Hardened. Locked down. Still fully alive.
A hardened Fedora Workstation 44 derivative with 41 functional modules across kernel, network, identity, integrity, firmware and browser controls.
SELinux enforcing, auditd, USBGuard and LAN-egress control ship by default — plus an optional provider-neutral WAN-strict mode. The daily-driver stack stays intact: Flatpak, NetworkManager, Firefox + uBO and a VSCodium workspace for opt-in Claude Code, Codex and local AI.
Disk encryption is an Anaconda installer choice. Build sources are published for audit; bit-for-bit reproducibility is not independently verified.
Fedora 44 · GNOME 50
41 Functional Modules
OS Telemetry Suppressed
Verify your download
A hardened OS is only as trustworthy as the file you booted. Always check the GPG signature and the checksum before writing the ISO to a USB stick.
Release signing key fingerprint:
1ACB FCE4 9687 FEBB 9101 0E52 F8E3 F11D 6962 256F
After you have independently matched the fingerprint, a valid signature shows that the checksum file was signed by the corresponding NoID Privacy release key; the checksum then proves the ISO is byte-for-byte intact. Both checks must pass.
What You Get
Defense layered across the whole stack — on by default, with Snapper rollback for covered root-system state
Substantially reduces attack surface — a pragmatic hardening tier, hardened by default while you stay in control. NoID, not ParaNoID: privacy-oriented defaults and LAN-isolation controls on any network you join — not anonymity or protection from every observer.
AI-Agent-Ready Workspace
Built for people who live in a terminal + IDE + AI-agent loop — opt-in agents, suppressed OS telemetry, local-AI capable
noid-claude-install and noid-codex-install install the reviewed native CLI and/or verified extension only after separate prompts.CLAUDE.md is exposed through native Codex and Gemini adapters, while project AGENTS.md carries the same doctrine. Opted-in Claude and Codex receive privacy defaults; model requests still send prompts and selected context to their provider.
How It Compares
A different optimum — privacy, security, documented recovery boundaries and usability
| Feature | NoID Privacy WS 44 | secureblue | Kicksecure |
|---|---|---|---|
| Base / delivery | Fedora 44 Workstation · mutable DNF | Fedora Atomic · OCI deployments | Debian 13 · mutable APT |
| Administrative boundary | Conventional sudo · 3-minute timestamp + faillock | run0 · sudo / su / pkexec removed | Separate daily-use and sysmaint roles on new GUI images |
| Browser approach | Fedora Firefox · repository policy + pinned uBO | Trivalent · hardened Chromium + SELinux confinement | No browser bundled · browser-choice workflow |
| Integrity / rollback | Btrfs root snapshots + user-owned AIDE baseline | Signed Atomic image / deployment workflow | Depends on selected image and operating mode |
| Primary fit | Mutable GNOME dev / admin workstation | Atomic Fedora / container-oriented workflow | Security-focused Debian / Whonix ecosystem |
Architecture snapshot, not a ranking. secureblue emphasizes authenticated Atomic delivery, hardened_malloc and Trivalent; new Kicksecure GUI images emphasize a separate sysmaint role. NoID Privacy deliberately chooses mutable Fedora with LAN isolation, user-owned AIDE, checked Snapper rollback, Firefox and an opt-in AI workspace. Peer-project defaults can change. Primary references: secureblue features, Kicksecure overview, Sysmaint and browser policy.
Requirements
A modern x86_64 UEFI machine; TPM 2.0 is optional
Built as a daily driver; actual performance depends on hardware and workload. The figures above are planning recommendations, not installer-enforced minimums.
Not for: ARM / Raspberry Pi · non-UEFI hardware · multi-user / family systems (LAN-iso blocks shared services) · enterprise AD / LDAP. Not a replacement for Tails / Whonix anonymity or Qubes VM-isolation.
Linux Audit 3.7.1 — reviewed and pinned for Workstation 1.5
Workstation 44 includes the reviewed, SHA-256-pinned, byte-identical upstream
NoID Privacy for Linux v3.7.1 payload. It covers 42 sections with hundreds of conditional
checks and records unknown or not-tested evidence explicitly. The noid-audit wrapper runs it
offline by default and adds the optional AI-remediation prompt when invoked without flags; active network
checks require an explicit --online opt-in.
noid-audit. It remains read-only by default; state-changing trust decisions require an explicit user opt-in.--offline by default. Only noid-audit --online permits the upstream connectivity, public-IP, DNS and LAN probes. Raw JSON and AI prompts can contain sensitive evidence; review and redact them before sharing.
--ai, --json, optional --offline and the GitHub Action; review and redact generated evidence before sending it to a cloud provider.
On Workstation 44, run noid-audit. On another distribution, download the exact standalone v3.7.1 tag:
This downloads the fixed v3.7.1 tag and then runs it as root; review the source before execution.
Standalone 3.7.1 leak/connectivity tests contact documented third parties
(including Cloudflare, Quad9, Akamai and ifconfig.me) and expose ordinary connection metadata such as your public IP; use
--offline to skip all outbound test sections. Review and redact the generated AI prompt
before sharing it with a cloud provider; that transfer is governed by the provider's terms.
Frequently Asked Questions
Is NoID Privacy Workstation 44 affiliated with Fedora or Red Hat?
No. It is an independent derivative built on Fedora Workstation 44 — not affiliated with, endorsed by, or sponsored by the Fedora Project or Red Hat. "Fedora" is a registered trademark of Red Hat. NoID Privacy ships its own hardening, branding, apps and a build recipe in the published source tree.
How is it different from secureblue or Kicksecure?
NoID Privacy is a mutable Fedora-based daily-driver with hardened defaults and Snapper coverage for supported root-system state. It does not claim immutability or amnesia, and it does not restore storage layout, LUKS provisioning, Secure Boot enrollment, firmware or /home.
Is NoID Privacy Workstation 44 really free?
Yes. The build code is GPL-3.0-or-later with documented file-level exceptions, and the ISO is a free download. OS telemetry is suppressed by default, and the build recipe and disable-list are published for review. This is not a claim of an independently verified bit-for-bit reproducible build.
Will the hardening break my daily-driver workflow?
GNOME 50, Flatpak, NetworkManager and Firefox + uBO remain available, but several security defaults intentionally trade compatibility for a smaller attack surface. Bluetooth, camera, microphone and location are opt-in; LAN isolation blocks shared services by default; and Gaming Mode relaxes the two image-controlled Steam/Proton blockers while SELinux stays enforcing. Steam is installed only in a separate visible completion step after the required reboot makes 32-bit execution live.
Does it include the NoID Privacy for Linux audit tool?
Yes. Workstation 1.5 includes the reviewed, SHA-256-pinned, byte-identical NoID Privacy for Linux v3.7.1 payload and starts it through noid-audit. The wrapper runs offline by default and adds --ai when invoked without flags; active network checks require the explicit noid-audit --online opt-in. The auditor covers 42 sections with hundreds of conditional checks; actual findings vary with the host and available tools. Standalone 3.7.1 also provides --ai, --json, --offline and a GitHub Action.
Ready to harden your daily driver?
41 functional modules. Optional installer-selected encryption. Secure Boot capable. No first-party analytics. Published build source.
Download NoID Privacy Workstation 44
Complete Your Security Ecosystem
Workstation 44 is the hardened OS in a family covering Windows, Android and Linux. The same philosophy connects them: You own your system.