The Hardware Compatability List was discussed on the vpub yesterday, in regards to it being outdated and how useful(or not) it is to non-users seeking suitable hardware. It was futher said that the real issue is out-of-the-box compatability - i.e. there is a problem until Qubes ‘just works’.
This reminded me of my thoughts on Qubes Certification. I have definitely seen written that the original intention was to expand the Qubes Certifiaction program into ‘tiers’ (‘sometime in the future’).
I feel that the Qubes Certification program could be improved by introducing such tiers - e.g:
Qubes Ready/Qubes Compatible (runs qubes out of the box without issues)
Qubes Essential (works with open source BIOS - i.e.: existing standard)
Qubes Plus (existing standard + improved hardware switch requirements)
Qubes Pro (This would be an improved standard - e.g. stateless - but for now I think effort should be focussed on the above, as the existing standard already only has 3 certified products from 2 vendors who are modifying old hardware).
Why?
Well, first we have to be clear on what the purpose of qubes certification is. My assumption is that it is to benefit the qubes community, but also increase adoption of qubes (as the post which explained the intention to create different levels indicated) - not merely to provide a list of ‘more secure hardware’ for users to purchase.
Assuming the above is correct - the current certification program can be massively improved.
The certification program functions by providing an incentive to manufacturers. Currently, there is little incentive for most manufacturers - as is demonstrated by the current state of the program. I believe that the program is not increasing the userbase as much as it could be - particularly given most new users will not want to buy old hardware at a relatively expensive price.
How can it be improved?
Currently, as discussed yesterday, many existing users have gone through the uncertainty of installing qubes on hardware that may, or may not, work. The HCL is not useless, but has its limitations. My suggestion is to prove a ‘Qubes Compatible’ certification to manufacturers who ensure their hardware configuration works with Qubes out of the box.
This is extremely low effort, and I believe there would be an uptake, as:
- Many devices work with qubes out of the box - or with minimal tweaks
- Effort for device manufacturers is negligible - we can provide the simple documentation (e.g. xen.efi tweaks, common firmware compatibility issues) - and provide a guide which the manufacturer gives to users (integrate current work on new user tutorial).
- There is a clear benefit to manufacturers - we could create a marketing pack demonstrating current uncertainty around compatible hardware and demand for modern compatible hardware; qubes has a growing userbase and increasing traction. The cost for this certification could be relatively minimal.
(Ideally, we would pilot this with manufacturers whom have an overlapping userbase - i.e. system76, purism, framework, raptorCS, etc - and we could then use this pilot to market to other manufacturers).
This is a positive cycle of growth, the more certified hardware, the more users. The more users, the more certified hardware. For those who would like to see an improvement in the minimum standard (as I think we all would), this cycle of growth would enable us to gradually improve the minimum requirements (e.g. Qubes Compatible would require coreboot/open-BIOS).
Why Qubes Compatible AND Qubes Essential?
Qubes Compatible is necessary, IMO, to increase adoption - raise awareness (and repeat). Qubes Essential - i.e. coreboot/open-BIOS compatible - is IMO essential as many models are now supporting, or looking to, coreboot. System76 for example.
If Open Source BIOS is becoming increasingly prevelant, why the need for ‘Qubes Compatible’?
There are manufacturers whom are not adopting open source BIOS, or are definitely dragging their feet. I believe offering a low-cost option to them, with tangible benefits, would massively benefit the qubes community, by raising awareness and adoption (positive cycle of growth), without harming the integrity/value of the certification program as a whole. IMO ‘Qubes Compatible/Ready’ is clearly distinct from ‘Qubes Certified/essential/pro/plus’. If Qubes can take advantage of this term ‘Qubes Compatible’ it seems only a positive, as people will ask is it ‘Qubes Compatible’, and manufacturers without certification will then have to clarify this e.g. ‘it supports it, but not certified’, which of-course turns most consumers away when they hear such things. (In a way, like thunderbolt certification).
Notes on the current certification process
I am sure this has been raised before - the current process on the website I think is off-putting for manufacturers.
Currently the program, from a manufactuers perspective, doesn’t have much benefit to them.
Seeing that they have to send 2 units which they have to offer in the exact same config for at-least a year is not encouraging.
I understand why this is here, given current qubes team resources - but this is part of the problem I think. Embodied by ‘we will need to charge a consulting fee for more in-depth work.’
The community has a lot of time for Qubes, and I’m certainly willing to contribute to documentation/adapting existing for manufacturers. I think we as a community have the resources to provide enough documentation to manufactuers such that the certification program can certify a ‘model’ of a device and the T&Cs of certification mean the manufacturer can market different configs (i.e. wifi card, screen, BIOS version), as compatible - but they have to ensure they are, and can be penalised if they’re not.
Please see:
No longer listed on the Qubes website's certification page? - Other OSes - Purism community