High spec laptop for Qubes OS

[ad...@adammccarthy.co.uk]

Hello,

I currently run Qubes OS on an XPS 13 from 2015 with an i5-6200U, 8GB
RAM, slow NVMe. It can't really handle Qubes OS - it's quite laggy and
struggles to play video on the 4K screen. The CPU and RAM are normally
maxed with a couple of VMs running, even without video.

I'm going to buy a new laptop with a higher spec which should hopefully
handle things well. The following laptops are my final five contenders.
They all have a discrete GPU, which I'm hoping to passthrough to a VM
for playing streaming video (h264/h265/vp9 codecs). Do I have this right
that it would be most efficient to use the Intel GPU in dom0 and the
discrete GPU in the VM? I also do a lot of scientific computing, so it's
useful to offload some computation to a GPU via CUDA.

I get the impression from the HCL that they should all work fine as long
as I replace any non-Intel wifi m.2 sticks with an Intel 8265. Do you
have any thoughts on whether one would be more appropriate than another?

Dell XPS 15 9560 (2017)
Intel i7-7700HQ Quad Core
32GB RAM
512GB M.2 NVMe
Intel + NVIDIA GTX 1050

Dell XPS 15 2018
Intel i7-8705G Quad Core
32GB RAM
512GB M.2 NVMe
Intel + Radeon RX Vega M GL

Dell Precision 5520
Intel Xeon E3-1505M v6 Quad Core
32GB RAM
512GB M.2 NVMe
Intel + Nvidia Quadro M1200

Lenovo P51
Intel Xeon E3-1505M v6 Quad Core
32GB RAM
512GB M.2 NVMe
Intel + NVIDIA Quadro M2200

Razer Blade
Intel i7-7700HQ Quad Core
16GB RAM
512GB M.2 NVMe
Intel + NVIDIA GTX 1060

Thanks,
Adam

[Tai...@gmx.com]

I suggest a lenovo W520, as it supports coreboot with open source hw
init and me cleaner (which nerfs but does not disable ME - it is
impossible to disable ME, dell/purism are lying) you can also use an
egpu for additional graphics power and install an ivy bridge processor
for better power figures.

I would also look in to the TALOS 2 (OpenPOWER9) which is a very high
performance owner controlled workstation with libre firmware for both
the board and BMC (even the microcode is owner controlled and has
documentation supplied, there is absolutely no hardware code signing
enforcement).
POWER is now the worlds only owner controlled performance cpu arch due
to both intel and AMD adopting black box supervisor processors and
hardware code signing enforcement.
https://raptorcs.com
It also supports CAPI and PCI-e 4.0, which I imagine might interest you.

Notes:
There isn't much point using qubes with hardware that has ME/PSP,
especially newer hardware that doesn't have open source init (ex: what
you listed and of course the faux-libre purism laptops)
"Gaming" or "Workstation" laptops end up being a pain in the ass to
carry around so if you don't really need one I wouldn't get one, or get
a lower power device that supports an EGPU setup.
You can't pass through a laptop GPU like that as both the iGPU and dGPU
considered a primary video adapters - you would have to purchase an eGPU
if you want a GPU in a VM and you also need a secondary usb controller,
monitor, audio device etc.

[vel...@tutamail.com]

I think a Lenovo is the way to go...the Qubes developers use them, the X1/Gen5 was mentioned as being popular with them. I googled and Max Ram is 16, however I went from 8-12 and more then satisfied with improvement. I wanted the X1 but thought it was out of my budget and thought I would look too cool using it:)

gmx.com...your comment:

> Notes:
> There isn't much point using qubes with hardware that has ME/PSP,

Is the ME/PSP risk more from a Governement/Intel threat or are the vulnerabilities with these features available to other threat vectors as well? Would appreciate your thoughts...

Thanks again Qubes team...

[Yuraeitha]

I'm not too familiar with those particular models.

