I’m using x230. because developers tested. but too slow. so I want to buy new laptop. Please let me know what you think of QubesOS on your laptop so it can help my purchase.
Personally, I use a ThinkPad T480, and it works like a charm, though if I had to recommend something for a purchase, I’d ask these (off the top of my head):
- what budget are we taking into consideration
- what work will be being done - e.g. something that utilizes lots of domains simultaneously and needs lots of RAM or not?
- does it need to be compatible with Heads, AEM, etc.?
Hardware compatibility list (HCL) shows, which devices people are using and whether there are problems with them. We also have a list of computers recommended by the Community.
2 Likes
Thank you. But what I want to know is if QubesOS is stress-free on that laptop. For example, I’m thinking of getting a T430 i7, but I don’t want to be slow again if I buy one.
Basically I use it for internet and composing music. But I would like to be able to do everything.
This time I want to buy the best one without thinking about money.
For me it is very important to be able to use Heads or coreboot.
It probably depends on tasks that you do on the laptop. You did not specify them in the original question.
Some websites heavily rely on GPU acceleration, on Qubes you need a strong CPU to run them smoothly.
Maybe this could help you a bit: Survey: CPU and VM boot time
Then, just choose the fastest CPU and largest RAM among those that are tested in the Community.
See also:
Get the Librem 14 v1. It is the laptop I use and I already recommended it in another thread.
Also, see my recent Hardware Compatibility List report.
If you need help with your purchase of it from Purism, mention my username, quote, or reply to this post.
1 Like
Notice the t430 comes with several different processors.
Intel uses the terms Core I3, I5, I7 even though it upgrades the processor between upgrades. Like, the X-230, Core I5 is a third generation processor. The Core I7 third generation processor, (and I have not tried it) is faster, but someone said not enough to be worth how fast the battery is used up.
Each successive generation of Intel Processors should be faster, by a quantum factor every two years. Run cooler, and use less power for the speed. Hopefully a later computer can have a better battery inside.
I suspect that the Lenovo X-230, while having a third generation processor, and being limited to 16 GB RAM is well thought of;
Because nearly everything, security wise, that could be known about it is known.
It can have Heads Flashed to be a verification against tampering.
It is extremely physically durable.
They are small, light, easy to carry.
They can be found all over the world, it one needed a computer to modify inside their own country, and at as reasonable a price as is possible.
Downside being that Intel either has, or will soon stop providing updates for third generation processors that would protect against security problems, other problems. Do I trust Intel after they tried to slip one by everyone with the Intel Management Engine have its own modem, and could be, surreptitiously, without my knowledge or permission, updated by Intel. Changed to make my computer do something that I would not want. In truth, that would be like using an atomic weapon to get rid of an annoying fly. (without a lot of detail, there are ways to prevent the bad part of the Intel Management Engine from ever being activated)
Well, It is my belief here are technically knowledgeable folks check for any additional security hazards that might come from Intel Updates. If I do not hear of that in the security forums. I don’t worry about that.
More useful to my security is to worry on my own Op Sec. (Operational Security) .
AMD processors, from what I understand, offer more speed per dollar. I read of folks on the Security Forums who suggest that AMD also has implemented - back doors onto their processors, but not all of that is as well known as is what is known of Intel Processors. If you look at Intel web pages, they list some flaws, and possible security hazards, which look like they have not been fixed. If you just want to worry.
If you look at the Nitro Key website, they talk about different processors available on the T430, the Intel Processors are third generation. AND: There is another processor that begins with Q which is a lot faster. That for some, is part of the attraction of the T430 over the X-230. In addition the screen is slightly bigger. A lot is known of upgrades to T430, better screen. Better keyboard, and one can hardware Flash Heads onto the T430. Heads, if you recall, allows the user to verify if his computer has been tampered with. What is called an "Evil Maid Attack.’ There is another way to prevent an ‘Evil Maid Attack’ in some computers if one can not Flash Heads onto it. But that is another question. Still the T430 is limited to 16 GB RAM, which is slow if one starts several Qubes at the same time.
Renehoj mentioned the T480, (and from his previous comments, he means the one with the 8th Generation processor. either I5 or I7. Not the T480 with the 7th generation processor) 8th generation Intel processor being much faster than third. A big point being the T480 can have the memory upgraded to 32 GB (according to Crucial Memory site). Here in US, the land of profiteering and inflation, I can buy a basic refurbished T480 from Wal Mart for less than three hundred dollars, and upgrading memory to 32 GBs almost as much. Modifications of ‘anti-evil maid’ , neutralizing the bad parts of Intel Management Engine, on your own. Beware, there are several different versions of the T480. Get the one that fits you.
If you get the T480, soon you will be thinking, I could have spend some more (maybe double) and have gotten a thirteenth generation processor with the Nitro Key NV41, or the same machine from its original manufacturer.
I suspect the way the sales of the two different manufacturers are separated is that if one lives in Europe, then one looks for a European seller. If one lives in the US, one looks at a US/Canadian Supplier. Purism is rumored to soon be selling a new later model of its computer.
