Laptop buying advice (turned into ramble)

User Support Hardware Issues
1

TLDR: What is the most secure supported laptop in EU under 1K USD (or 900 EUR)

I looked over some posts, and considering QubesOS is supposed to be one of if not the most secure desktop systems, the hardware advice seems pretty shit.

I know about HCL and Certified Hardware:

  • HCL - kinda messy (where filter) and IMO with no proper info about firmware security. Is there some list of devices where you could either flash/sign EVERYTHING yourself (and the firmware is good up to date with ongoing updates all the good stuff), or have a trustworthy manufacturer/seller and don’t cost an arm and a leg? I’m currently learning about GrapneneOS, so please excuse me if I get something wrong, but newer hardware/firmware should generally have better security, right?
  • CH - sold out/no longer available or very overpriced from what I saw. Some device links there are literally just internet archive links (╥﹏╥)

Can someone please give me some UP TO DATE guide on where to start? Also could QubesOS devs maybe, like, get in touch with knowledgeable volunteers to make everything more user friendly PLEASE?

With the shitshow internet/technology is becoming, more and more people want private devices. Maybe, if they like released their own hardware (something like framework, or made a partnership with framework or something idk) and made it at least close to as user friendly as grapheneos webinstall is, the donations would go up a lot because more users? Maybe worth considering this but idk I’m still new to Linux (in terms of knowledge).

Also if I bought the very expensive laptops with Qubes preinstalled, how can I know there isn’t some preloaded shit? is there some sort of Auditor like this?

2

I know its probably not the answer you are looking for, but to future-proof my investment, If Qubes / Xen worked on ARM (I know xen now does so is it just a matter of time?) I would, personally think seriously about an ARM device.
You are right but its not the “advice” its just the options are really limited.

Ultimately we would want something with open-sourced user controlled firmware, (stateless if possible).
There is a big gap and nothing really fills it 100% yet.

3

It depends on your threat model.

The Qubes OS news page, reverse chronological order:

Differential analysis against the source code.

4

Oh alr thanks!

5

Dodoid's Computing Freedom Table - DCFT

I don’t see a single green under cpu microcode, and I assume the older stuff without microcode is for security useless today because it’s simply old. Even on a 100% open source firmware device with QubesOS, the security could be shit if there are exploits found by third parties that aren’t reported/patched. This spreadsheet is nice, but how is it relevant?

It depends on your threat model.

Elaborate please, WHEN could older hardware be better for security I don’t understand.

The Qubes OS news page, reverse chronological order:

How does that help me easily choose the best current hardware? Should I just go by newest mention (of gpu cpu mobo/laptop) or do I have to study it, and if I do, why couldn’t people like you just make an updated list to save everyone else time? Don’t get me wrong it’s great info but it’s a lot if someone just wants the best current hardware (or best under 2000/1500/1000/800…, that could I guess easily be filtered out if some auto updating database based on seller websites was made, I believe for a database expert {NOT me} this should be easy work with little maintenance).

Differential analysis against the source code.

How long does it take for someone with only basic shell skills doing something like that for the first time?

osresearch .net/

looks complicated

Verifying signatures — Qubes OS 4.3.2 documentation

Isn’t this only for .iso, and if so, I thought the only reason someone would pay for preinstalled system is that it’s already set up and the person doesn’t have to fix many bugs/configure many things. Is that the case on Qubes certified laptops? Because if so, I don’t think you can easily verify already set up system without going through a lot of code, so the easier option seems to verify the .iso and then set it up yourself, which kinda defeats the point of paying for the setup.

Also mind sharing current QubesOS signatures? :upside_down_face: (master and release) I think I’ll soon try it on one thinkpad 2 Lenovos and 1 desktop (in winter there’s free time for me)

6

You asked for a list of devices for flashing/signing everything, that is the list.

Vendor vs. user firmware, you either accept what they give you, a community-maintained variant, or you hand roll your own security solution.

By latest Qubes-certified model:

Up to you.

I am not interested in being a maintainer for anyone else.

No authoritative reference to what basic qualitatively/quantitatively means, so I cannot sufficiently answer the question.

No, git commits as well.