As for GPU passthrough, I'll second what Tai...@gmx.com said, currently it's not possible to do what you seek with discrete GPU's in the way you described. But keep in mind that Qubes 4.1. is planned to include a new approach to graphic pass-through for single AppVM's, without comprosmising security, which is exactly what you just described. In other words, Qubes 4.1. may include this feature. If you're interested to know more, then check the roadmap/github trackers. Also if you instead go down the eGPU road (which may not work in the end anyway), then you should probably get a computer with Thunderbolt connection, to allow for the large transfer of data which USB 3.1. cannot fully handle. From memory, USB 3.0 is around 5 gbit, USB 3.1. is about 10 gbit, and Thunderbolt can run up to 40 gbit (check Thunderbolt versions too). Also be sure you don't just assume that USB type c ports include Thunderbolt comparability, most of the early ones don't. It's only some recent 2018 laptop models that started to include USB/Thunderbolt type 3 hybrid ports. Before 2018, it was mostly only Apple/Mac's. If you want eGPU (untested on Qubes as far as I know, but in theory it might work), then you would want high transfer speeds. Probably minimum USB 3.1., but preferably 40 gbit Thunderbolt (get newest Thunderbolt version and be sure it has enough PCI connections tied to it for maximum transfer speeds). Also note that Thunderbolt isn't well supported in the kernel yet, I'm not sure which kernel includes it, but make sure you research this too if you need Thunderbolt.

You could consider getting the same laptops most of the core Qubes team uses, the Carbon X1 gen5. I believe it has Thunderbolt too? But even the cheapest version of this laptop is rather on the expensive side.

You could also go a bit cheaper down from the Carbon X1 gen5, i.e. get the Lenovo 720s instead or something along those lines. (I did not test or see reviews on the new Lenovo 720s, please ensure you do further research on it first. Be very critical.).

Generally I agree that free open standard hardware is important and something we really, really need, but it may just not be feasible for normal users just yet. Getting W520/TALOS may work for some, but it won't work for everyone. This depends on ones needs, and what sacrifices you are content in making (for example can you sacrifice aesthetics, look and feel?).

Qubes OS on normal hardware (fulfilling current security hardware requirements) is still a much more secure alternative than Windows/Mac/Linux OS's, even on compromised hardware from i.e. Intel/AMD/etc. I agree there still are very big security/privacy problems in hardware, there definitely is. But all things considered, if you're not trying to be immune from state-level/advanced hacker attacks, then it may be too extreme to go that far just yet. Unless of course, you are a high profile target, or even a medium-level target. Don't piss off, or grab unwanted attention of dangerously resourceful people. If you're a normal user, and you don't grab unwanted attention, then you should be okay in this time and day, however, that may change down the line as attack vectors improve and advance, and increasingly become mainstream for less skilled hackers to use. At which point, it's not the few handful really skilled hackers you need to worry about, but script kiddie "hackers" around every city-block.

Frankly it's impossible to get the perfect hardware to our desires. Whatever your needs may be, you need to take everything into account. The current situation however, I'd think if you're low profile (normal person with no unwanted attention), then you should be fine from a security perspective, with most laptops that meet the current hardware specifications.

It's the same if you climb Mount Everest or venture into a wild jungle, no matter how much you prepare, there will always be risk. There are no perfect hardware, while we can do better, currently we are heavily limited.

[vel...@tutamail.com]

I know they were volunteered recalled but could be an opportunity for good refurb pricing...

[Tai...@gmx.com]

On 02/24/2018 11:50 PM, Yuraeitha wrote:

> Qubes OS on normal hardware (fulfilling current security hardware requirements) is still a much more secure alternative than Windows/Mac/Linux OS's, even on compromised hardware from i.e. Intel/AMD/etc. I agree there still are very big security/privacy problems in hardware, there definitely is. But all things considered, if you're not trying to be immune from state-level/advanced hacker attacks, then it may be too extreme to go that far just yet.

Why not have max security all the time? It isn't difficult.

