Best Laptop For Qubes

[qubes...@gmail.com]

I know this question has been asked many times but there is still no definitive answer. The Purism laptops do not have TPM support and in the HCL list there is not a machine that ticks every box without issues. What machines are the devs using? What laptop does Joanna use?

[qubes...@gmail.com]

Any one got an X270 or Kaby Lake machine?

[cooloutac]

On Monday, June 26, 2017 at 3:50:14 PM UTC-4, qubes...@gmail.com wrote:
> I know this question has been asked many times but there is still no definitive answer. The Purism laptops do not have TPM support and in the HCL list there is not a machine that ticks every box without issues. What machines are the devs using? What laptop does Joanna use?

are you sure they don't man?

[cooloutac]

i googled, apparenlty tpm not compatible with coreboot? lol that sucks. I think they have secure boot though. so who cares about coreboot at that point lol...

[cooloutac]

oh this is interesting. I try go to this page https://www.coreboot.org/Security#TPM_issues but I get a 404 error. every other link on their site works lol.

[Tai...@gmx.com]

On 06/26/2017 10:30 PM, cooloutac wrote:

> On Monday, June 26, 2017 at 10:27:32 PM UTC-4, cooloutac wrote:
>> On Monday, June 26, 2017 at 3:50:14 PM UTC-4, qubes...@gmail.com wrote:
>>> I know this question has been asked many times but there is still no definitive answer. The Purism laptops do not have TPM support and in the HCL list there is not a machine that ticks every box without issues. What machines are the devs using? What laptop does Joanna use?
>> are you sure they don't man?

Purism isn't worth buying, it has the same level of firmware freedom and
respect for you and your privacy as a dell and is incredibly overpriced
for what it is.

I would advise a X220/X230 which is open source besides the ME (supports
ME cleaner) The Ivy/Sandy bridge lenovo thinkpads (X220, W520, T430 etc)
also support TPM and I would be more than pleased to help you install
coreboot >:3 It is what I use as the open source firmware no ME Lenovo
G505S lacks a dock connector which I require.

In comparison purism's version of coreboot is simply a wrapper layer
that uses a binary blob to do all the work.

> i googled, apparenlty tpm not compatible with coreboot? lol that sucks. I think they have secure boot though. so who cares about coreboot at that point lol...

Coreboot has a grub payload option with kernel signing, which is the
same as "secure" boot only more versatile as you can sign your owner
kernels.

"Secure" boot isn't secure, as there are plenty of exploits to bypass it
including the probable nation state backdoors.

Coreboot has TPM support for various boards, where did you get the idea
it didn't?

On some native init libre opteron coreboot boards such as the KGPE-D16
and KCMA-D8 coreboot has owner controlled CRTM which means the CRTM is
not predictable as it would be with a vendor bios (having a predictable
CRTM ruins the security of a TPM)

[cooloutac]

they are all severely overpriced. and I just refer to the exploits saying hacking teams insyde bios exploit didn't work with secure boot enabled. Doesn't that say something. Richard Stallman says secure boot is ok to use. That doesn't ease your mind?

nation state backdoors? so amd is not part of that? Not sure what we can do about that is except petition for laws against it. some guy was on irc the other day complaining he couldn't get qubes installed on one of these opteron server type boards cause I assumed the driver was not working for his intel gpu believe it or not.

I think the first thing you should look at when buying hardware is if the vt-d/iommu is supported. And best way to do that is to make sure they show a picture of the option in the manual, and preferably show it enabled. If they mention the word security regarding it too thats a good sign. Everything else should fall into place as far as compatibility with qubes goes.

This is pretty hard to do with oem laptops, so you can just walk into a computer store with the live qubes usb. and start rebooting laptops and checking the hcl report. The worst they can do is tell you to leave there is no way you will get arrested. Just be honest and tell them you use qubes-os and you want to make sure the iommu feature work which is its main security benefit.

I would stay away from a machine that is too new is the general rule of thumb in linux world. They are usually 1-2 years behind on hardware support.

