You can get a used StarBook MkV for around $500 on ebay. I use it with 64GB as my daily driver and I have no complaints. T480 is a darling in the community because it’s the final model on which you could still disable Intel ME.
Having used both a T470 and a T480 for Qubes OS in the past, I was much happier at the time with the T470. The T480 had better CPU performance, but I experienced multiple hardware reliability issues with it. I’m primarily using a P1 Gen 5 atm. It’s not bleeding edge at all any more. It has a second NVMe socket, a decent fan system, etc. If I was to buy a laptop today, I’d strongly consider a proper GPU for local LLMs, but that’s probably not within the budget constraints you mentioned.
Thanks for the info! I actually looked into StarBook, Purism, and NovaCustom laptops, but unfortunately I haven’t had much luck finding any on eBay. The few I did come across were pretty expensive. NovaCustom also seems to be sold out of most of their laptops, and I’m guessing with the current RAM shortage they probably won’t be producing new systems at reasonable prices anytime soon.
That said, I think I’ve found some better options with ThinkPads, and I’m starting to move away from the T480 after learning more about its quirks.
I did have one question though. What’s the difference between the Quadro M1200 and the Nvidia M2200? Which one do you think is the better choice for Qubes OS?
I’m looking at buying a ThinkPad P51, and I was wondering if there are any of those little nuances or flaws with the P51 like the ones Frankly mentioned about the T480. Also, is there a version of the P51 that can run Coreboot, or is that not possible?
Ive decided to move away from the T480 and instead go with a Lenovo ThinkPad P51 with the i7-7820HQ. What I’m trying to figure out now is which configuration is the better choice for Qubes OS: the Quadro M1200 or the Nvidia M2200?
I also wanted to ask which, if either, has Coreboot support. If I remember correctly, I read that Qubes doesn’t play particularly well with Nvidia GPUs, so I’m not sure if one option is better than the other or if it doesn’t really matter.
I figured I’d ask you since you seem to have a lot of experience with Qubes and Coreboot. I’d really appreciate hearing your thoughts before I pull the trigger on buying one.
When you think about Qubes OS from a budget perspective, let me help you: you don’t need Qubes OS, and you will for sure fall into false sense of security.
Neither, you already know the exact reason:
If you want to read first-hand experience, here are examples:
The Lenovo ThinkPad T480 has Coreboot support, including with the Heads payload:
The Lenovo ThinkPad P51 does not support Coreboot nor Heads.
Thanks for your perspective. I get what you’re trying to say, and I appreciate the reality check.
That said, I still feel like there has to be a good middle ground. I’m not expecting a perfect setup or the same level of assurance as a fully certified Qubes machine. I’m just looking for a reasonably priced laptop that supports most of the important security features and provides a solid Qubes OS experience.
My plan is to start with something that’s within my budget, learn the platform, and then upgrade to a more ideal setup down the road if the opportunity comes up
Also, since everyone has been giving me different recommendations and perspectives, I’ve started changing my approach to what laptop I should buy.
After looking through the list of supported hardware, I originally moved away from the T480 and started leaning toward the ThinkPad P51 with the i7-7820HQ because it seemed like a good balance between price and performance.
However, I asked another user about it, and they pointed out that the P51 doesn’t support Coreboot or Heads. From what I’ve been able to find, that seems to be correct, so now I’m a little confused about which direction to go.
At this point, I’m just trying to look at all my options. My budget is limited, so buying a NovaCustom, Purism, or StarBook isn’t really realistic for me right now. I’m trying to find the best compromise between security, Qubes OS compatibility, and cost. Given my financial limitations, what would you recommend I look at instead?
You can simplify your direction with a yes/no questionnaire that isolates must-haves from nice-to-haves:
- Is Coreboot support required?
- Is Heads support required?
- Is a discrete GPU required?
- If so, are you willing to troubleshoot GPU issues, including black screens after Qubes OS installations?
- Is soldered RAM acceptable?
- Is an Ethernet port required?
My questionnaire responses:
- Yes
- Yes
- No
- No
- Yes
Your responses may be different, and/or requires further filters to isolate what criteria matters to you or not.
Based on my answers, which specific laptop would you recommend? I know the NovaCustom NV41 would probably be ideal, but it’s out of my price range and seems hard to find. Given my budget, would you go with a NitroPad X230, NitroPad T430, PrivacyBeast X230, or something else entirely?
I haven’t read the whole thread but have you thought through the pros and cons of using a CPU that is 8+ years old and not receiving Intel microcode updates ? I had a t480 but moved to a newer desktop due to lack of microcode updates. T430 is even older.
That’s actually something I’ve been struggling with. It seems like there’s a tradeoff no matter which direction you go.
So where would you say the middle ground is? On one hand, I like the idea of Coreboot and Heads on older hardware, but on the other hand, I don’t want to end up with a CPU that’s simply too old. That’s what so many people in this thread have been pointing out from their own perspectives on security and Qubes OS.
If you were trying to strike a balance between modern hardware, ongoing security updates, and a good Qubes OS experience without spending a fortune, what laptop would you recommend?
The pathway is clear from my perspective:
Lenovo ThinkPad T480, then scale up. Coreboot and Heads become optional, but what matters is that you get to use Qubes OS in a cost-efficient manner. At any time after hardware acquisition, you can decide to optimize the boot firmware situation if needed, or simply transition to NovaCustom + Dasharo once your budget permits.
I would add:
Do I trust the HAP bit disablement?
The code is still on the flash chip because modern CPUs can’t boot without it. (Which would cross off all the newer machines like Star-Labs, and the Clevo)
P.S You may also look into the AMD Microcode signature verification vulnerabilities (Starbook) and the Clevo Bootguard key leaks that could mean even Dasharo / Coreboot may have issues trusting the boot chain.. (This was a while ago, I don’t know where that went, firmware malware could be signed by leaked keys)
That’s why I’ve been going back and forth on this. The more I read, the more it seems like every option comes with its own set of tradeoffs.
With all of that in mind, what would you consider a good middle ground laptop? A lot of the recommendations I’ve received, like the StarBook, NovaCustom, and Purism, are either very expensive, hard to find used, or no longer readily available because of parts shortages and limited production.
Given those limitations, what laptop would you personally recommend for someone who wants a solid Qubes OS experience without spending a fortune?
I don’t know but you you started with the question:
Is the ThinkPad T480 still the best choice for Qubes OS, or is there a newer model?
Maybe that answer is yes, for you 
?
You do not have the financial luxury to explore options unless you are willing to hold off purchasing hardware for an extended length of time.
Thanks so much for all your help, and thanks to everyone else who took the time to share their advice and experiences. I really appreciate all the different perspectives. They definitely gave me a lot to think about.
For now, I think I’m going to go with the ThinkPad T480. Given my budget and the current hardware shortages, it seems like the most practical choice for me at the moment.
I’ll definitely keep an eye out for a good deal on a NovaCustom or a StarBook in the future. If I happen to find one at a reasonable price, I may upgrade down the road. Thanks again, everyone!