Short list of laptops/desktops that work well with Qubes OS

Thank you for the update! I still don’t understand, why “developer-tested” is relevant, whereas “vendor-tested” isn’t. In both cases, there is no official recommendation/guarantee here, just the community recommendation, right? Don’t they both mean in principle community-tested (given enough HCL reports)?

Also, those “developer-tested” laptops, in my view, (when alone) make unfair advertisement to Lenovo, who multiple times compromised security and privacy of the customers – something against the Qubes values.

I still don’t understand, why “developer-tested” is relevant, whereas “[vendor-tested]” isn’t.

By using Qubes OS and being part of this community I am implicitly and explicitly placing a huge amount of trust in Marek and the development team. There is just no helping it. If I don’t trust them, I might just as well use Windows. Of course it is relevant which computers they are using to test Qubes OS. Naturally bugs will be found and fixed on those machines first. Note that this has nothing whatsoever to do with Lenovo or placing any trust in them.

On the other hand, all I ever heard about Purism so far is: they got certified and then the certification needed to be removed because of hardware changes. @Michael was open to restart the process with them and aborted it again because he got reminded how Purism “as a company” works. All this does NOT imply bad intent on either side, but that at least one side is more or less flying by the seat of their pants. Which might be OK in some circumstance, but not to certify hardware. So this is explicitly NOT about trust. Nobody here thinks that Purism is malicious as far as I can tell. They have just decided to develop hardware in a way that does not work well with getting certified.

Qubes OS doesn’t even come preinstalled and all we have is one sentence on their website saying that they test their hardware to work well with Qubes OS (which version?, how often?, what process?). To consider a “vendor-tested” comment at the very least there would need to be a dedicated page on their website showing which version of Qubes OS was tested against which version of their hardware and with which result. And what “tested” means in the first place: what was tested … just that it installs?

That’s why community submitted HCL reports offer much more insight and confidence than a vendor claiming to test their hardware on their website. Makes sense?

1 Like

well my suggestion near the beginning of this thread was to remove “developer-tested” since I don’t think it is very relevant, and instead leave certified and community-tested.

I think Andrew did a great job of incorporating this new community-tested list into the website so that it shows up on a lot more pages than the “developer tested” content, and maybe we can decommission the dev-test list at some point. i would love to know if it accurately reflects the current hardware used by the dev team (my guess is there is additional hardware being used). this would also reduce the need for dev team to keep such a list accurate & updated, and if they are using some machine not on the community-tested list than they can submit an HCL and get it put on the list.

i think focusing on integrating & promoting the community-tested list is the most productive avenue, since it is much more thorough and informational than the dev-tested list, and avoids the “advertisement” feelings you have @fsflover with the dev-tested list.

3 Likes

Good points @michael.

I think there is some extra value in knowing which machines the developers use. It’s a simple calculation: if there is an issue with those machines, it will annoy the devs and most likely get fixed sooner than later. :wink:

If you want to decommission the page on the website that makes a lot sense. However, do you see an issue with calling out explicitly on the community list if a specific machine is being used for testing by the core team?

I think having it be mentioned on the community list is a very fine idea for the reasons you mentioned. I just like it embedded within that list (which is more up-to-date and informative) rather than its own “thing” which feels a bit lost in the website content - but i don’t have particularly strong feeling about it.

and thanks for all your work on the community list, it is really excellent and i’m hoping others find it helpful! maybe you want to share with qubes-users mailing list?

Done.

I asked Marek about this above, but I guess he’s too busy to reply. I’ll just go ahead and decommission it. We can always restore it later, if needed, and of course all current content will forever be in the Git history.

Done:

@Sven, the old https://www.qubes-os.org/doc/hardware-testing/ URL now redirects to https://forum.qubes-os.org/t/5560, so I’ve edited the wiki post to un-hyperlink the “developer tested” comments and documented this change in the history log (revision 35).

3 Likes

Excellent!

OEM vs. Vendor

Currently the List sates “OEM” in the first column (e.g. Lenovo, Nitrokey, Librem). I would suggest instead using the word “Vendor”.

Original Equipment Manufacturer (OEM), although technically more precise, may lead to more confusion. And even this is not correct because for Nitrokey’s laptops it’s arguable the OEM is Lenovo and not NitroKey… So maybe set it to Vendor (or equivalent) and add a foot-note about it (if justified).

1 Like

Let’s just call in “Brand”, which is also used in the report and quite likely the most precise description.

2 Likes
  • The performance is acceptable for every day tasks (web incl. audio/video, view/edit documents)

Excuse me, can we please therefore delete the 9+ year old CPUs which can’t offer anywhere near adequate performance browsing on basic websites (software rendering).

When I get through researching I’m happy to upload HCLs but think recommending models which have such inadequate performance on most modern software is going to hurt the project. Can we please draw a line at say 6 year old discontinued CPUs / Intel Ivy?

can we please therefore delete the 9+ year old CPUs which can’t offer anywhere near adequate performance browsing on basic websites (software rendering).

You say this based on what? …personal experience?

Can we please draw a line at say 6 year old discontinued CPUs / Intel Ivy?

Ivy Bridge was launched in 2012. That’s 9 years ago.

The only pre-Ivy CPU listed is the i5-2520M (Sandy Bridge). We got many folks running R4.0 on Sandy Bridge CPUs – they are all wrong?

What is “adequate performance”?

When I launch a new qube it takes 8 seconds, when I load a complex website it might take 3-4 seconds until it is rendered. I feel this is adequate for what I am doing and how I am doing it. Do you?

