Unless “read-only” is being enforced by hardware (reading from optical media, etc), a compromised sudo user can circumvent anything, and write anywhere. A read-only flag or the root filesystem being mounted from somehwere else are just trivial extra steps in the way.

Improved security != extremely secure, is all I’m saying. There are a lot of things that go into making a system extremely secure, and while an immutable root filesystem may be one of them, it doesn’t do the job all on its own as advertised in this post.

The root filesystem is being read from somewhere, and if it’s being read from, it can be written to. Having an extra step or two in the way doesn’t make it “extremely secure”.

A Raspberry Pi 3b is about as plug-and-play with wifi and audio out as you can get, for $35 usd. 64-bit, Arch ARM has an image for it, the support and community are the absolute best you can get in an SBC, pretty much anything you could possibly want to do with it will have a blog writeup guide that sonebody’s already done. If a 4-core 1GHz processor and 1GiB of memory are suitable for the software you want to run, that’d be my go-to.

The top issue from this similar joke repo I feel sums up the entire industry right now: https://github.com/rhettlunn/is-odd-ai

I have a 43-inch Insignia N10 that works great in exactly that role. Dumb TV with HDMI inputs, audio outputs, and that’s about it. Best Buy’s in-house brand, it was like 120 bucks about a year ago, when my Vizio TV from 2003 finally died in a way I couldn’t fix :(

The built-in speakers aren’t great, definitely recommend hooking it up to something else.