Conceptually, I love it. I used it since about 2016 until last year, but I had to record some video and use stuff like OBS and it just became impossible (with my skill level) to get working.
I abandoned and went back to Fedora, which is odd as I’d stuck with it through lots of other NVIDIA crap issues and such.
Hopefully adoption increases and one day I can use in a workplace setting.
I’ve been using Qubes about 4 years, and a few things have dogged me as serious enough problems that I often think about switching back to Ubuntu+KVM/VirtualBox.
VPN support: I’m not talking about the useless support built into Network Manager. I mean the isolating proxy VM to make all traffic go through the VPN with no exceptions. This has worked at times, but is extremely unreliable and fragile. This should be Qubes killer app.
Working with attached storage: I frequently need to work with files on NAS or USB devices. Copying them back and forth is often impossible due to the file sizes and time involved, not to mention the wear and tear on my SSD. I’ve been able to attach a couple USB devices to qubes dependent on the filesystem, but what to do about encrypted devices or file shares eludes me.
Custom qubes are not really supported: Making minimal templates for a very specific purpose with minimal attack surface sounds great in theory, but problems with these have been a huge time sink. Undocumented dependencies, which is probably partially Fedora’s fault, odd problems caused by such, and figuring out what magic package, if any, when installed will solve the problem have caused a ton of frustration and wasted time for me.
For me, Qubes does one thing very well - compartmentalize online personas and sensitive activities. Once I need more or need to deviate or customize, there are a ton of sharp edges. If it weren’t for supported Whonix, not needing to duplicate an OS for each VM, and disposable VMs, I doubt I would be able to use it for anything. I still think about whether it’s worth it from time to time.
It was easy enough to set up a qube to mount the NAS. I could even install the encryption program ON that qube. But then as you noted, the files aren’t where they need to be.
I have managed, with a LOT of work over the last two weeks, to figure out how to pass a mount of one of the encrypted files to another qube, which decrypts it and passes on a link to that to yet a third qube–who can mount it into their file system.
I’ve even managed to automate the process…somewhat. But it’s very “fragile,” there are five steps involved (two of them must be done by dom0) and if any one of them goes wrong all hell breaks loose, and I have to manually undo the steps that did happen, to be able to try again. I’d certainly not recommend what I have done for a general user.
Hi @aquser. I would like to reply on two points you mentioned some thoughts. They may not solve your problems, but I will share just in case.
Do you use it with a Debian or a Fedora template? I switched sys-vpn to a Debian template when Fedora 33 or 34 update broke the VPN, and it’s been working well for me.
Again, since I switched some work VMs to Debian, minimal templates are working well.
I use a shell script to enable the VPN and the Qubes firewall settings to reject all traffic not going to the VPN gateway.
This does allow any host using the VPN to access 3 or 4 ports on the VPN getway even if the VPN tunnel is down, but I was too lazy to change the iptables forward rules to only allow the use of the VPN interface.
It’s not a deal-breaker, but for me, not having S3 suspend working properly on some laptops is “mildly inconvenient”. It’s one of those “it would be nice to have” things…
Yes, I know that it’s because of reason that are way beyond the control of Qubes OS, but still, “it would be nice to have”…
Patience, young grasshopper. Qubes will be unleashed on your beast of a machine as soon as we figure out how…
…and with what nVIDIA and AMD have been doing with the Linux kernel, I remian optimistic that it’s only a matter of time before your frown turns upside-down
Neither Debian nor Fedora based templates work for me anymore. I believe it was Debian 10 (not available to me now that I’m on 4.1) and Fedora 33 (EoL) that last worked.
I use a mix of both depending on which is easier to customize for the problem at hand. When updating my Debian 11 templates for 4.1, they became unbootable. I rebuilt one I couldn’t easily switch to Fedora and deleted the rest. I’m now much more selective when deciding to make minimal templates.
Qubes using the internet connection provided by their net qube before it can bring up the VPN will access the internet in the clear. The VPN can also go down or fail in a couple of ways that result in the same. The purpose of a VPN qube for me is that everything goes through the VPN or goes nowhere. NO EXCEPTIONS!
Yes, you remove the forward rules from eth0 in sys-net, and set the firewall to only allow access to the VPN gateway. Then sys-net can’t forward any traffic while the tunnel is down, and you can only access the VPN gateway though the internet connection.
I’m pretty sure you have the tools to do what you ask.
I just confirm the Qubes OS VPN issue. The only how to which worked for me was Using Mullvad VPN in Qubes.
I am pretty sure no VPN description is wrong but some aren’t simply written for newbies. On some “how to setup your VPN” I miss (for coder obvious) …enter this here and there, download you VPN file here, move to… or this is your *crt or *conf…
IMHO that’s the issue right there: “reasonably” is not good enough.
I want security. Maybe I shouldn’t have answered since I am using Qubes, but I am thinking of moving back to Tails at least for some tasks. I prefer Qubes to Tails becasue Tails is unusable for many tasks (e.g. development, in my experience).
In my non-expert opinion sys-net seems to be the main issue with Qubes security. Though something like the Purism system at least seems to have provable protection from BIOS malware, but that still wouldn’t prevent transient attacks on sys-net.
I would like to see more info/tools on Qubes on how to detect and try to mitigate sys-net attacks.
I am assuming that Tails is more secure with regards to network attacks (at the expense of usability) but I could be mistaken.
The thing is, “reasonable” security is all you can realistically hope to achieve as a regular individual right now. Anyone promising you more is probably selling you a bill of goods.
Nothing. I even got to the phase that I’m lazy to fire up my Windows qube to do some tasks I can’t in Linux world, not to mention to revert to some other OS.
I purchased a rather pricey but wonderful laptop that handles QubesOS just fine. But I think the HCL and RAM requirements may impede some. I’ve heard of folks getting away with 16GB but I cannot imagine such a life myself.
and I am working an my automated minimal template setup I need to deal with my VPN setup again. Let’s see if can setup this 