> Users will still suffer XSS from crappy Oracle corporate applications, phishing, buffer overflows etc.

Buffer overflows - the guide mentioned both sandboxing (snap/apparmor) and remote low level data collection (auditd). If you don't trust the app, that's about as much as you can do.

Phishing - There's not much the OS can do. 2fa is required on the service itself, but that's not in scope for this doc.

XSS - Since you're connecting through a proxy in the recommended networking setup, there's a chance some known endpoints will be blocked. Again, that's in scope for the remote service, not really the OS setup.

I think they did a good job of describing what can you do as far as end-user workstations go. You could do some improvements by getting a grsec kernel, but that's not really Ubuntu 18.04 anymore. (I wish they mentioned it as an option though)

My point is they are crippling the functionality of the computer to achieve a marginal security improvement. The insecurity largely resides on the applications, which it barely touched on. Snaps are great, but anything that can touch X is a problem. Profiles for AppArmor are tricky to get right. If they want to do confinement then dockerised apps is much more effective than treating the end user as the primary threat to guard against. All the effort to prevent end users running binaries won't stop ROP gadgets or prevent kernel breaks. Adding 2FA for login, decent firewall and container networking rules, and syslog reporting, would be far more useful than their bizarre paranoia about users running scripts.

The complaint about LUKS is also bizarre, because the work function for trying one passphrase is enormous by default, and easily configured to be stupendously costly (e.g 30s). Its also quite feasible to boot from a USB key, which has a passphrase wrapped key; when separated from the computer this is very secure. TPM isn't foolproof either, so it comes across as rather ill informed.

There's also zerotier https://www.zerotier.com/ if you want something nicer to configure and potentially need to handle double-nat. The implementation is not as minimal, but will pretty good.

I really like their Edge devices, particularly the ability to enforce a distributed firewall. However, it really isn't clear to me how their crypto works. They use PK to do something, and traffic is encrypted with a symmetric cipher. How are nodes authenticated to join? It isn't clear from their description. They don't do PFS, it seems like there is no key rollover at all? Maybe I'm just obtuse, but I don't think they have explained it very well.