Besides if the TALOS 2 isn't successful it will be the end of high
performance owner controlled hardware, so maxing out today is important
so you will be able to tomorrow.

> Unless of course, you are a high profile target, or even a medium-level target. Don't piss off, or grab unwanted attention of dangerously resourceful people.

"Avoid pissing people off" is bad advice and simply no fun - if your
security plan counts on that then you don't have any security at all.

> If you're a normal user, and you don't grab unwanted attention, then you should be okay in this time and day, however, that may change down the line as attack vectors improve and advance, and increasingly become mainstream for less skilled hackers to use. At which point, it's not the few handful really skilled hackers you need to worry about, but script kiddie "hackers" around every city-block.
>
> Frankly it's impossible to get the perfect hardware to our desires. Whatever your needs may be, you need to take everything into account. The current situation however, I'd think if you're low profile (normal person with no unwanted attention), then you should be fine from a security perspective, with most laptops that meet the current hardware specifications.

I would argue that the TALOS 2 is perfect, it is the only system that
has freedom, security and performance - you could even play videogames
on it if they were compiled for POWER.
Its featureset and performance are much better than what intel and AMD
are selling rather than being simply equivilant - it isn't at all
"heavily limited".

A wintel skylake system "meets the current specifications" but I could
cause a commotion and steal your encryption keys while you are
distracted by plugging in a USB debugger because intel "forgot" to
disable that feature in shipping chipsets.

> It's the same if you climb Mount Everest or venture into a wild jungle, no matter how much you prepare, there will always be risk. There are no perfect hardware, while we can do better, currently we are heavily limited.

I run open source firmware on all of my computers and I sacrifice
absolutely nothing - I play new games at max settings in a VM on my
KGPE-D16 and if I wanted to I could install OpenBMC for remote lights
out access just like on a mainstream proprietary system - it is feature
equivilant.

I highly doubt that anyone here would prefer silly apple aesthetics and
total lack of features/expansion ports over a secure functional computer
and I for one prefer the industrial designs of the older thinkpads and
latitudes.

On 02/24/2018 11:49 PM, vel...@tutamail.com wrote:
> I think a Lenovo is the way to go...the Qubes developers use them, the X1/Gen5 was mentioned as being popular with them. I googled and Max Ram is 16, however I went from 8-12 and more then satisfied with improvement. I wanted the X1 but thought it was out of my budget and thought I would look too cool using it:)

The W520 supports 32GB, the T420 and X230 16GB.

The W520, T420 and X230 (with x220 keyboard) are all decent mobile
workstation performance choices and they support egpu via expresscard.
The G505S is more free (no ME/PSP) but it doesn't have expresscard and
the build quality is not as nice.

>> Notes:
>> There isn't much point using qubes with hardware that has ME/PSP,
> Is the ME/PSP risk more from a Governement/Intel threat or are the vulnerabilities with these features available to other threat vectors as well? Would appreciate your thoughts...

Rumor has it that signing keys for all ME versions and local HECI
exploit mechanisms are being traded on obscure internet forums and being
used to attack the usual targets (fortune 500, journalists, political
types etc)

I highly doubt you I or anyone posting here is important enough to get a
specific exploit package targeted to us by a government actor - you
gotta have something worth stealing such as industrial processes,
proprietary code to some important program, blueprint etc, for instance
the chinese government has many hacking teams dedicated to industrial
espionage but just because you aren't a necessarily a target doesn't
mean you should support the makers of non-owner controlled hardware.
> Thanks again Qubes team...
I am not a qubes team member - they have better things to do than tech
support but I don't.

[awokd]

On Sun, February 25, 2018 1:52 am, Tai...@gmx.com wrote:
> You can't pass through a
> laptop GPU like that as both the iGPU and dGPU considered a primary video
> adapters - you would have to purchase an eGPU if you want a GPU in a VM
> and you also need a secondary usb controller, monitor, audio device etc.