[cooloutac]

If you walk into a microcenter I guarantee you can prolly get the manager to burn it onto a usb for you lol.

[Tai...@gmx.com]

Where did stallman say that? BIOS exploits are not at all stopped by
"secure" boot, that is simply a kernel signing mechanism they're
entirely separate.

My libre kgpe-d16 gaming build cost less than I would have paid for a
non-free intel machine with equivalent performance.

> nation state backdoors? so amd is not part of that? Not sure what we can do about that is except petition for laws against it. some guy was on irc the other day complaining he couldn't get qubes installed on one of these opteron server type boards cause I assumed the driver was not working for his intel gpu believe it or not.

An intel gpu on an opteron server board? and you wonder why I question
your expertise.

The only way to have a backdoor on my libre boards is microcode, and
they aren't going to bother wasting insane amounts of money to make one
as they don't need to.

The KGPE-D16 is in the qubes HCL list, and I have tested it - it works
great.

> I think the first thing you should look at when buying hardware is if the vt-d/iommu is supported. And best way to do that is to make sure they show a picture of the option in the manual, and preferably show it enabled. If they mention the word security regarding it too thats a good sign. Everything else should fall into place as far as compatibility with qubes goes.

I have bought two separate "IOMMU" supporting computers that turned out
not to actually support it, both said it in the manual too - After I
bought my libre KGPE-D16 I finally was able to use it and play games in
a VM with an attached graphics card. (performance is great too, I play
BF1 @ max settings)

I am pleased to not have to rely on a vendor for fixes, as I have always
been left in the lurch even for "enterprise" hardware.


Honestly why do you keep arguing this? You keep putting down real
quality options that work and that people can buy today.

[cooloutac]

I'm wrong, Purism doesn't have secure boot. future models supposedly will though. along with tpm support.

RMS must of said it on fsf, or prolly his own website. I forget which. He basically said secure boot "failed its intended purpose, so its ok to use for security purposes"...

Well I guess I lucked out with iommu on my machine. But making sure its showing the picture of it was the suggestion I've read from Joanna on the site and it worked for me man. I just added the part of making sure it shows it as enabled in the pic, and would also add or if it states enabled by default in the manual.

I'm not sure what you mean depending on vendor for fixes. You are making the machine yourself? lol. Or do you mean that those boards are patched more frequently? Accuse me of over analyzing if anything but I'm not trying to put anybody down.

[cooloutac]

On Monday, June 26, 2017 at 11:14:32 PM UTC-4, Tai...@gmx.com wrote:
> On 06/26/2017 10:57 PM, cooloutac wrote:
>
> > On Monday, June 26, 2017 at 10:43:26 PM UTC-4, Tai...@gmx.com wrote:
> >> On 06/26/2017 10:30 PM, cooloutac wrote:
> >>
> An intel gpu on an opteron server board? and you wonder why I question
> your expertise.
>

maybe it was a xeon lol, point is I think server boards are for servers, I don't immediately think compatibility.

You keep accusing purism of being overpriced then post about a 100 dollar keyboard, and now 500 dollar mobos? Its like you keep trying to prove my point security is only for rich people. lol

[Tai...@gmx.com]

On 06/26/2017 11:41 PM, cooloutac wrote:

> On Monday, June 26, 2017 at 11:14:32 PM UTC-4, Tai...@gmx.com wrote:
>> On 06/26/2017 10:57 PM, cooloutac wrote:
>>
>>> On Monday, June 26, 2017 at 10:43:26 PM UTC-4, Tai...@gmx.com wrote:
>>>> On 06/26/2017 10:30 PM, cooloutac wrote:
>>>>
>> An intel gpu on an opteron server board? and you wonder why I question
>> your expertise.
>>
> maybe it was a xeon lol, point is I think server boards are for servers, I don't immediately think compatibility.

If you don't know what you are talking about don't just throw stuff out
there, you can have your opinion but that isn't a fact and it shouldn't
be stated as such.
It isn't right to put down good hardware for no reason like what you are
doing.
When I was a young teenager and I first joined the internet I did the
same thing until people told me to stop, then I learned for real - they
appreciated that and so did the tens of thousands of people I have
helped on various forums over the years. I hope you will do the same.

