Linux

There are no open security bugs against TDE that I'm aware of—if there were, I'd expect them to be fixed in the next release. In my experience, the development team, while not huge, is active and competent.

I've been using TDE since a little while after Gentoo sunsetted KDE3, and I've had no issues. Just make sure your X server is secure—-nolisten and all that stuff—and don't try to use Konqueror as a web browser (it remains an excellent file manager), and you should be fine.

Wayland is "more secure" than X in that it makes less LAN contact by default and tries to sandbox programs from one another to an extent, just in case some future browser exploit that can copy random swathes of your screen tries to screenshot your password manager or something. There are no active exploits against a correctly-configured X server at this time that will magically vanish if you switch to Wayland, as far as I'm aware—it's more future-proofing stuff.

Desktop environments are not equal form the security perspective, but they all are rather insecure, because security is hard and harms UX, and the GNU/Linux desktop is traditionally focused on UX and the user freedom by sacrificing security. However it is possible to build a secure environment based on an insecure DE, what Qubes OS does with XFCE, for example.

It appears to be maintained, which is a point in its favour.

You could send them a message on their mailing list and ask the question.

Probably not significantly less secure than Xorg itself, I wouldn't mind using in your place. DE security is usually not a huge problem, if someone can exploit these vulnerabilities usually you are quite bonked.

Remember most of what happens on screen is xorg, the wm is a simply interacting with xorg and other parts of your DE are simple user level programs like the panel etc..

Before you give up on XFCE and/or Chicago95 - have you replaced the default menu with Whisker Menu? For me, Whisker Menu is a must-have for any sane XFCE user. When I used it with Chicago95, I found I could have a Windows 7 style interface with Windows 95 aesthetics.

Honestly, even if Chicago95 is aesthetically not what you want, I'd recommend trying an alternate theme on XFCE - I currently use modified DesktopPal '97 combined with a pack of Haiku-style icons.

Overall, I'd be interested to know more about your qualms with XFCE and see if customization can help you overcome them. A lot of distros have annoying defaults for XFCE, but I changed a few simple settings and have a desktop I rather enjoy using. It is totally fine if it still isn't the thing for you after any potential discussion, but I just want to make sure you really know what XFCE has to offer before you move on.

My issue would be the old version of Qt it runs on, which is not maintained anymore. That itself is a bit of a problem security-wise.

It TDE secure (for personal use)?

Depends on your threat modeling. Though, unfortunately, none of the DEs/WMs on Linux offer perfect security; this even applies to a hardened distro like secureblue.

So, practically-speaking, it probably ain't great. But we aren't used to great anyways 😅.

You don't need Trinity for that, you can theme up KDE Plasma 6 to look and feel old school too.

As far as the TDE devs know, there haven't been any issues resulting in a user getting hacked, they've modernized the underlying code, and actively patch any reported vulnerabilities: https://redlib.tiekoetter.com/r/linuxquestions/comments/1f81hz4/is_q4ostrinity_desktop_environment_inherently/

That said, it is still a niche codebase with a small team, so they might not have the resources to be so proactive against theoretical vulnerabilities as a project like KDE or GNOME with Wayland. If you're being targeted, TDE would certainly be a shiny attack surface, but otherwise, I don't really see why a hacking group would go for something as niche as TDE. There's a tradeoff, like the one I take with X11 because I refuse to give up my XFCE+Chicago95 setup for an arguably more secure Wayland setup.

Most of the issues of a desktop environment just come down to there being more code and therefore a larger attack surface. Lots of widgets, obscure processes, and nooks and crannies to hide malicious stuff too. And legacy code with expansive privileges from the days before security was as much of a concern. While not Linux, it is analogous with security being a big part of why Microsoft released Server Core, which stripped out much of the GUI.

An extreme case, I also know of a someone who used Windows XP to do rather important work on the internet until around 2020. Only thing that stopped them were websites getting too bloated to load on their computer. But they did follow the basic rules as you mentioned and seemed to be just fine.

Sorry for the triple post, refreshed a couple times too much when it didn't respond