If you plan on passthrough, the GTX laptops should be removed from the
list. Nvidia intentionally cripples their drivers to force you to purchase
their more expensive/even higher profit margin products if you want
passthrough.

Taiidan, I thought the main problem with passthrough on laptops was that
they didn't have a hardware switch to toggle which card is driving the
(built in) monitor? Since the OP is just planning on using it for CUDA and
wouldn't require video out, couldn't it work?

Dell does sell some models of laptops with a partially neutered ME. Purism
and System76 do as well.

You might want to pose that passthrough question to Dell tech. support and
if they can't answer it, see if you can return whichever laptop you select
if it's unfit for purpose and try another.

[Mike Keehan]

On Sun, 25 Feb 2018 01:11:16 +0000
ad...@adammccarthy.co.uk wrote:

> ....

>
> I'm going to buy a new laptop with a higher spec which should
> hopefully handle things well. The following laptops are my final five
> contenders. They all have a discrete GPU, which I'm hoping to
> passthrough to a VM for playing streaming video (h264/h265/vp9

> codecs). ....

Hi Adam,

I use the Dell XPS 15 9560 (2017) which works well, but the Nvidia chip
does not work with the nouveau driver at all (yet - might do in future).
I have not tried using Nvidia's own driver. My screen is 1920x1080,
and handles HD video OK but with the occasional slight tear. CPU use
runs to about 30% avg on a HD video.

Best of luck,

Mike.

[Yuraeitha]

But Adam is asking for laptops here, not desktops, that's why it becomes such a problem. It's not that I disagree so much with you, it's just that there are other perspectives to consider too. While I from time to time learn new perspectives and insight into open standard hardware from you (which I appreciate btw), I also in general tend to criticize perspectives, it's kind of a part of my personality (aka it's not personal), while I remain open to be criticized of my criticism too. That's why I love discussions, it enriches all parties. Just mentioning this so that I'm not misunderstood by being opposing.

In regards to Adams needs, it's true that security and functionality are important, but it's not equally so for all people (although we don't fully have an understanding of his needs, it might be more insightful if he elaborates a bit on it, otherwise our discussion will remain somewhat philosophical). I think we can agree many people, but not all, just want something that works, no further questions asked (dangerous, nut nonetheless). These kind of people also often love aesthetics (not to over generalize too much which can go wrong too, but some kinds of Mac fanboys/girls are like this for example). But it's not something exclusively so for Mac users either, or even all Mac users, but other PC users may have similar traits perspectives and desires as well.

There can also be certain functionality specifications, which may not be available in many laptops, and to add to that, adding specification requirements quickly narrows down the market of available laptops. If you add open standard on-top of that, it becomes even more narrow. It'll be impossible to fulfill all needs. We lack open standard laptops on the market which has the features we need.

While I my self take security seriously too, i.e. I as an example, have worries for a collapsing democracy in the future as technology risk becoming more and more centralized and closed, instead of decentralized and open. Another I as an example have other needs too, for example I do really enjoy a good looking laptop that feels like a high quality build. (That being said as a disclaimer, I heavily dislike Apple products).

Thing is, not everyone views laptops and computers the same way. I think the solution may be to try understand what people want form their devices, and try push solutions that fixes users needs through decentralized open standards, and thereby beating large corporations and their closed centralized technology, at their own game. Qubes OS is one such example, especially with Qubes Air coming in the future, among others.

The concern, I think, is that while it's true that it isn't always the users fault that security is weak, it is also true that it isn't always the hardwares fault either. It's often a mix of the two, where both variables can shift to give a different output in the equation, that being security right.

I don't think we can beat this game by taking away sleek looking laptops from people, it'd be like taking candy from children, they will cry. Before that starts to sound arrogant, I may say that I feel the same too, I'd love a good looking sleek laptop. That being said though, I also take security seriously too.