1 Like

Yes, personal experience with X220 and L460 machines. For text editing it is fine. For outputting to a 4K screen and doing any amount of Internet browsing / interacting with web3 they are both pretty horrible. A newer CPU would be better, there is a “power user” segment and I’d like to help compile the current top 3-5 laptop choices for them. I thought that is what this thread was meant to do so was surprised to see recommendations for 9 year old hardware.

To be more constructive, the bottleneck seems to be software rendering on older CPUs.

I see you’ve done a lot of work to maintain the HCL, thanks. In your opinion what is the best thing we can do to accommodate power users? I’m going to buy 1-3 decent spec laptops to find a good “daily driver” for Qubes and will submit their HCLs.

Hi @bowtiediguana,

the “community-recommended list” is specifically targeted at inexperienced aka non-technical users needing a computer that “just works” with Qubes OS. Please also consider that the Qubes OS community is global: what might look like a low-end option to you, might be all that is available or in budget for someone else.

This list nevertheless currently contains two options (Librem 14 & ThinkPad P51) that should work well for what you want to do. Also: a power user can be expected to analyze the HCL, do some troubleshooting and workarounds to get their environment going. The Dell XPS 8930 and several System76 laptops come to mind.

Good luck and looking forward to your HCL reports!

2 Likes

" In your opinion what is the best thing we can do to accommodate power users? I’m going to buy 1-3 decent spec laptops to find a good “daily driver” for Qubes and will submit their HCLs."

Thanks for you efforts.

I think part of the issue with using older computers, is that:

  1. They are well known, well tested, well trusted hardware. Older machines have Linux Open Source FOSS, that is well known, well tested. Newer hardware could not have that.

  2. Not the only goal, but an important consideration to having a Secure Computer is having, Core Boot, Disabling of Intel ME Portion that allows a computer to be changed. Allowing for an installation of Heads, Evil Maid attack. I don’t think that is a criteria to be on the, “Works out of Box.”

Later Hardware can not have such well tested FOSS Modules. Frustrating. Many of the hardware manufacturers bow to worship before the great deity M$.

I get your sense of frustration. I have used Qubes on a Lenovo X-230. I also have right now Qubes 4.1 (which is in testing, therefore should not be used in a required trust situation) on an Alienware 17 with a Skylake Processor and 16 GB RAM. The speed of response of the Alienware, is great. Still the basic Firmware which is behind the Boot, was originally written for Windows, and for speed of gaming. Basic Firmware is not for Security.

I like the example. If was a person like Elon Musk, whose job requires frequent traveling while keeping your company information, data, plans secure. Not being afraid of the complication of using Qubes. Then the Security Need of Anti-Evil Maid would be required.

Gee, I bet you knew all this. Thanks for your efforts. I wish I could afford the latest hardware with the best Security options.

If you combine these two points, you should be able to see that an inexperienced user who just wants a powerful machine will have to do a lot of hard work comparing the CPU generations listed in the per-laptop pages (not even listed in the original table). This is exactly why I liked your original approach where you sorted the list by the CPU model. At the same time, an inexperienced user with a low budget would be able to look at the bottom of the sorted list and immediately find affordable machines, too.

1 Like

will have to do a lot of hard work comparing the CPU generations listed in theper-laptop pages (not even listed in the original table).

Ok, I have reintroduced the CPU into the main list but retain the brand/model sorting/grouping to avoid double entires for models. I hope that is a compromise that addresses at least part of you critique while at the same time maintaining the compactness of the list.

To that end I have also made some other visual edits to improve the readability.

Finally, it appears while I was doing that you committed another change linking a discussion regarding @adw’s change of the “developer tested” entires. I couldn’t preserve it without loosing all my work. So I restored your edit with a minor change afterwards. Hope that works for you.

1 Like

Hi @sven & Qubes community.

Thoughts on whether the ThinkPad P15 Gen 2 is likely to work? (20YQ004KUS)

The ThinkPad P15v (20TQ004AFR) is in the HCL Hardware compatibility list (HCL) | Qubes OS

vs

Both have similar Intel integrated graphics, but different Nvidia discrete graphics. Not sure Qubes will use the latter, as far as I know everything is software rendering.

The WLAN is Intel AX210, only the AX201 is mentioned in the HCL, but the AX210 is listed as being supported since Kernel 5.10 Linux* Support for Intel® Wireless Adapters

If someone could have a quick look, I’ll risk a purchase and add it to the HCL if I get Qubes working.

Thoughts on whether the ThinkPad P15 Gen 2 is likely to work?

Re: Tiger Lake U Series Core i5/i7 see qubes-issues #6411

There are 2 positive R4.0 reports with i5-11500 (ASRock B560 Pro4) and i7-1165G7 (XPS 13 9310). Both mention igfx troubleshoot is required.

There are 3 positive R4.1 reports with i5-1135G7 (Lenovo ThinkPad E14, ThinkPad X13 Yoga Gen2) and i7-1165G7 (System76 Lemur Pro).

In the existing P15 report I see two USB controllers, but that doesn’t mean the Gen 2 has them too. The website only lists two ports (not controllers). I bring that up because you mentioned it as a reason that the Librem 14 doesn’t work for you.

Personally I would stay away from Tiger Lake for now. As I mentioned many times before, when using Qubes OS you will do much better going with a 2-3 year old PC. There is plenty of power there, but you will have to go for something preowned or refurbished. The P51 was a bag of trouble when I got it new (company PC) and then over 2+ years it reached the point where it made it on the “just works” list. Don’t know how many other ways I can shout it from the rooftop: “shiny new” and “Qubes OS dom0” don’t go together very well and probably never will.

2 Likes