Malwarebytes, a full reinstall, a day gone. Then, a few months later, again. Two coworkers going through the same thing with their own aging parents said this was worth writing down, so here goes.
what actually goes wrong with a regular machine
She was running Windows 10, and the pattern repeated on a loop: Malwarebytes, a full reinstall, an entire day gone, everything clean. For a few months. Until it wasn't. Her significant other's machine ran the same cycle, on the same schedule. Bad links, bad computer hygiene, whatever the attack vector: it didn't really matter which, because the fix was always the same all-day event, and it never stuck.
It's not just my mom, it's pretty much every tech person I know. Tech gets harder as we age, and technology and attacks get easier. They are actually pretty frequent. FBI's IC3 tracked more than 201,000 victims 60 and older in 2025, reporting over $7.7 billion in losses, a 37% jump from the year before. Tech-support scams alone cost that age group $1 billion. Nobody's tracking exactly how many of those people get cleaned up and hit again inside the same year, but if you've done that cleanup yourself, you already know it happens.
why linux mint
The reasons stacked up fast once I actually sat down to pick something. Linux is a smaller malware target, so the cycle she was stuck in mostly stops applying on its own. Mint runs fine on modest, older-spec hardware: useful when you're shopping for reliable and cheap, something to replace the whole thing in case it's really compromised. It's stable, it supports the printers and peripherals she already owns, and none of it depends on chasing this year's hot release. Updates and backups both run through ordinary Linux sysadmin tools, tools I already know, and tools an agent can help me script against, instead of clicking through some vendor's proprietary console.
Windows made its own case against itself: Copilot, ads baked into the start menu, a screensaver that's really just another ad surface loading over the network. I'd have spent as much time turning things off as keeping the machine patched. You can lock down a Windows account too, restrict it, disable what you can, but you're still fighting the OS's own defaults on ads, forced updates, and telemetry the whole time, not just at setup. Mac wasn't a real option either: expensive, an unfamiliar platform, and just as hard to remote into and back up as Windows, maybe harder.
why a mini pc, and which one
I landed on a Beelink SEi12: Intel Core i5-12450H, 16GB DDR4, a 500GB SSD, $285. The i5-12450H is way more than Cinnamon, LibreOffice, and a browser will ever ask for, which is exactly the margin you want on a machine you can't walk over and troubleshoot in person. It's small, quiet, barely sips power, and it reuses her existing monitor, keyboard, and mouse instead of turning this into a whole new desk.
how we set it up
We started with Claude, I told it about what I needed and we brainstormed a plan, wrote down requirements, it guided me with setup and talked me thru problems we might have and here is where we landed and some of the issues we ran into along the way. Everything routes through a single mesh: Tailscale, no port-forwarding, nothing exposed to the public internet, reachable from wherever I am without fighting her home router. Remote support goes through a dedicated admin account, separate from her own login: NOPASSWD sudo, password login disabled entirely, reachable only over Tailscale SSH. There's no password to phish or guess, just tailnet identity, and it keeps anything I do fully separate from her session, profile, and history.
For actual hands-on-screen support I run RustDesk self-hosted, not the public relay, as a system service; it's already running, so she doesn't have to click "accept" for me to get in.
Updates are unattended-upgrades, scoped narrowly to security-only, not a blanket auto-upgrade of everything on the box, which sounds simple until you read what "security-only" actually resolves to. The default config ships with a template macro:
"${distro_id}:${distro_codename}-security";
It auto-expands from lsb_release. Mint reports Distributor ID: Linuxmint, Codename: zena, so that macro resolves to Linuxmint:zena-security: an origin/archive combination that doesn't exist anywhere. No error, no warning. It just silently matches zero packages and patches nothing, forever, while looking fully configured and working. I hardcoded the actual origin instead, confirmed straight from apt-cache policy against what the repo itself declares:
Unattended-Upgrade::Origins-Pattern {
"origin=Ubuntu,archive=noble-security";
"origin=Google LLC,archive=stable";
};
The second line's a separate wrinkle: Chrome isn't part of the Ubuntu/Mint security channel at all. It has its own repo with no security-only track, so it gets patched wholesale instead of filtered, which is fine, a browser is high-value enough to earn that.