The OP, Adam, seem to be in a similar situation? I'm not sure if he is. But if he wants best of both worlds (laptops, not desktops), he thereby ends in an impossible situation choosing between two variables, security and user-needs. One factor of the equation has to give in for the other factor, because the equations output is already set (existing laptops on the market right now), and we can only try shift the variables so the equation solves and matches.

For the most part I do agree with you btw, don't get me wrong about that. The enemy I think, is society as a whole, and not just the hardware industry and market. We need to find solutions in society to fix this, and consider issues in society too. The impossible situation Adam seems to end up in here between these two factors, is one such example, we can't fix it, there is no solution right now. He will draw the short straw, just like the rest of us, if we have user-needs which is not covered by open standards. Society seen in a holistic view, with regard to open hardware, needs to change in its views and understanding of it. We can even force the large corporations on their knee's this way, to open up their standards if society as a whole demands it.

Meanwhile though, there is no good choices for Adam in the laptop market. I might be wrong as I don't keep taps on new open standard releases, but as I understand it, we're at least a few years away from a decent quality build open standard laptop? and a bit further away from such laptops with various functional needs.

As such, while it sucks, shoulnd't we recommend him laptops that works better overall between his user-needs and security? For that though, we need a better understanding of his needs though, he hasn't posted about that yet.

[Tai...@gmx.com]

On 02/25/2018 06:06 PM, Franz wrote:

> But does Talos 2 work with Xen? It seems it does not:
> https://www.google.com.br/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=0ahUKEwig_reIlsLZAhXK2VMKHRlvC6cQFggrMAA&url=https%3A%2F%2Fgroups.google.com%2Fd%2Fmsg%2Fqubes-users%2FbqRSuU3T6MA%2Fn9tFozKsAQAJ&usg=AOvVaw2aUCCm88WSdcxkcCqWhZbe
Yeah unfortunately Xen doesn't support POWER and they have rebuffed
advances from IBM and Raptor offering assistance to support it.

I had suggested it as their desired use-cases isn't really possible in
qubes, according to various other people it is nearly impossible to
attach a gpu to a qubes VM compared with using QEMU-KVM.

In terms of laptops, the most free is the Lenovo G505S which can run
qubes (no ME/PSP) although it doesn't have an eGPU capability and max
ram is 16GB so the best choice would be the W520 if one wants an eGPU
capable laptop with 32GB max ram.

[Tai...@gmx.com]

On 02/25/2018 06:41 PM, [799] wrote:

> Hello Taiidan,
>
> -------- Original-Nachricht --------

> An 26. Feb. 2018, 00:33, Tai...@gmx.com schrieb:
>
>> In terms of laptops, the most free is the
>> Lenovo G505S which can run
>> qubes (no ME/PSP) although it doesn't have
>> an eGPU capability and max ram is 16GB so
>> the best choice would be the W520 if one
>> wants an eGPU capable laptop with 32GB
>> max ram.

> Depending on the use case I would always also think about battery runtime, something where the W520 fails.
> I would always always think about a x230 which runs so well under Qubes and can be coreboot'ed.
The x230 only supports 16gb ram and he said he wants more.
> Out of interest, why are you not recommending the W540?
Obviously because not only does it have ME it also has no open source
firmware, it also has the crappy chiclet keyboard and you can't swap it
out like one can with a x230/t430 etc.
> I have both (x230 and W540) and the biggest benefit of the W540 is the high resolution display.
> Unfortunately it doesn't support Coreboot and build quality is not as nice as the older x230 series.

[awokd]

On Sun, February 25, 2018 11:33 pm, Tai...@gmx.com wrote:


> Yeah unfortunately Xen doesn't support POWER and they have rebuffed
> advances from IBM and Raptor offering assistance to support it.

Is there a link somewhere to this? I've been searching but not finding it.
I don't see why Xen wouldn't want to increase their user base.

Getting Xen running on power would be the most direct route to getting
Qubes running on it. The other option would be KVM, but that's going to be
Hard because Qubes depends on features that don't exist yet in KVM.