There is no actual difference between "server" and "desktop"
CPU's/chipsets, it is 100% marketing and artificial market segmentation.
Intel/AMD don't run two production lines they simply burn fuses to turn
features off or on for that market segment. They also sell 4 and 8 core
cpus but they only make 8 core cpus, if an 8 has two broken cores
instead of throwing it away 4 are shut off and it is sold as a quad core.

>
> You keep accusing purism of being overpriced then post about a 100 dollar keyboard, and now 500 dollar mobos? Its like you keep trying to prove my point security is only for rich people. lol

A G34/C32 cpu is only around $30, whereas you'd pay $500 for a xeon with
equivalent performance
A KCMA-D8 is $330 not $500.

I built my libre computer for $500 total, I fail to see how that is
comparable to a closed source computer (purism) that costs thousands of
dollars - if they were actually free that would be a fine price to pay
but they aren't so you're spending twice as much as a dell or system 76
for no reason.

I have had my Model M keyboard for 10 years, before I bought this I had
to buy a new $30 keyboard every 3 years as they would break or the
letters would wear off and they would look gross so I have saved money.
I will never have to replace it as it will never break. It feels much
better to type on and my hands stopped hurting too.

I don't understand why people will balk at spending money on slightly
higher fixed costs (what you don't replace every pc upgrade, keyboard
chair etc) when they spent thousands on a new gaming pc every few years.

[Tai...@gmx.com]

On 06/26/2017 11:34 PM, cooloutac wrote:

> I'm wrong, Purism doesn't have secure boot. future models supposedly will though. along with tpm support.
>
>
> RMS must of said it on fsf, or prolly his own website. I forget which. He basically said secure boot "failed its intended purpose, so its ok to use for security purposes"...

I highly doubt he would say that considering he knows the real reason MS
introduced it.

>
> Well I guess I lucked out with iommu on my machine. But making sure its showing the picture of it was the suggestion I've read from Joanna on the site and it worked for me man. I just added the part of making sure it shows it as enabled in the pic, and would also add or if it states enabled by default in the manual.

Yeah if it works you sure did, I have two non-libre computers that claim
support in the manual but don't actually have it.
Most boards also have multiple revisions, for instance gigabyte has a
board that has 6 versions and IOMMU only works on 2/6.

>
> I'm not sure what you mean depending on vendor for fixes. You are making the machine yourself? lol. Or do you mean that those boards are patched more frequently? Accuse me of over analyzing if anything but I'm not trying to put anybody down.

If you don't have libre firmware you can't fix things yourself, you need
to rely on the vendor.

[Jean-Philippe Ouellet]

On Mon, Jun 26, 2017 at 3:50 PM, <qubes...@gmail.com> wrote:
> I know this question has been asked many times but there is still no definitive answer. The Purism laptops do not have TPM support and in the HCL list there is not a machine that ticks every box without issues. What machines are the devs using? What laptop does Joanna use?

"best" is subject to one's perspective, so I don't think you'll get a
"definitive" answer. For example, which do you care most about: raw
performance, battery life, the openness of your boot sequence,
something else?

From my personal experience and that other Qubes users I know IRL, any
used (to give hardware support a year or so to settle) X-series or
T-series thinkpads seem to hit a good balance between compute power,
hardware support, and price. The fact that they're popular among
hackers means they get more attention for hardware support (including
coreboot support for select models).

Personally, my day-to-day machine is a thinkpad x1 carbon with an i7
and 16gb ram. It took about a year, but hardware support is more or
less perfect now, with the exception of suspend/resume still failing a
couple times a month (not often enough for me to care, and I suspect
due to an embedded controller issue and not linux/xen). Battery life
is ~6 hours, but my workload is probably much heavier than the typical
user (usually 10-20 VMs running at a time, lots of DispVM starts, and
lots of compiling). The CPU is powerful enough to handle my workload
without issue.

