I don’t know of any comprehensive source but there are a few basic things you that I do.

1. Ensure sudo is on the system so that root account is not used.
2. Get a secure browser that with add ons to protect against malicious sites (https everywhere, JavaScript blockers, etc…)
3. Download software from trusted repositories and verify with GPG keys or hashes. Be wary on installing anything using a shell script with super user access.
4. Use keys instead of passwords for ssh if you are going to use ssh.
5. Password tools like Vaultwarden and KeePass can help secure passwords.
6. You can encrypt your hard drive with LUKS before you install Linux with many distros.
7. Flatpak (Docker as well) can allow you to run applications with limited access to your system much like phone apps on Android. This can be more secure but comes with larger app sizes and limits what you can do with the app sometimes (e.g. browsers not being able to upload files because they don’t have full filesystem access)
8. If you want a firewall on your workstation (not needed much anymore with hardware firewalls from routers), UFW makes it easy
9. If you want to check for viruses use ClamAV (ClamTK for a GUI app).

Yes, just because the source code is available doesn’t mean it is licensed for others to take. Now we have AI tools that have scraped the web for all of its content and won’t see the difference between source available, open source , and free and open source. It is possible that those who use AI tools could be unknowingly using code without the license to do so.

This argument in this article is poor. An analogy would be:

“Because donating free food to the poor might feed future criminals, we should no longer provide free food.”