Sharing my checklist for buying a laptop to install Qubes

[adw]

@oijawyuh

Ability to update BIOS via USB (.cab file for a self-updating BIOS or an ISO bootable USB), without giving tbe BIOS internet access and without needing live boot or dual boot. Laptops regularly update their BIOS, sometimes with severe vulnerabilites. You cannot perform BIOS/firmware upgrades from within Qubes. Some vendors provide for updates only via Windows or Linux. This is to avoid. I was disapointed to read that system76 BIOS update requires POP OS. These are some posts of how challenging firmware update can be:
Updating the firmware when using Qubes
What is a suggested way of updating BIOS firmware?
HCL - System76 Darter Pro (darp8) (2)

I don’t necessarily agree, for the reason explained here:

HCL - System76 Darter Pro (darp8) (2)

FWIW, as suboptimal as this firmware update situation is, it’s still better than the situation I was in with my ThinkPad. In order to update the BIOS on that, I had to download a file that I had no way of authenticating, use a Perl script that I had no way of authenticating in order to convert it into the appropriate image type, copy it onto a USB drive, then boot from that. At least now I’m not manually downloading all sorts of untrusted files and running scripts I found on the Internet to conv…

In other words, just because you can update the BIOS offline via USB doesn’t mean it’s automatically more secure than an online update, since some update blobs distributed for offline flashing via USB can’t be authenticated in any meaningful way, whereas some online update methods can be. If you download an unauthenticated blob, copy it onto a USB drive, then use that to flash your BIOS, you’re still accepting the insecurity of “online updates,” just with one or two extra steps in between (physically moving a USB stick around and copying some files onto it) that do nothing to improve security.