Hello r/GUIX,

Esquema is a minimal, security-first, rootless container runtime built natively in Scheme.

It integrates with GNU Guix and Shepherd to give reproducible, strongly-isolated environments without a daemon, without root, and without YAML, just declarative Scheme.

Containers are first-class Scheme objects. Isolation is explicit, fine-grained and secure by default.

Official: https://git.securityops.co/cristiancmoises/esquema
Codeberg: https://codeberg.org/berkeley/esquema
Github: https://github.com/cristiancmoises/esquema

A hardened, privacy-focused, reproducible GNU Guix System as a boot-anywhere live ISO. 

Kernel SecurityOps (Custom Linux 7.1.1) · sway (Wayland) · curated offensive & forensics toolkit · Tor on tap.

Security Ops OS is a complete operating system defined as a single, pinned Guix Scheme artifact and shipped as a hybrid BIOS/UEFI live ISO you can dd to a USB stick (or drop into Ventoy) and boot on essentially any machine.

Download:

https://github.com/cristiancmoises/securityops-os/releases/tag/v1.9.0

Hey r/guix,

Recently upgraded my hardware (Acer Predator Helios Neo 16, i7-13700HX + RTX 4060) and used the migration as an excuse to properly systematize my Guix setup instead of just copying config files across.

What I built:

Custom channel: I maintain my own Guix channel with latest versions of packages I need for daily use that aren't in upstream: Tor Browser, Tor, Mullvad VPN, and a few others. Keeps my config.scm clean and reproducible across machines without patching upstream or relying on foreign distro packages.

Custom live image: Building a bootable GNU Guix image with two desktop options: XLibre + Sway. Ships with my own hardened Linux kernel config so the whole thing runs from a USB stick without installation. Goal is to give anyone a functional, privacy-oriented Guix environment without having to touch a partition table.

The hardened kernel piece took the most iteration: getting NVIDIA proprietary drivers working via nonguix on the live image while keeping the kernel lockdown config sane is its own adventure.

My configurations AMD/INTEL: https://git.securityops.co/cristiancmoises/guix-config

Channel: https://git.securityops.co/cristiancmoises/securityops-channel

SecurityOps OS: https://guix.securityops.co

My web operating system SecurityOS: https://os.securityops.co

SecurityOS — an amnesic, Tor-only privacy OS in your browser

A hardened fork of daedalOS (Next.js + TypeScript) that runs entirely in the browser. Built for students, researchers, and security practitioners who want a self-contained, no-trace workspace.

Live: https://os.securityops.co

Browsing — Tor only, by design

• Every request routes through a server-side privacy proxy over Tor (SOCKS5h, so .onion resolves and DNS never leaks). No clearnet browser exists.
• Proxy is SSRF-guarded, fails closed if Tor is misconfigured, pins the validated IP (no DNS rebinding), forwards only an allowlist of response headers, rewrites links/forms to stay in-app, logs nothing.
• Tabbed, with a NoScript-style 3-state JS control: Off (default) / first-party-only (LibreJS filter strips third-party server-side) / All.
• Optional Rust sidecar for the untrusted fetch + HTML-rewrite path (lol_html streaming rewriter); OS falls back transparently to the built-in proxy.

Crypto & data (Vaptvupt, compiled to WASM)

• Password mode: PBKDF2-SHA256 → AES-256-CTR + HMAC-SHA256 (encrypt-then-MAC) → .zupt.
• Post-quantum public-key mode: ML-KEM-768 + X25519 hybrid — keygen, encrypt to a pubkey, decrypt with the private key.
• Exposed in the terminal (vaptvupt/encrypt/decrypt) and the file-manager right-click menu.
• Secure delete: 3-pass random or zeros, then unlink.

System

• Amnesia: containers run read-only with RAM-only tmpfs (no volumes, no logs); session overwritten with CSPRNG randomness and wiped on shutdown.
• Linux VM: a v86 32-bit x86 emulator (WASM) booting live ISOs (Alpine, Tiny Core, SliTaz) amnesically, routable through Tor.
• TAILS launcher with CI-verified downloads (OpenPGP signature + SHA-256).
• Embedded first-party apps: SecTube (video), Vaptvupt file share, SecChat (E2EE video chat), plus an offline Security Tools suite (hashing, encoding, entropy, UUID).
• Expanded terminal: UNIX commands plus curl/wget over Tor, du, df, tree, stat.

Security model
Strict CSP without 'unsafe-eval' ('wasm-unsafe-eval' for WASM), frame-ancestors 'none', HSTS, COOP, CORP, locked-down Permissions-Policy. Single source of truth for headers (scripts/securityHeaders.js), mirrored to the Next config, _document.tsx, and the reverse-proxy samples. No persistence by design.

What loads — and what won't
The proxy renders pages server-side in an opaque sandbox, so it is deliberately not a full browser. Onions and mostly-static sites render cleanly; many arbitrary sites won't — they block Tor exit IPs (Cloudflare challenges), require JS + login, or break under URL rewriting. That's the ceiling of a privacy proxy, not a bug. For full anonymous browsing of arbitrary sites, use the Linux VM over Tor.

Turbo Recorder captures your screen and audio at the best quality your hardware can deliver. It probes your machine and configures everything automatically — operating system, display server, CPU vendor, GPU, the best hardware video encoder, screen resolution, and your microphone + system-audio sources — then builds a real-time, correct-speed FFmpeg pipeline and records.

•  Zero config: auto-detects OS, CPU, GPU, encoder, screen, mic & system audio
•  Hardware accelerated: NVENC · Quick Sync · VAAPI · AMF · VideoToolbox, with automatic CPU fallback
•  Real-time, correct-speed capture: constant frame rate, so recordings never play back in slow motion
•  OBS-style capture: full screen, a specific monitor, a window, or an exact region
•  You choose: CPU or GPU encoding · H.264 / H.265 / AV1 · lossless FLAC (or AAC/Opus) audio
• 🖤 Beautiful dark GUI and a powerful CLI: packaged as .deb / .rpm / AppImage

Official repo: https://git.securityops.co/cristiancmoises/turborec

Codeberg: https://codeberg.org/berkeley/turborec

Github: https://github.com/cristiancmoises/turborec

Hello r/emacs

Here in Brazil, WhatsApp is practically a necessity... so much so that I once bought a brand-new smartphone just to install it and keep in touch with a few friends, family, and work.

This project grew out of a simple wish: to live inside Emacs for everything, all day long.

Now you can (almost) put your smartphone down too.

Feel free to use this tool. If you like it, please share it with your friends. Have a nice day.

Remember… in code we trust.

Website: https://whatsappel.securityops.co

Official repo: https://git.securityops.co/cristiancmoises/whatsappel

Codeberg: https://codeberg.org/berkeley/whatsappel

Github: https://github.com/cristiancmoises/whatsappel