Qube Organization

[enmus]

@jpbaiocchi

I used to have a separate password vault qube myself, but I eventually merged it with my general purpose offline qube because I figured: why bother if they’re both offline?

In default setup no qube (template) except dom0 is truly offline. Any template can still contact repositories over qrexec - and that is not offline, so installing software in a template for common purposes increases surface attack significantly. I knew this was coming, and that is why docs recently changed to my suggestion.

Can somebody clarifies how qubes-update-check service works and how dom0 gets update notifications for TemplateVMs that are never powered on?

Thank you for taking this seriously and talking to devs. Thanks to @unman to clarify second bulleted point from my previous post and consequently user (and now obviously wider) unawareness on the case is security risk per se. So - unawareness is risk per se, not not-updated template. That is why I really think several words @adw will eventually add to the docs would definitely increase liability if nothing else. Using outdated with the bugs yet to be discovered KeepassXC in my offline vault i…