Made a debian VM to try doing a PoC for a hypothetical managed PC that would have the appropriate settings for a non-technical family member.
You can do a lot with Firefox enterprise policy, like forcing DoH with a specific provider, forcing ublock origin to be installed with locally relevant blocklists enabled and settings page disabled, disabling AI and annoying popups, adding/removing search engines (you can say add noai.duckduckgo.com as a default), adding a managed set of bookmarks to the bookmark bar, preventing websites from asking for sensitive permissions (I would completely lock out notification access), etc.
On the actual Linux side, there's a bunch of things that should probably be done:
- adding an admin user
- removing default user from sudoers
- figuring out how to script KDE's user settings and provide defaults
- setting up a mesh VPN or such for remote SSH access
- setting up openssh
- maybe making a minimal script for those last two things and using something like ansible for everything else
- honestly there isn't much more because the web browser is the most important part of a computer for a normal person
- okay maybe there should be LibreOffice, some KDE tools like Okular or KWrite, Krita, Inkscape, probably that's it
- also a hand crafted set of file associations (idk how to even do that) unless debian has figured out how to make good defaults for that already (Arch has not and it's very painful)
Also the Firefox policy I mentioned above may be a little evil in some of the things it locks out, I have two versions actually, one for the kind of person that won't explode a computer if you let them use one, another for when I wouldn't say that.
luna the doggie 
@lunareclipse@snug.moe
