I will offer my version of Downloading Qubes more securely for a first install of Qubes.
Explanation for this should be for someone who is less experienced in computer security, than many on this forum.
I presume, “They are all out out to spy on my computer activities.” Maybe some other of my activities, or someone they think I know, as well.
Such a spine chilling word. “They.”
I would start with buying two, or three USB flash drives, still in blister pack, with consideration of buying them someplace no one would expect I go. I would have a computer to devote exclusively to using Qubes. I am guessing that computer likely will accept Windows. So wipe the drive, and do a fresh install of Windows.
Acquire one of the better VPN’s. Yes, I know it costs money. I will not suggest one VPN over the other in this post. This you can do with Tor.
Download one of the later versions of Ubuntu, which I don’t think arouses suspicions, because Ubuntu is often needed to replace some of the sloth and problems of Windows. Also Ubuntu can be , modified used to avoid some of the Privacy issues which are more difficult to avoid elsewhere. My Personal guess is that any software that is large, and meant to be easy for the general public to use, some well intended software might have a security leak. Still, I feel that it is better to use Ubuntu than any, even freshly installed version of Windows with all Updates, to accomplish the download the first install of Qubes.
Install the VPN inside Windows to accomplish the Download. Verify the VPN connection is the one you are on. I want to believe, that having a VPN active on a computer is not suspicious in itself, as some use VPN’s for some things that are quite innocent. I am quite sure that a lot of internet connections can be corrupted if one does not use a VPN or tunnel of some kind. If anyone knows I am wrong I would be glad to hear it. That is relying on the security of a browser alone is enough,
Using Tor, or any of the other types of anonymity services would take forever to download Ubuntu, or even several days to download a much smaller distribution of Linux.
Download Ubuntu, using the VPN. I would have chosen a version of Ubuntu LTS that has been out for awhile. I would read/study the advice on the Ubuntu site about how to verify whether my download is reliable, not corrupted. Likely not complicated, but it is advice which is a moving target, might change by tomorrow morning. Computer Security is often a moving target.
With my verified download of Ubuntu, I would break one of the USB keys out the blister pack wrapping. Kept them safe and secure, right? I would install Ubuntu onto the Key. I have not used Windows to install a Linux Distribution onto a USB Key. I used to use "Balena Etcher.’ No program performs well forever. Ubuntu Forums have a lot of active users, so perhaps best to use their advice.
After you have Ubuntu, (or like a local computer store says, Ubunny) on the flash drive, you can install it to the computer. One must modify the BIOS/EFI of computer to accomplish booting from the USB which has Ubuntu. Recommendations for this are surely on the Ubuntu site. Keep in mind, you will have to use these same modifications to boot the USB key you will have to do to install Qubes.
Install the Flash Drive with Ubuntu onto the computer. Get the appropriate App for the VPN you have, install it. Verify the VPN is working. Personally, I would install the Linux version of OpenSnitch. I am told it drives ordinary people crazy, constantly asking if I would allow it to connect here or there.
Do not use the Ubuntu for real purpose before Downloading Qubes, while using the VPN. Verify the VPN is active and working. So Download the latest version of Qubes in Ubuntu.
Qubes Download is big, this make take awhile on even a fast connection. After your download looks to have finished correctly.
There are several means to verify whether the Qubes download is accurately the correct one. Not so easy for those new to Linux. Some of the instructions are on the Qubes Documentation. Some of the help for installing and using GPG. I would guess the linux newcomer would find help on the Ubuntu site.
After you are satisfied with your having a valid copy of Qubes. There is another verification that Qubes will do on itself before installing. Not sure that qualifies as real security, but just that the download is accurate as nothing is missing. I guess that could be faked by a highly competent government Computer service. I would be sure that the NSA (the United States Computer Security service. Actually “National Security Agency,” or collequially, “No Such Agency.” has thought about trying to have their own version of the Qubes download to slip in. I am also guessing that it is not that easy for even the NSA to insert their own version. But what do I know.
After the download is finished. Verified. User will need to break open another blister pack of a flash drive, install Qubes onto the computer. The newcomer to Linux might find this install vexing. it will require making some decisions of just finding the correct buttons on the install. There is documentation on installing Qubes, on the Qubes site. Just be prepared to spend some time reading, trying. and not feel too frustrated.
I strongly suggest that the user find a way to continue to use the VPN to study issues, and how to resolve issues.
After Qubes is installed on your computer, for most of us that is a laptop. Find a way to install the VPN on Qubes before proceeding. Behind the VPN, do the first update of Qubes.
I would use the third USB key to install Tails to it. That is. “The Anonymous Incognito Linux System.” It is a live version of Linux. Meaning you start it from the Flash drive, it runs from the flash drive. When the computer shuts down. The computer has no memory it has happened. The name of “Tails” is from the fiction book, “Little Brother.” by Cory Doctorow. You will have to make up your own mind.
There are other variations on my instructions. Like use the Live CD of Ubuntu to download Qubes, and before shutting down the Live CD.
I write this hoping a lot of more knowledgeable people will shoot holes in my explanation. I expect it.
For those who live without fear of “They.” Realize that one must not do anything in some places to be taken from storms of ones own life, to a place where agents are trying to earn a bigger salary by obtaining confessions.
Anyway. Halloween is coming soon. Boo. Happy Halloween.