My understanding is that ME can only be disabled “to a certain degree” and that one cannot be certain how active or capable it still is. In other words, there’d still be a big difference between (partially) disabling it and not having it at all. But I’m no expert.
So I did some quick Googling and found that AMD and Intel are the only two modern x86 consumer manufacturers left standing since a while (decade?) back, aside from manufacturers in China, who are mostly nascent. Motherboards and chipsets supporting anything other than AMD or Intel packages are basically non-existent.
Not great if you distrust PSP and ME, but considering how much power and impact someone with ME and/or PSP control will have on the world stage, the keys to ME and PSP are probably among the most closely guarded secrets in the world (not to mention extremely difficult to hack).
But maybe I’m putting too much faith where I shouldn’t.
You are right, some proprietary bits are still required for booting. However having a few 100 KB of those is a much smaller attack surface than tens of MB. (if you can neutralize ME).
Laptops with Libreboot suffer from Specre and Meltdown AFAIK. PSP cannot be neutralized at all. So realistically, neutralizing and disabling ME is the best choice today.
Certainly, don’t allow the perfect to be the enemy of the good. “Good and existent” beats “perfect and nonexistent” every time. But since this thread is asking about the ideal hardware (even if it doesn’t exist), I’m going all out with the wish list.
Maybe Qubes will run on ARM in the future. I think there’s no nasty management engines on ARM, but I’m not sure.
I had ARM-based chromebook some years ago. It was pretty good experience, so this is not totally scifi.
Yes, following a guide that is still being worked on by @Plexus.
thanks very much, really helpful for everyone.
sys-njalla is one of my VPN providers and that qube uses the Qubes OS
firewall to make sure sys-njalla can only connect to the respective VPN
servers and nothing else.
not sure, whether my understanding is correct,
all traffic, to various IP destination, are encrypted by sys-vpn,
and will be decrypted in VPN server, somewhere outside our device,
before then being forwarded to various IP destination.
so, if sys-vpn, resides before sys-firewall,
does it mean, sys-vpn doesn’t know, what IP is blocked by sys-firewall ?
also, does it mean, sys-firewall doesn’t know,
whether the encrypted traffic, sent to VPN server, by sys-vpn,
contains the blocked IP or not ?
There is something even better on the horizon: Port Qubes to ppc64 [3 bitcoin bounty] · Issue #4318 · QubesOS/qubes-issues · GitHub.
If I understand this correctly it would then use KVM as a hypervisor backend?
Good point. My honest question wasn’t meant to point out that no other alternative exists–it was simply what I wanted to know at the time. When I first started writing my original post, I wrote a wish list of what the ultimate Qubes PC might look like:
- No ME/PSP or equivalent
- As many cores as practical for tasks in mind, with some redundancy
- Optimized for virtualization
- Speculative execution never even installed
- Clock speed as high as practical for tasks in mind, with some redundancy
I scrapped it because it was basically what a child might send to santa, but you pointed out that this is exactly what I myself asked for.
Sometimes ideas that are just thrown out there despite being utterly fantastical might actually lead to something.
Maybe people posting their hardware wish list (or even Qubes features) in this thread should be required to start their posts with “Dear Santa”?
Intel laptops without Intel ME are very weak, but there are also Amd laptops without PSP, G505s as an example, it supports coreboot and 16GB of RAM along with a10 processor
I want a small lightweight device that
- is powerful
- is efficient
- is designed to last
- is open and verifiable
- is completely documented
- is user owned and owner controlled
- is secure without secret architecture
- is repairable, modifiable, and extendable
- has intuitive awe-inspiring human interfaces
- will do what I need it to do tommorrow even though I don’t know what that is today
But back to reality in 2021…
Not that anyone asked but I think the KGPE-D16 is still a unique AMD pre-PSP option. Imperfect and challenging, certainly, but still interesting. See this and this if you’re curious why.