The lesson generalizes: the thing that looks configured isn't the same thing as the thing that works. It's scheduled to reboot at 3am so it doesn't interrupt her mid-task, except the safety policy that skips a reboot while someone's logged in doesn't distinguish "logged in and using it right now" from "logged in three days ago and never logged out," which is the normal state for a non-technical daily user. I found out the mundane way during setup: running an update by hand one day, apt got stuck, and digging into why turned up /var/run/reboot-required still sitting there: a kernel update days old, waiting on a reboot that was supposed to happen automatically and just never had.
Backups run overnight: restic pushing her home directory (minus caches) to a self-hosted rest-server on the home NAS, in append-only mode, over the same Tailscale link. Append-only matters: even a compromised or buggy client can add backups but can't touch history. No cloud service, no ongoing cost, nothing facing the public internet.
Now for the real threat: this all started with a bad click, a phishing link, a fake "tech support" pop-up, a scam text. What actually addresses that is DNS-level filtering, device-wide, not just in the browser: Control D, scoped to her machine specifically through a Tailscale tag, blocking malware and phishing domains, typosquatting, newly-registered domains (the freshly-spun-up sites scams tend to use before anyone's flagged them), dynamic DNS, and URL shorteners that mask where a link actually goes. I verified it's actually blocking, not just configured: bit.ly resolves to a null address on her machine specifically, and resolves normally everywhere else on the tailnet. It's a meaningfully different kind of protection than a scanner would have been: it never lets the malicious domain resolve in the first place, which is closer to the actual attack surface (a link in a text, an email, a fake pop-up) than a signature scanner watching files already on disk. Still, we run ClamAV as a backstop, a small, lightweight scan of just her home directory. It probably wasn't necessary for her use case, but it's cheap insurance.
The rest is structural, not new: there's no admin password on her account to be talked out of in the first place; RustDesk's design means real support never needs her to read a code or click "accept"; Safe Browsing is on by default in both browsers. What's still genuinely missing is the one thing that isn't a technical control at all: the actual spoken rule, "I will never call and ask you to install something or read me a code." Everything else here got more concrete and more technical the deeper I went. That one hasn't moved since the start.
what it installs by default
Mint 22.3's Cinnamon edition already covers most of what she needs out of the box: LibreOffice (Writer, Calc, Impress, Draw) plus Firefox and Thunderbird. Mint ships the lighter Drawing app and the Pix image viewer, which covers cropping a photo or opening an attachment without asking for anything heavier. Nemo handles files, Timeshift handles snapshots. And Snap itself is blocked outright: /etc/apt/preferences.d/nosnap.pref pins snapd to priority -10, so nothing on the system can pull it in as a dependency without me deciding to override that.
why cinnamon
Cinnamon was the easy call: fast, lightweight, and close enough to a Windows desktop (start menu, taskbar, system tray) that there wasn't a new mental model to learn. On this hardware it's genuinely crisp; the start menu in particular renders clean and responds instantly, which matters more than it sounds like it should. She's not going to troubleshoot a laggy UI. She's going to assume something's broken and call me.
I've already told the coworkers who asked, and the answer is yes. Mint, Tailscale, and RustDesk are going to save me a stack of future Saturdays, and more importantly, they keep her able to use her own computer without either of us being anxious about it.
The part I didn't set out to build, but got anyway: she can't be talked into installing TeamViewer for whoever just called claiming to be tech support. She isn't in sudoers. She can't escalate privileges even if someone on the phone talks her through it. My own access is locked to tailscale ssh: full control-plane authentication, no open ports, nothing listening on the public internet. The one piece still missing: UFW, scoped to the Tailscale interface only, so even the SSH listener isn't reachable off the tailnet. That's the last step, and it's next, after a month or two of tech support quietness, LOL.