[David Hobach]

On 02/26/2018 04:29 PM, 'awokd' via qubes-users wrote:
> On Sun, February 25, 2018 11:33 pm, Tai...@gmx.com wrote:
>
>
>> Yeah unfortunately Xen doesn't support POWER and they have rebuffed
>> advances from IBM and Raptor offering assistance to support it.
>
> Is there a link somewhere to this? I've been searching but not finding it.
> I don't see why Xen wouldn't want to increase their user base.

Found
https://discussions.citrix.com/topic/358571-installation-of-citrix-xenserver-on-ibm-power-server/

Also http://hcl.xenserver.org doesn't mention any POWER server.
Most people seem to use x86 so the POWER arch is unfortunately not that
well supported.

[awokd]

On Mon, February 26, 2018 5:40 pm, David Hobach wrote:
>

>
> On 02/26/2018 04:29 PM, 'awokd' via qubes-users wrote:
>
>> On Sun, February 25, 2018 11:33 pm, Tai...@gmx.com wrote:
>>
>>
>>
>>> Yeah unfortunately Xen doesn't support POWER and they have rebuffed
>>> advances from IBM and Raptor offering assistance to support it.
>>
>> Is there a link somewhere to this? I've been searching but not finding
>> it. I don't see why Xen wouldn't want to increase their user base.
>>
>
> Found
> https://discussions.citrix.com/topic/358571-installation-of-citrix-xenserv
> er-on-ibm-power-server/

I see in that thread "PowerPC development in Xen was short lived. It
stopped in 2010 and the code was removed from Xen 3.3". I wonder what the
reasoning was and the history on it at the time. It doesn't talk about Xen
and Raptor though, they've only been working on Power for the past couple
years or so.

[[799]]

Hello Taiidan,


-------- Original-Nachricht --------
An 26. Feb. 2018, 00:33, Tai...@gmx.com schrieb:

> In terms of laptops, the most free is the
> Lenovo G505S which can run
> qubes (no ME/PSP) although it doesn't have
> an eGPU capability and max ram is 16GB so
> the best choice would be the W520 if one
> wants an eGPU capable laptop with 32GB
> max ram.

Depending on the use case I would always also think about battery runtime, something where the W520 fails.
I would always always think about a x230 which runs so well under Qubes and can be coreboot'ed.

Out of interest, why are you not recommending the W540? I have both (x230 and W540) and the biggest benefit of the W540 is the high resolution display.

Unfortunately it doesn't support Coreboot and build quality is not as nice as the older x230 series.

[799]

[Franz]

On Sat, Feb 24, 2018 at 10:52 PM, Tai...@gmx.com <Tai...@gmx.com> wrote:

I suggest a lenovo W520, as it supports coreboot with open source hw init and me cleaner (which nerfs but does not disable ME - it is impossible to disable ME, dell/purism are lying) you can also use an egpu for additional graphics power and install an ivy bridge processor for better power figures.

I would also look in to the TALOS 2 (OpenPOWER9) which is a very high performance owner controlled workstation with libre firmware for both the board and BMC (even the microcode is owner controlled and has documentation supplied, there is absolutely no hardware code signing enforcement).
POWER is now the worlds only owner controlled performance cpu arch due to both intel and AMD adopting black box supervisor processors and hardware code signing enforcement.
https://raptorcs.com
It also supports CAPI and PCI-e 4.0, which I imagine might interest you.

[Tim W]

No it does not yet it gets repeatedly mentioned to where it makes people think its viable option which it is not.

The op wants a high end laptop which also eliminates all the old coreboot laptops. as he wants a laptop it also removes the asusu amd server board desktop builds. Best bet is lenovo thinkpad with the highest ram and processor combo and ssd drive/s. It will likely give the best compatibility

[Alchemist]

The Razer Blade and the XPS/Precision both have hellish thermal throttling issues. I can't imagine putting a hotter CPU in the 15 with the same cooling will end well.

