged in every release since ~F28 and never had issues. I switched to F40 within the first week or so and a few packages were wonky. Basically Python was super fresh and did some odd stuff with containers where it did not work without manually removing and replacing Python in each container. I think that was the only manual intervention issue I’ve had with Fedora. I have a 3080Ti laptop with the 16 GB GPU. The Anaconda system in Fedora builds the Nvidia kernel module automatically in the background each time the kernel is updated. It works flawlessly, even with secure boot enabled.