I did not have this issue before running only free repos.
I don't want to use non-free drivers. I noticed a behavior change at boot up and handing off bluetooth to the OS.
rfkill unblock all seems to have changed nothing after reboot. Only after booting in does it do anything. Before I had no issue. It's like the rfkill switch if toggled off does not hand off to the OS now during boot. It stays off on the OS and I must through software enable bluetooth. Before I could toggle BT and Wifi on and off with just the switch never having to mess with rfkill package. Maybe a newer version of rfkill is to blame

Now it's like the OS doesn't 'grab' the bluetooth. When I boot rfkill starts with a softlock but I imagine maybe it's just now the default after installing the package. Maybe it's just my configuration. It's not something I messed with before but now I am paying attention to it.
Not sure anyway to fix this without nuking the setup.

I'm using a t400 running libreboot.

Right,
I wonder if checking your sockets could detect it. I think you are pretty save.

netstat -ao | less

  check your sockets in recovery and in full user mode.
Look for anything abnormal. It's good to get familiar with what your system sockets look like. dbus is pretty busy. If you can minimize sockets you minimize attack surface.
Most of the targeted libs are apache or java related. Minimalism is a good bet.
Again though a lot of linux vulnerabilities seem to happen early during boot process or in between system upgrades I imagine is when they are the most vulnerable. I am only guessing though that's when you are dealing with root kit level stuff.
Only way to get persistence as well I imagine.

see GNUser's init script to modify your mac address at boot up.
It automates the whole process.
https://dev1galaxy.org/viewtopic.php?id=786
you can use macchanger from the repo. you can manually set or change whenever you want.

I am having issues myself on chimera blue tooth. After upgrading. I had the bluetooth show up as disabled on boot up if RF kill switch was on during boot up then switch back on after logged in.
Got dmesg warning me failed to load bluetooth firmware. rfkill shows bluetooth as hard disabled even after switch is turned on.

you'll have to move openvpn from /sbin into /usr/local/bin
I'd suggest trying to use network manager or some user side application with VPN support.

As of now I have not tried and always ran it as root.
Potentially you can try experimenting with firejail or fakeroot .

I see there is a iceweasel package. I opted to use that.
Although i see no real change between firefox-esr. It's still in the repo so I use it instead.

Excuse me if I am being ignorant. But pipewire also can deal with video?
Isn't this the kind of encroachment systemd is guilty of? Doing too much?
Anyway kinda sounds like a user level PAVP. I'd rather just have alsa but with easier device switching.

Apologies. When trying to play a movie on a TV from the laptop. Running Devuan or even Debian. I had no sound through the HDMI port so no sound out of the TV.

yikes. I'll miss it but looks like there are already drop in replacements.
Am I missing something or is chimaera recently had obmenu added again? I never noticed it going missing.

I don't know enough to comment about the functionality. Well I haven't bothered to 'upgrade' to wayland.
However, X as it is now. As I still use it suffices. But I do realize any big security holes or oversight in X would be difficult to patch.
I am hopeful wayland will provide added security.

Now I can't say Xorg is terribly insecure. More so I have noticed I've only had issues when I am using say a Dell laptop. The news of SMM vulnerabilities on Dell systems does not surprise me in the slightest. Xorg works, and it's familiar. Now booting a minimal system, sure might take away some issues. But honestly the Meta packages that is xfce makes it difficult to trim it down and keep all the niceties

I had issues when booting into a X session, going to tty1 logging in as root. Coming back to the X session and seeing bounce keys or sticky keys is activated. I assume key logging. It's only happening to me on Dell systems, and due to it being such low level on the system I can only imagine automation and big 3 letter agencies at play. No issues of the sort on something running core boot or when I run a dell system further away from untrusted networks.

Now I hate to be that guy but the idea of an accessibility feature being leveraged for key logging doesn't sit well for me. But what does that have to do with Xorg? Why does Xorg have to pick up the slack for XFCEs mishaps and meta package bloat. Modularity and modability are great goals. I think X does a decent job and will continue to do a good job.

I think it comes down to user wants and needs. I do buy hardware based off of software. My first bare metal install was on a Dell laptop, now I do not want to repeat a purchase of a system that has questionable security under the hood. Devuan released under the pretense of Watching your first step. The rabbit hole does go pretty deep, down to the microcode, boot up, bios and uefi. I think we can all agree if you have a trusted execution at lower layers. IE Coreboot. You are better off. The average person doesn't care, and more fear mongering will only make you sound like a news reporter. But when it comes down to trust. I trust Xorg more then I trust Dell, Microsoft, or Google. Heck I trust systemd more then those 3. Hopefully wayland will become something people wont blink twice on installing. Maybe it can provide some functionality and no cost of security. As it stands now I don't think it's there yet.

Now this pipewire, concerns me. Why does pipewire need to deal with video? Oh containerized programs. right,
if snaps and flatpacks were not disruptive enough. What happened do one thing and do it well? Pipewire should of stuck to audio. It'll be a monolithic blob like systemd. Dangerous. That is the devil in the details to me. pipewire is trying to do too much and runs on the MIT license. Which is inferior to the GPL.

I know nothing of GTK3 theming. All I know so far is modifying basic hex values.
I'll look into it I see some documentation is a place to start. One thing I miss on the Clear looks theme is the Workspace squares changing color when hovered over. I'll see if I can re-introduce that.
It'd also be an excuse to make my GTK2 and Gtk3 colour palates match perfectly. Currently if you look close there are discrepancies on the theme I am using.
If I have time I'd throw in a openbox pallet with it. No promises, but I'd love to try and contribute something helpful.

I use that program setnet.sh (I'd be nice if it was in the repos I found it on an Old Iso in Ascii and I transferred it over to BeoWulf)
Thanks to Vincenzo "KatolaZ" Nicosia
Connecting never was easier.
Although it lacks features like Hostname spoofing Channel selection. but it's really good program. Unfortunately the github version seems slightly older the one I have is from 2018. It might of migrated to gitlab or something

Any issues I have usually come from intel Wifi Cards. Not as stable (oddly no other cards drop connection for me) and funny that hostname spoofing is quirky on intel Wifi cards starting a new tty it will change your tty hostname. so yeah Free Wifi cards are a good place to start.

I am on 5.9 on this laptop.
I have not noticed any issue with Xfce4-panel (4.12 version)
I am using openbox session. w/ Ati gpu.