I have friends happily running qubes on other thinkpads (X230, T430,
and various editions of the X1 carbon), and even one happily running
qubes on a macbook. One friend ran it on a dell and gave up due to bad
hw support (graphics & suspend/resume issues) and no patience for
messing with kernel versions, etc. YMMV.

Cheers,
Jean-Philippe

[Jean-Philippe Ouellet]

As for Purism, I have my gripes too, but at the end of the day I think
their existence provides a net-positive benefit to the community and
commodity hardware landscape.

Personally, I think Purism's marketing is perhaps a bit...
overoptimistic to a technical audience? And I do think they exaggerate
their openness compared to other options. That said, I do believe
their heart is in the right place, and that they do things like hiring
(?) Trammell Hudson to work on heads for their machines, and having
one of their staff work on revere engineering the non-removable ME
sections shows that. If their perhaps somewhat objectionable marketing
is necessary to sufficiently differentiate their products so they can
justify their higher price tag, and if that price tag is necessary to
stay alive and to fund the things they're working on that benefit the
community (specifically the low level stuff - I don't care about
PureOS), then so be it.

It initially seemed to me that Purism was just trying to capitalize on
less-technically-informed people's desire for privacy and security
without really delivering on that promise, but that seems not to be
the case after all, and I think they deserve more love than hate than
they're currently getting from the community.

Don't get me wrong, I'd love to ditch intel and foxconn and everybody
else and use a risc-v novena running genode or something to get my
work done, but unfortunately that day (decade?) isn't here yet, so in
the mean time let's be realistic and support those trying to
incrementally improve the things we can actually still get our work
done with.

As for the Raptor Talos and POWER in general, yes, I totally agree
it's leaps and bounds better than other commodity options, but I
couldn't afford one, it wouldn't fit in my backpack, and even if it
would I'm also not interested in carrying around a car battery just to
power my CPU for 5 minutes. I'd love to be proven wrong, but I don't
see it as a realistic option.

This is somewhat offtopic from Qubes, but oh well. That's where this
topic has drifted to, and the essay-rant is already written, so too
bad :P

[qubes...@gmail.com]

How does Purism's Coreboot 'wrapper layer' compare to using Lenovo Bios, American Trends etc? Do we know that closed source BIOSes do not contain keyloggers to capture encryption passwords?

[qubes...@gmail.com]

Anyone?

[Chris Laprise]

On 06/27/2017 01:34 AM, Jean-Philippe Ouellet wrote:
> As for the Raptor Talos and POWER in general, yes, I totally agree
> it's leaps and bounds better than other commodity options, but I
> couldn't afford one, it wouldn't fit in my backpack, and even if it
> would I'm also not interested in carrying around a car battery just to
> power my CPU for 5 minutes. I'd love to be proven wrong, but I don't
> see it as a realistic option.

Lol... That was my impression of Talos as well: A bit monstrous in the
physical aspects.

How did POWER diverge from PowerPC so radically in this respect? Is the
latter technically moribund or patent-encumbered?

>
> This is somewhat offtopic from Qubes, but oh well. That's where this
> topic has drifted to, and the essay-rant is already written, so too
> bad :P

I'm always glad to see the question of hardware platforms raised with
Qubes, esp when discussing compatibility. There is no strictly
compatible system for Qubes and this makes me think the project should
eventually get into the business of detailed hardware specification...
what ideal Qubes hardware looks like.

--

Chris Laprise, tas...@openmailbox.org
https://twitter.com/ttaskett
PGP: BEE2 20C5 356E 764A 73EB 4AB3 1DC4 D106 F07F 1886

[Chris Laprise]

On 06/27/2017 01:16 AM, Jean-Philippe Ouellet wrote:
> I have friends happily running qubes on other thinkpads (X230, T430,
> and various editions of the X1 carbon), and even one happily running
> qubes on a macbook. One friend ran it on a dell and gave up due to bad
> hw support (graphics & suspend/resume issues) and no patience for
> messing with kernel versions, etc. YMMV.

Dell were the most notorious cost-cutters for a long time. But in all
fairness, I think one must discern between the consumer and business
product lines when discussing compatibility issues and quality.