As I understand it, it still supports coreboot / libreboot and two processors, surprisingly
Yes, you can get one with coreboot and QOS preinstalled (+ QOS donation)
Compatible processors include “Abu Dhabi” Opterons with the most powerful (aka power hungry) being the 6386SE Hexadeca-core. Last I checked, Qubes 4.0 applies the 63xx microcode updates properly during boot. Although I only use one OS6386YETGGHK and four EEC 16GB RDIMMs, it is possibile to install two (thus 32 cores) and at least 192GB DDR3 with a “blobless” coreboot. Heads on coreboot 4.11 with TPM support is possible too! It may not be a good choice for many but for anyone seriously looking at systems without Intel ME or AMD PSP I think the KGPE-D16 shouldn’t be overlooked.
I was interested in this board a few years ago but then support was dropped in Coreboot and I read about trouble getting a distro like debian to boot. I don’t know if anything has changed over the past few years and if this is even compatible with Qubes?
Unfortunately I can’t speak to troubles with debian or the current efforts to revive coreboot support. I’m following the Heads github issue #719 - Re-upstreaming and maintainership of the KGPE-D16
At the time I read your message, the latest comment says there will be a meeting Monday 23rd August 15:00 UTC on https://meet.3mdeb.com/kgpe-d16-refresh
I also added a HCL report for the Asus KGPE-D16 (6386SE) with stock firmware here.
Thanks a lot, very interesting information! I will follow the development, maybe I’ll get one of these boards one day.
Also, thanks for the detailed HCL report, it’s good to know what’s working and/or how to get there.
I’d also recommend reviewing Thomas’ 2/24/2020 qubes-users mailing list post containing notes of his experience getting Qubes R4.0 running on the KGPE-D16 with Coreboot 4.11 and GRUB2 at https://groups.google.com/g/qubes-users/c/nbwWa9b-Eo0
Note: My experience does not completely coincide with the last post in that thread.
Also for anyone considering the KGPE-D16, the May 2020 Qubes Certified Desktop qubes-users thread at https://groups.google.com/g/qubes-users/c/19J1nfca3HY is worth reading imho.
Have a good weekend…
This should definitely branch off into “If you could design the perfect Qubes OS laptop and desktop machines, what would they be like? Be as detailed as you can, because we might actually be able to crowdfund this!”
I also agree with all of @Sven’s points, with a few of my own:
- The internal keyboard and trackpad must be on its own bus
- all other internal peripherals should either be on their own dedicated bus, or at the very least grouped by function/purpose
- integrated graphics AND discrete GPU (possibly multiple GPUs, for passthrough fir gaming, video editing and mining)
- Multiple M.2 slots for SSDs
- MANY MANY SODIMM slots for RAM for Qubes
- Kill-switches for camera
- Ports ports and more ports, of all varieties (maybe even interchangeable like the Framework Laptop, allowing more flexibility to port passthrough)
- Maybe some kind of “USB Condom” on all USB ports
- FOSS-friendly Ethernet (potentially multiple RJ45 ports) and wifi (preferably multiple antennas, for pentesting)
- Enough battery life for 3-4 hours of use at full load
- 4k display (potentially touchscreen)
- Rugged enough to “take a beating”, but elegant enough to not look like you’re on an archaeological excavation endeavour
I don’t care if it’s a brick, I’ll still carry it round
- LOTS of PCI slots
- LOTS of separate USB Buses (preferably max two ports per bus, as you can always use adapters to connect more devices)
- Maybe some kind of “USB Condom” on all USB ports
- FOSS-friendly Ethernet and wifi
- FOSS BIOS (ideally Heads or a fork of Heads)
- UPS (just in case, even if it’s only a 10-minute battery, just so your machine can shut down properly)
- SILENT FANS, or no fans at all! (I’ve done my time in a server room)
Am I missing anything?
Disclaimer: This is a wishlist, and I’m fully aware that all of this in a single machine would be difficult, if not impossible….