Hello 
So whats up with the printing situation in kicksecure?
[user ~]% apt list --installed | grep cups
WARNING: apt does not have a stable CLI interface. Use with caution in scripts.
libcups2t64/stable,now 2.4.10-3+deb13u2 amd64 [installed,automatic]
[user ~]%
If its just libcups2t64 does this effectively mean at the minimum that CUPS is missing for local printing?
Why is CUPS not included?
Too much of an attack surface not worth maintaining for a small % of users?
CUPS is often reachable over internal networks, and sometimes even the public internet. I have never seem a distro that distributes a hardened version of it. There was some new 2026 CVE’s that maybe you saw that are very similar to the 2024 CVE’s that are on official cups github security advisory section.
My Debian 13 shows lots of cups packages man that are prob unnecessary for basic printing (no network printing):
debian13@localhost:~$ apt list --installed | grep cups
WARNING: apt does not have a stable CLI interface. Use with caution in scripts.
cups-client/stable,now 2.4.10-3+deb13u2 amd64 [installed,automatic]
cups-common/stable,now 2.4.10-3+deb13u2 all [installed,automatic]
cups-core-drivers/stable,now 2.4.10-3+deb13u2 amd64 [installed,automatic]
cups-daemon/stable,now 2.4.10-3+deb13u2 amd64 [installed,automatic]
cups-filters-core-drivers/stable,now 1.28.17-6+deb13u1 amd64 [installed,automatic]
cups-filters/stable,now 1.28.17-6+deb13u1 amd64 [installed,automatic]
cups-ipp-utils/stable,now 2.4.10-3+deb13u2 amd64 [installed,automatic]
cups-pk-helper/stable,unstable,now 0.2.6-2.1 amd64 [installed]
cups-ppdc/stable,now 2.4.10-3+deb13u2 amd64 [installed,automatic]
cups-server-common/stable,now 2.4.10-3+deb13u2 all [installed,automatic]
cups/stable,now 2.4.10-3+deb13u2 amd64 [installed]
libcups2t64/stable,now 2.4.10-3+deb13u2 amd64 [installed,automatic]
libcupsfilters1t64/stable,now 1.28.17-6+deb13u1 amd64 [installed,automatic]
libcupsimage2t64/stable,now 2.4.10-3+deb13u2 amd64 [installed,automatic]
printer-driver-hpcups/stable,unstable,now 3.22.10+dfsg0-8.1 amd64 [installed,automatic]
python3-cups/stable,now 2.0.4-2+b2 amd64 [installed,automatic]
python3-cupshelpers/stable,unstable,now 1.5.18-4 all [installed,automatic]
debian13@localhost:~$
Network printing or printing to a remote cups server is like 1% of linux users if any at all lets be honest unless you are enterprise or advanced you are most likely not doing this.
Currently I have a Brother printer that just worx out of the box on Debian 13. Most modern printers including Brother can use IPP-over-USB (Driverless Printing). Mine I just plugged in USB printer cable and it just worked either the driver was included by default or its using driverless printing.
I’m just trying evaluate the printing situation in Kicksecures defaults. Modern brands work without needing network access. HP however, the brand has gone down hill tremendously, partly why I switched. Modern HP printers effectively require network access for cloud, updates and BS.
Due to this fact, most security conscious are not going to mess with HP printers on linux and aren’t going to use a printer connected to a network either. So that makes this fall in the 1% of users again (my opinion).
Would you say supporting printing in general would be 0.1% of kicksecure user base. Kicksecures wiki page on printing not very clear compared to Whonix’s page. Does anyone even print on Whonix? Again this prob a small % of users.
My use case when printing is QR codes and things I’m studying.
Would Kicksecure reconsidering shipping CUPS included with hardening and isolation 
that nothing is changed after updates.
you know is partly this reason to do most on a secure host. Since you suggested it, I might give er a go and see what its like. Wish me luck 
Kicksecure is very hardened in comparison to vanilla Debian, but even so, vulnerabilities can (and have) existed in system components like the Linux kernel that Kicksecure was vulnerable to, and where no major Linux distribution could have reasonably been immune to the vuln before it was found. (The recent Copy Fail and Dirty Frag vulns are good examples.) Using Kicksecure as a hardened virtual machine host is good defense-in-depth.