I have the P51 and the issues around it are regarding the thermal paste, if you do a repaste with kryonaut or similar you'll keep a lower avg temp.

[Tai...@gmx.com]

On 03/02/2018 01:27 AM, Tim W wrote:

> No it does not yet it gets repeatedly mentioned to where it makes people think its viable option which it is not.
>
> The op wants a high end laptop which also eliminates all the old coreboot laptops. as he wants a laptop it also removes the asusu amd server board desktop builds. Best bet is lenovo thinkpad with the highest ram and processor combo and ssd drive/s. It will likely give the best compatibility

I guarantee no one can tell the difference between a quad core ivy
bridge W520 and whatever the latest crap lenovo is selling.

Secure laptop.
Slightly faster laptop.

Pick one.

I am tired of people like you who recommend choices that are literally
dangerous - lenovo adds backdoors and virii to their modern hardware,
and they have done so again and again even after getting caught multiple
times.

[Tim W]

Everyone knows those issues on this board and its understood. Point being he asked for present day high end laptop but at the same time I will agree with you that for most basic use models its not so much the processor as it is ram amount but one thing for sure is you can not recommend a PC that one is not a laptop and two has no xen or qubes support i.e talon/powerpc.

I think its rather moot talking about intel backdoors when its 100% plausible that countless firmwares are backdoored. Its been mentioned numerous times by Joanna Marek and others that at some point at this current point in consumer computing ayou must accept trust. Whatever that point is may be different for different people but unless you are going to make a computer from silicon up and every line of code to include a compiler etc you must trust at some level. Thus the whole idea of picking and choosing which of the possible violation is unacceptable is rather moot

[Tai...@gmx.com]

On 03/02/2018 10:13 PM, Tim W wrote:

> Everyone knows those issues on this board and its understood. Point being he asked for present day high end laptop but at the same time I will agree with you that for most basic use models its not so much the processor as it is ram amount but one thing for sure is you can not recommend a PC that one is not a laptop and two has no xen or qubes support i.e talon/powerpc.
>
> I think its rather moot talking about intel backdoors when its 100% plausible that countless firmwares are backdoored.

Considering that the TALOS 2, KGPE-D16, KCMA-D8 and the G505S's
firmwares are open source and every component such as pci-e addon cards
that aren't are restricted by the IOMMU - again you give dangerous
advice and suggest that people focus on some vague theoretical backdoor
rather than what is a proven fact (that intel machines are owned by
intel, not you) and thus tell them they shouldn't even bother with security.

I mean by those standards why use qubes at all? it probably has
backdoors from all the worlds governments so you might as well just use
windows 10!

> Its been mentioned numerous times by Joanna Marek and others that at some point at this current point in consumer computing ayou must accept trust. Whatever that point is may be different for different people but unless you are going to make a computer from silicon up and every line of code to include a compiler etc you must trust at some level. Thus the whole idea of picking and choosing which of the possible violation is unacceptable is rather moot

So what you are saying is that because someone could have theoretically
slipped some super clever backdoor in to an open source firmware it
doesn't matter at all and why not just get a closed source firmware
laptop with ME?

That is not at all what they are saying.

What exactly are your professional qualifications on this matter? Do you
own at least one computer with open source firmware? If you are so
concerned with your privacy why do you use gmail?

[Tim W]

Wownfine I give up h you ha e read so much into my commemts that I never intnnded whatever. Tell the guy that wants a high end laptop to buy a power pc or a talonto run qubes ofc it. Or to use those ausu boards as that will make angreat laptop. Since every piiece of hardware you use om those syztems is 100% opensource I guess that includes the harddrive firmware w. As this op wants a laptop though please name a single open that meets the standards you speak of with no close sourced firmware and drivers. Becuase no LE agencies in the USA ha e ever used backdoor firmware on hardrives.

Actually do not bother as I am done distruptiong this ops threads with such off topic drivel.

There are plenty of choices for high end laptops that have been suggested or can be found on the compatbility list.