ISO/Torrent:

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE8/o/mdYoH3s6Pl6HHD2bYn8/raQFAmq/HNkACgkQHD2bYn8/
raSy6Q//UUhqSoHnj6Y4PHaxL1+tT7IxQVpgcFF8fkEEBN6Vf8kfTajf0DAgtR8d
PCOXCcYkT3dizH1qFFvdq3Sx7rr0vX2WfOeubWKfricNLQ9CjMHljDu0U81HlcLv
OjaAeQwNbAlLt+RB7QS9z5O3Ps6yNhd8GZXlA8QjVZOF76FOFZBvQdUEJ0zxPcpd
/rMTJnjVaFaBgLq5gIviQN0hVJlWB561LgM96qBNwxI+0fV+O9x6Dv0qB44Uh5mZ
VJkFYeq1q7+yPfC3sKaeEcX1VWZfrqOOE9GB8l6Ss3MgAR6AaQOg0wDS8iFyuFjS
15q+FhYkRTuL4oE3j2l28JnEvKLY4VHTfjWDYE4/L+3hz7ntFfFO0Psqwqa+Cxav
lRAoLXktDcSHg86z2lHKeWxy26eKQUsC+h3BwwiloeLxSBTrhdnaVJ8lYaLZeH64
nSVEIlgdbLqR78ukUGBCG5GrWB80gwmHWWCEudOhS+0Efz2jz94v2OT2F54v1u5Z
oa0WBi0vjbbeZ+pSnafG4D5Sik5Py1yqKRYDusR7qBKTWzHEwisWfzvb3Kt4wlHk
0U3+MdEXuclmfju+h57p2ViYu3Z4VuPfcovOtvT4kA+WC0n7rEI39tBKPRL8S55x
BvTyLm5JsBV/sVRR6ISTksG48UTOHQ9CJZwYwWCOF7Exk48X8bw=
=MDar
-----END PGP SIGNATURE-----
7

Oh my bad I think I meant list of best current QubesOS devices, poorly worded.

Yes, but especially now with all the AI exploits, I don’t see how you could keep up with it, and community maintained would

  1. need to be only for some hardware, so it can be quickly enough updated, and
  2. have sufficient hardware security. That’s the reason pixel 7 and less is not recommended, and pixel 10 is currently the best (google fucked up 11s), because no update can fix the hardware

Soo is there some rule that every newer certified hardware has to be better than the rest oor…?

While I understand this, if you (and others) already learn this stuff for your own need/maybe even job, it wouldn’t be that much work to write like 1-2 paragraphs a day and every time something important changes just updating your “public qubesos notebook”. Shouldn’t that take, like, 5 minutes?

basic proficiency with Linux terminal on cachy/mint/mx and copying install scripts - I know for example what if else or echo does :sweat_smile:

Thanks!

8

The closest list is the Qubes-certified hardware, since all of them will be supported until Qubes OS 5.

Five additional requirements:

  1. SLAT support
  2. Open-source boot firmware, including SMM interface code
  3. Proper DMAR ACPI table construction
  4. Supports non-USB input devices (e.g., via PS/2) or has a separate USB controller that is only for input devices
  5. Does not have any built-in USB-connected microphones

No learning, zero need and not a job.

Hard to rule a decisive verdict, but if you want a simpler solution, reinstall Qubes OS.

9

I know and the 5 requirements are nice, but the devices probably have some important differences between each other in terms of security, right? So if I for example wanted something cheaper than the 2 newest ones (Starbook Horizon and StarFighter), do I just have to do a few hours of research to decide properly or has someone already done it and posted the results?

I really don’t mean to be rude, but what about the time you just spent answering me? Aren’t you just doing it to help people with Qubes?

Then, again, why is there even an option on some sites to pay to have Qubes preinstalled? I don’t see the point in that.

10

Firmware as already stated, and to be more specific, payloads:

  1. EDK II
  2. Heads

And the vendors that maintain them, Star Labs, 3mdeb, or community-maintained by @Insurgo.

The former, everyone has different priorities.

Not necessarily, my technical experience extends beyond Qubes OS into firmware and hardware, so I get to freely discuss all three in holistic unison within this topic. The moment any topic becomes specific to Qubes OS only, I usually let the rest of the community handle it instead.

Qubes certification requirements:

And value-added services, for example, NovaCustom claiming to use the installation charge to support Qubes OS development, in addition to customizing the keyboard to use the Qubes OS logo in place of the Super key.

11

I believe newer hardware is generally more secure too, but there are exceptions. For example, I remember that the Pixel 11 dropped the MTE feature that was available on the Pixel 10.

I’m also still using an old Lenovo ThinkPad T430. Interestingly, because it’s an older model, I’m able to avoid the issue discussed here: ALL dTPM BASED PLATFORMS SHOULD BE CONSIDERED VULNERABLE FOR NOW · Issue #2256 · linuxboot/heads · GitHub

For now, I’m holding off on buying new hardware until this issue is addressed in future hardware generations.