Show HN: Bor – Open-source policy management for Linux desktops
Points and comments are a snapshot, not live.
Bor v0.8.0 adds Thunderbird, Edge, and Firewalld policy management for Linux desktops.
Bor v0.8.0 introduces three new policy types: Thunderbird, Microsoft Edge for Business, and Firewalld zones. The agent manages policies via gRPC push with mTLS, and tamper protection uses inotify. The web UI was overhauled with URL routing, server-side pagination, and WCAG 2.2 AA accessibility. RBAC now supports per-action permissions. Security hardening includes mTLS certificate binding, HKDF migration for TOTP secrets, and SSRF protection in repository import helpers. Policy catalogues are generated from protobuf annotations.
What commenters are saying
Commenters largely praised Bor's design, especially the mTLS/gRPC push model and inotify-based drift detection. Several asked about alternatives; the author noted Samba's Linux policy support is unmaintained and lacks tamper protection, while Ansible/Puppet require more coding and don't enforce strict policies. Others requested features like SCAP/DISA STIG support, custom scripts, and integration with Authentik. The author clarified that custom scripts are deliberately excluded to avoid turning the agent into RCE-as-a-service. There was interest in using Bor for home labs and child screen-time enforcement via GNOME 50's parental controls.