[Tai...@gmx.com]

On 03/06/2018 12:10 AM, Tim W wrote:

> Wownfine I give up h you ha e read so much into my commemts that I never intnnded whatever. Tell the guy that wants a high end laptop to buy a power pc or a talonto run qubes ofc it.

Xen doesn't support POWER, which is why I suggested the x86_64 KCMA-D8
and KGPE-D16 for a qubes desktop.

I always mention the TALOS 2 anyway as despite the fact that the xen
developers haven't released a POWER port of xen it does support hardware
virtualization via POWER-KVM and POWER-IOMMU so one can use it for a
server or secure workstation concept just without the qubes inter-VM
usability enhancements - the TALOS 2 is significantly faster than even
the latest intel/amd server hardware and has many more features for a
lower price than current high end x86_64 server hardware.

> Or to use those ausu boards as that will make angreat laptop. Since every piiece of hardware you use om those syztems is 100% opensource I guess that includes the harddrive firmware w.

Hard drive firmware isn't part of a motherboard; irregardless all of my
suggested systems feature an IOMMU which prevents a rogue drive firmware
from attacking the system memory via DMA.

One could also buy an open source firmware SSD from the OpenSSD project.

> As this op wants a laptop though please name a single open that meets the standards you speak of with no close sourced firmware and drivers.

The novena would fit that category but it doesn't have an IOMMU thus I
suggest the G505S wherein the only DMA capable device that requires a
binary blob for hardware initiation is the video card - system memory is
of course protected via IOMMU-GFX on that model so it can't really do
anything bad.

"X thing is 90% good not 100% so don't bother at all!!!11"

> Becuase no LE agencies in the USA ha e ever used backdoor firmware on hardrives.

They have not, that is beyond their capabilities and costs many hundreds
of thousands to develop for a single drive model - there are many far
easier ways to further an investigation.

[alexc...@gmail.com]

I use an Acer Aspire E5-575G-76YK and went to 32GB of the highest speed and lowest latency RAM that was compatible. I also went to a Samsung 1TB 850 Pro SSD.

This Acer is well known for being a workhorse but most of all, one of the most Linux compatible notebooks out there. I love it. Plan on buying a 2nd as a spare.

[Yuraeitha]

Well the day a proper secure, user owned laptop hardware, which is something not looking like it came from the last decade, has proper thunderbolt and similar tech only available on modern laptops (which I need, in all seriousness), I'll immediately buy and never look back.

Seriously all these scumbag laptop companies out there.... the moment a proper company comes out and offers proper user controlled laptops which also provides a variation of specs and types of laptops, it's byebye to these manipulative scumbag companies.

While many people don't care at all, the amount of people getting fed up with these companies are mounting and increasing as well. It's dangerous if they keep making people unhappy, and it'll only get worse as technology becomes increasingly closer to our brains, and at some point even integrated into our brain, which will undoubtedly happen, and maybe even (probably likely) become mainstream.

So who wants a proprietary, backdoored, error-prone, computer in their brain in contrast to open source, open hardware, which can be trusted? Even before all this, some people who didn't care before, are starting to care now when technology is increasingly getting closer to their lives. Like The Amazon Echo, which is always listening to its environment, and now it's happening to TV's and many other gadgets as well. Eventually even toasters can spy on us.

It'll probably only be a question of time before people smack down on large corporations demanding major change. The question is probably more "when" it'll happen. At which point is enough enough?

Seemingly it also has a cultural effect, like the Chinese people are essentially just rolling over allowing their iron tight government to use new technology to become never before seen scary Big Brother v.2.

But the western world probably won't let it go that far. There are many ignorant people, but at some point, the film will have to crack. We're building a dys-topian society here, and more and more people are starting to realize just that.

Heck we might even see an Elon Musk in open hardware one day, if the problem keeps growing. But right now, laptop hardware choices are rather moot and quite frankly, impossible to find something that serves all primary needs (not even getting to the secondary needs).