One of the other questions some might ask. I have never really used Qubes, and over a thousand to get a computer with Qubes is a lot to just experiment, is a bit steep. And if this is just more of an experiment rather than, say -some Journalists, and Human Rights folks can be in desperate situations. but for just an experiment. Well, there are a lot of less expensive computers that may not have an ability to have Heads Installed, that are on the HCL. I know I might find some really old tower at a used, recycled shop for less than a hundred. Would run terribly slow, but it would give you an idea of the structure of using the Qubes software.
Keep in mind that Intel processors are distinguished by generations, as well as portable processors versus the more powerful and speedy processors in towers. That Core I5, Core I7 is - I guess comes from sales people.
As always, I hope for someone more knowledgeable to come along and tell me where I am wrong in this. Trust almost anyone else’s opinion over mine.
1 Like
The difference in price is a lot more than just double.
The 1240P (NV41) is overall much more powerful than the 8650U (T480), but the power comes from the core count, not the individual cores. The differences in core clock speed is only 4.2 GHz vs. 4.4GHz, but the difference in core count is 4 vs. 12.
Unless you have a work load that scales very well with core count, you are probably not going to notice a huge difference between the two laptops, and the same argument is probably true for a fully upgraded T430 with the max CPU.
2 Likes
As far as I have read about it from 3dmeb’s Dasharo documentation and NovaCustom product pages, Heads is not ready for deployment as a payload for any of the NovaCustom laptops that support Coreboot. Even if Heads was available, I would not upgrade to the NovaCustom laptops myself because they all lacks hardware kill switches. A webcam slider does not count.
The Librem 16, which was formally acknowledged within one of the investor emails a few months ago. Purism community speculation suggests it will be released next year.
Thank you for the link, it is great that Nitrokey is being proactive with Heads deployment for the NovaCustom NV41. The Heads Wiki needs to be updated to include it.
My statement for the lack of Heads from NovaCustom’s laptops still stands though, but hopefully not for much longer.
Hardware kill switches are nothing but marketing frills. Microphone and network kill switches are useless since audio can still be gotten via the sensors and an attacker can just wait until you toggle the network on again to exfiltrate data. A camera kill switch can be useful as a small usability improvement but it’s not any better than using some tape.
What sensors? Be clear and explicit.
You are going to have to provide a citation to this attack, whether it is in a laboratory or out on the field. Preferably a long-winded technically dense explanation so I can reproduce this attack against myself as an experiment.
Far from it. Webcams can record audio and video, so putting some tape on it will not stop the webcam from pulling a video feed. Killing power to it with a hardware kill switch prevents it from being used.
1 Like
I am also using a x230, speed doesn’t bother me much, but I recommend looking at the certified laptop from nova customs if you want something with 100% compatibility and high end hardware
When it comes to single thread performance, both clock speed and IPC have important effects. Although 8650u is 4.2GHz and 1240P is 4.4GHz, there have been drastic IPC improvement across these generations ( to say, more than 50% ). You can see single thread and multithread performance measurement of those processors on the internet, 1240P is much better in every aspect.
I do agree that the X230 without upgrades is a bit on the slow side. It is usable but somewhat limited and also loud sometimes (at least mine). I still like it because in the machine there is the classic keyboard installed.
On the other hand an upgraded T430 feels just right to me. Wanted to buy a 3840qm CPU but it works fine with a 3720qm. I do not have the double-pipe fan, but it is still ok so far. In my eyes the real weak part of this machine is the original display, which can be upgraded to an IPS one.
Here are some details on how to upgrade such a machine. Having a really good T430 requires some new parts (display, lcd controller board kit, new cpu, good ssd, max ram, delta fan and a classic keyboard for dedicated users) and work=knowledge (flashing the bios requires taking apart the machine as the chip is on the back side of the mainboard). If someone prefers to save all that work/time/hassle (and spend a bit more), a newer (more silent, lighter, better screen, more ram) machine might be a better option.
Plenty of old hardware in the HCL, however I run Qubes on relatively new hardware.
Essentially this system with a Quadro RTX 3000 instead of 5000.
https://www.ebay.com/itm/175556319769
That being said, I have not replaced UEFI with something like libreboot/coreboot.
So far it works well, docking station is a bit dodgy, ethernet had one issue with the pci device not having reset so I just had to run a couple of commands to fix that. Now the 4K display sucks, so far the issue for me has been disabling the onboard display so I can stick to two external displays along with external mouse and keyboard. Still gotta figure out yubikey/solokey stuff after I figure out the issue with updating an Arch VM. The only issue I’ve seen that is really concerning is the USB-VM spiking up to 56% of CPU and that seems to be resolved by disconnecting my usb mouse and re-attaching it.
Otherwise, it’s pretty awesome. I plan on looking into how to contribute to the HCL. As for the UEFI/IME aspects, coreboot/libreboot doesn’t support this hardware so that may make it less appealing to you. I can’t say I’d recommend or not recommend, just that it works. Actually, the display has an issue where if you let it go to sleep/hibernate it will bug and the only solution is to power it off for a while and Dell didn’t want to place the monitors. So, just disable that stuff and when you aren’t using the device turn it off.
Not for much longer, indeed. We are working on coreboot+Heads!
We will tell more about it during the Dasharo Users Group (DUG) and during the Qubes OS Summit in Berlin (7th of October 2023).
2 Likes