So even though I have a warm spot for Thinkpads, I also recognize that
other 'primary' PC brands -- namely Dell and HP -- have business laptops
that fare well. And I can't imagine why anyone would want to spend hours
and days of their time trying to get understandably-finnicky software
like Qubes running on whatever consumer models happen to be laying
around. (Well, I can imagine, but I know it has to do with an unexamined
delusion that "PC hardware" represents some kind of blank slate that
Windows just happens to run on instead of the reality that they are
Windows-focused and full of undocumented shortcuts and bugs that greatly
impact non-Windows systems.)

[Peter Thurner]

I'm running qubes on a Thinkpad T520 - the Laptop is way to big in my
opinion. I build 16 GB RAM into it with a 500GB SSD and it runs qubes
quite smoothly.

What do you guys think about this Laptop?

https://puri.sm/products/librem-13/

With the i7 and 16 GB RAM it costs around 2k USD. Seems kind of legit in
my opinion. One has to buy an additional 3G card though, if one wants
one (and then one wont be able to add a second SSD).

Mit freundlichen Grüßen,


Peter Thurner

--

Blunix GmbH - Consulting for Linux Hosting 24/7

Glogauer Straße 21
10999 Berlin, Germany

P: +49 30 / 120 839 90
W: https://www.blunix.org

AG Charlottenburg, HRB 174906 B
CEO: Brian Wiborg & Peter Thurner

[Peter Thurner]

I see purism was discussed in this thread before - hence nvm :)

[helpp...@vfemail.net]

Anybody tried qubes on Alienware yet?

Quoting qubes...@gmail.com:

> --
> You received this message because you are subscribed to the Google
> Groups "qubes-users" group.
> To unsubscribe from this group and stop receiving emails from it,
> send an email to qubes-users...@googlegroups.com.
> To post to this group, send email to qubes...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/qubes-users/3f643bd6-e539-464f-8879-b3dd26b475d5%40googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.




-------------------------------------------------

ONLY AT VFEmail! - Use our Metadata Mitigator to keep your email out of the NSA's hands!
$24.95 ONETIME Lifetime accounts with Privacy Features!
15GB disk! No bandwidth quotas!
Commercial and Bulk Mail Options!

[cooloutac]

its common sense to me man. Server boards are designed for servers. I gave some tips on how to get something compatible which I think is priority. Another one is to research the board on linux forums and see if its used alot or not or if it has problems.

Its like wanting to use centos as a gaming os. is it possible? probably, anything is possible, but is it practical?

But Jean brings up good points whats "best" is subjective.

But I have to say talking someone out of buying Purism that supports Qubes and free hardware like you want, calling it overpriced, and then recommending expensive as hell server boards and 100 dollar keyboards as a little strange. I mean you balked first.

[Tai...@gmx.com]

On 06/27/2017 02:20 AM, qubes...@gmail.com wrote:

> How does Purism's Coreboot 'wrapper layer' compare to using Lenovo Bios, American Trends etc? Do we know that closed source BIOSes do not contain keyloggers to capture encryption passwords?
>

It moves the trust from for example AMI/Lenovo to Intel, but a real
conspiracy level backdoor would probably be coming from intel.

[Tai...@gmx.com]

On 06/27/2017 12:03 PM, Peter Thurner wrote:

> I'm running qubes on a Thinkpad T520 - the Laptop is way to big in my
> opinion. I build 16 GB RAM into it with a 500GB SSD and it runs qubes
> quite smoothly.
>
> What do you guys think about this Laptop?
>
> https://puri.sm/products/librem-13/
>
> With the i7 and 16 GB RAM it costs around 2k USD. Seems kind of legit in
> my opinion. One has to buy an additional 3G card though, if one wants
> one (and then one wont be able to add a second SSD).

