Some questions from a newbie

[marlionso]

Hi everyone, I’m a new Qubes user(hopefully) and will appreciate if you could assist me with some technical and non-technical questions I have.

Non-technical:

1. So in here: Qubes Partners | Qubes OS it says “(none)” sometimes as a source of contribution, does it mean the contribution is done from individual, anonymous source or what exactly does it mean?

2. Does the core team are volunteers or full-time employees?

3. How many active users there is who use Qubes as their main? Is there any data on this?

Technical ones:

1. I’m a bit unsure what kind of software I should be ok with installing within the dom0. From one side I do realize I increase the attack surface with each line of code from the outside, but in the same time, you guys say it’s ok to install something like KDE as DE inside the dom0.
   Can I install something like htop(any other soft alike)? If not, what the alternative(not for htop, but in general), if I can’t run it within template/appvm?

2. Do I need to disable networking for my sys-usb?

3. Do I need to create separate templates for each service and app or to use one template for many? Because I’ve read here on forum both sides and I don’t really know what approach is more appropriate from perspective of Qubes’ team / official position.

4. How do I disable updates for specific packages within the dom0?

5. How do I disable root in AppVMs, but keep it in its TemplateVM?

[gonzalo-bulnes]

Welcome @marlionso!

@marlionso

Can I install something like htop(any other soft alike)? If not, what the alternative(not for htop, but in general), if I can’t run it within template/appvm?

What you install or not in dom0 really depends on your threat model (what you want to protect, from whom, what are the consequences of you fail / how much convenience you’re willing to sacrifice towards that goal).

Could you elaborate on why you couldn’t run hotp for example in a vault VM (that is an appVM that has no network access)?

@marlionso

Because I’ve read here on forum both sides and I don’t really know what approach is more appropriate from perspective of Qubes’ team / official position.

This too depends heavily on your treat model. (Hint: “more appropriate” to whom, in what circumstances?)

For that reason, you’ll find people on the forum looking for help to set up their own machines in a variety of ways. Granted, the discussion about each person’s threat model is not often explicitely included in the advice folks give them… and many answers really sound much more authoritative than they should.

The Qubes OS team and other folks like me can help you understand the trade-offs involved with different approaches, but you are ultimately the only one who can decide what the right balance is between setting up a system that offers you the right theoretical protections, and a system that you understand well enough not to make mistakes when using it that void those protections in the first place.

In other terms: there can’t really be such a things as a “more appropriate” setup in general. Now, when it comes to your particular needs, I read your longing for an “official position” as a matter of trust. I hear you trust the Qubes OS team to make recommendations for you, they may well be able to do that. @adw regularly reminds that besides Qubes OS development, Invisible Things Lab (ITL, the company where many Qubes OS developers work) has consultancy offerings.

Invisible Things Lab

[gonzalo-bulnes]

@marlionso

How do I disable updates for specific packages within the dom0?

In the same way you would on a regular Fedora installation.

The following post (and the two posts that follow it) provide and example of that:

Default Screensaver (can I change the image back to the old one)

You will need to stop dom0 updates replacing the Fedora xscreensaver. You can do this by editing /etc/yum.conf and adding a line like this: exclude=xscreensaver-base I think that should block updates. (You will get warnings that your xscreensaver is out of date, but that is the price you pay for being cozy) I never presume to speak for the Qubes team. When I comment in the Forum or in the mailing lists I speak for myself.

[fsflover]

@marlionso

How many active users there is who use Qubes as their main? Is there any data on this?

Statistics

@marlionso

I’m a bit unsure what kind of software I should be ok with installing within the dom0.

Can you elaborate why you need some software in dom0? Normally, you do not run anything there, you only use it to manage VMs. See also: How to install software in dom0 | Qubes OS

@marlionso

Do I need to disable networking for my sys-usb?

Unless you have a USB network card, yes.

@marlionso

Do I need to create separate templates for each service and app

It depends on which level of compartmentalization you need. I wouldn’t start from that, it takes a lot of effort to manage many VMs.

[adw]

@marlionso

So in here: Qubes Partners | Qubes OS it says “(none)” sometimes as a source of contribution, does it mean the contribution is done from individual, anonymous source or what exactly does it mean?

It means that no one has contributed in that tier for that year. Any thoughts about how we can make that clearer?

@marlionso

Does the core team are volunteers or full-time employees?

Both.

[adw]

@adw

It means that no one has contributed in that tier for that year. Any thoughts about how we can make that clearer?

For now, I’ve just replaced (none) with [No Partners in this tier] to at least make it explicit until we think of a better solution.

[deeplow]

Hi @marlionso! If you could next time, please consider opening these questions in separate threads. At most you can group some together (questions about team / vonunteers of Qubes OS).

The reason for this is because then you can have a more explicit title (instead of “some questions…”), which makes it both more visible (increases participation) and more findable (for those with similar questions).