It is a ripoff, you would be better off buying a thinkpad x230 at least
then you would have an open init.
Purisms version of coreboot is a wrapper layer that doesn't init any
hardware, the real work is done by the FSP binary blob.
https://www.reddit.com/r/linux/comments/3anjgm/on_the_librem_laptop_purism_doesnt_believe_in/
They will never be able to reverse engineer ME, and their hardware is
not at all "free" or "open source"

[Tai...@gmx.com]

On 06/27/2017 10:20 PM, cooloutac wrote:

> its common sense to me man. Server boards are designed for servers. I gave some tips on how to get something compatible which I think is priority. Another one is to research the board on linux forums and see if its used alot or not or if it has problems.

"Designed for servers" The IC's are identical to their desktop
counterparts, just with different features burned in.

I want you to explain to me what makes a desktop board and CPU different
from a "server" board and CPU, real technical differences not marketing.

>
> Its like wanting to use centos as a gaming os. is it possible? probably, anything is possible, but is it practical?

CentOS and fedora are literally the same thing, what do you think makes
them different?

> But Jean brings up good points whats "best" is subjective.
>
> But I have to say talking someone out of buying Purism that supports Qubes and free hardware like you want, calling it overpriced, and then recommending expensive as hell server boards and 100 dollar keyboards as a little strange. I mean you balked first.
>

For the last time, purism is NOT free hardware.
Whats free about it? Why don't you explain that to me.

I paid $500 total for my setup including the $300 motherboard and I have
actual free firmware, $80 more gets me a great keyboard that lasts 30
years - compared to that a 2K quanta rebrand is simply overpriced.

[cooloutac]

i'm confused, amd is open source? at least you know you won't have compatibility problems with purism, presumably.

[cooloutac]

i only saw it for 475 just the motherboard alone, and I presum compatibility problems with it just cause its not a popular board. 100% libre is nice and all but so is being part of society lol. can you link me cheaper deals? lol 100 dollars for that keyboard.

[Tai...@gmx.com]

The KCMA-D8 MSRP is $315, and the KGPE-D16 is $415 (available on newegg)
- I can't understand as to why you want to convince people to buy a 2K
laptop but $500 for a legitimately free system is considered too much money.
Boards don't have "compatibility issues", chipsets do.. The firmware
configures reference tables like SRAT/SLIT/IRVS etc but it shouldn't be
present or doing anything once you're in an OS. The chipset in that is
physically identical to the one in an AM3+ board you've probably had at
some point so it is quite popular. Irregardless I have tested it and it
works great.

AMD has released a decent amount of documentation on their pre-2013
systems, and it is enough to make firmware ports - they have also
donated time and resources to the coreboot project which makes them a
company worthy of respect - we can only hope they continue with that for
zen.

The average keyboard costs $30 but it only lasts 3 years or less if like
to eat/drink at your desk, and $80 is actually a pretty good deal for
what it is - most mechanical keyboards are $200+. once you type on one
you can't go back.

[cooloutac]

sure 500 dollars would be a great deal for a whole system, but you are just talking about the motherboard and keyboard for 500. seems expensive, especially since you complain about the price of purism.

[J. Eppler]

I have to agree with @cooloutac $ 500 for just the motherboard and a keyboard is very expensive. You have to add the price for at least the CPU, power supply, memory, housing (optional), storage, monitor, mouse to be able to compare it slightly with a laptop.

However, the initial question was what is the best or rephrase the question: "what laptops work well with Qubes OS"? ThinkPad was mentioned a couple of times and Purism. Are there any other brands or options which have not been mentioned until now and are working well with Qubes 3.2 and will work properly with Qubes 4.0?

[pixel fairy]

On Tuesday, July 4, 2017 at 2:23:56 PM UTC-7, J. Eppler wrote:

> However, the initial question was what is the best or rephrase the question: "what laptops work well with Qubes OS"? ThinkPad was mentioned a couple of times and Purism. Are there any other brands or options which have not been mentioned until now and are working well with Qubes 3.2 and will work properly with Qubes 4.0?

many of dell xps and lattitude models work well. their sales droid told me the inspiron 15 would also work, just make sure you get it with an i5.

[cooloutac]

i would double check the hcl list though, for example most the xps 15 don't support iommu, but one model does supposedly. very hard to choose for laptop cause the oems don't really give you a bios manual i don't think?