What would you like to see improved in Qubes OS?

If you still get the popup asking you to confirm the file transfer, then it’s basically just a graphical version of qvm-copy-to-vm (note: not qvm-copy, which doesn’t specify the target machine on the command line, forcing you to choose it in the dialog).

There is one further difference: presumably he wants to be able to pick the destination folder rather than QubesIncoming/.

2 Likes

That would be very nice.

I realize there would be challenges in actually implementing this. For example, dragging a file over to a particular qube window could be enough to select that qube as the destination. However, I have problems imagining how the focus of selection could then ‘go inside’ the destination qube and select a particular folder. Maybe I’m wrong.

I guess I’d be happy just keeping QubesIncoming as the destination folder. Still a bit simpler than pfaffing around with pop-up menus. I’d like to keep it an all-mouse/graphical operation, no breakout to keyboard .

I wouldn’t bother with a pop-up confirmation, graphical ques would be fine. But then I don’t work with really sensitive material and a strict need for separation, unlike some other users. Maybe that’s just too lax for Qubes, as @qubist implies.

2 Likes

That would definitely be nice.

The rest of my list:

  • Support for lower power states so modern CPU’s can reach their lowest frequencies when idle.
  • Support for amd-pstate driver / CPPC.
  • Collaboration with grsecurity to get grsecurity kernels and userspace protection on Qubes.
  • Get Mirage firewall in Qubes Community Repository.
  • Get Qubes-VM-hardening in Qubes Community Repository (was already expecting it to be in there by now).
3 Likes

I spent a long time compiling a comprehensive list of all things I would like to improve and sorted them in order of importance to make it easier to filter through the chaff:

  • faster system and vm boot time

Apologies for the cheekiness, but it really is just that (Qubes is really good!) and at the same time believe it would be the biggest improvement to it.

1 Like
  • When letting the installer create the default VMs, I would like the sys-* ones to be based on a minimal image.
  • A backup that is more space efficient (incremental backup) and the ability to include/exclude certain files.
  • Allow permanent device bindings based on device IDs instead of the port it is connected to.
  • Some sort of best practices guide on how to safely use QubesOS (“if I want to be protected against X, then I have to do Y” and “those are general security and privacy best practices”). Make this documentation accessible for the less technical people.
6 Likes

@SteveC

If you still get the popup asking you to confirm the file transfer, then it’s basically just a graphical version of qvm-copy-to-vm (note: not qvm-copy, which doesn’t specify the target machine on the command line, forcing you to choose it in the dialog).

I don’t know why but whenever I use qvm-copy-to-vm <vmname> <filename> I still get the dialog asking me to choose the VM. How come?

2 Likes

@tree

I wouldn’t bother with a pop-up confirmation, graphical ques would be fine. But then I don’t work with really sensitive material and a strict need for separation, unlike some other users. Maybe that’s just too lax for Qubes, as @qubist implies.

That is the well known contradiction between security and usability. Take your suggestion to an extreme case, e.g. imagine one’s cat walking on the desk, stepping on the mouse button, dragging (and then stepping on the “Enter” key to confirm inside a potential popup, if there is one). Of course, that is a probably a silly example because one should never allow cats walking on computers or leave an unlocked desktop when not in use but you get the idea. Dangerous things can happen even when one is tired, or when one spills something on the desk. Nothing can prevent all possible insecurities caused by human error but we should be careful when we request/implement insecurities deliberately.

Personally, I would like to have the convenience you suggest too. However, that should come:

  • as an option which one unlocks explicitly (after a big warning)
  • in a controllable way - one should be able to control between which qubes and in which direction the feature should work, e.g. I may want to be able to drag to a disposable but I may not like to drag from a network connected qube to a disconnected one, or from “personal” to “work” and vice versa, etc.
2 Likes

It is expected according to /usr/bin/qvm-copy-to-vm, which is a symlink to /usr/bin/qvm-copy.

I think the idea is that one should not useqvm-copy-to-vm inside qubes except dom0.

Probably due to the fact that using other qubes name inside the qubes is against the logic of Qubes OS of compartmentalization.

2 Likes

State-preserving VM suspends
A tool to “gracefully retire” archived qubes (extract documents and browser passwords and save them in a convenient way), a tool to export and import qubes as vmdk’s
More qube colors
Liteqube in default setup
Full Windows guest support (seamless mode and decent performance)
Screenshot tool working out of the box
Permanently attach USB devices regardless of bus id’s they get
CDE theme :slight_smile:

3 Likes

Make an intutive way to add a TAB to the list of options of available programs, for a program that one adds to Qubes on ones own. Obviously this would be a program installed from outside.

Yes, there are security risks to adding programs not screened by groups like Qubes developers, Free Software Foundation.

But it makes Qubes easier to us for some types of users.

2 Likes

this would be a shell completion script (like bash completion), this could be made part of qubes projects, so it shouldn’t be a security risk if integrated into qubes source code.

1 Like

You mean bash-completion? Can’t you already use it as it is?
If you want completion for qubes tools then it’s a work in progress:

2 Likes

Sorry, I was not clear.

By intuitive. I meant it is easy for a newcomer to see how to accomplish without going back to read documentation site.

This is something Apple excels at. Like they know how people think.

By security hazard. Installing a program which has closed source and/or will have updates that are not monitored.

Like a newcomer wants to install a video chat. And wants to have a tab to start it easily.

Some of us might say. Insecure potential. But. Just making it hard on newcomer to start distracts from.
It is likely a security hazard.
Run it in a Qube by itself.

Consider having a qube with a tab with librewriter.
It is doable now. But not intuitive like right click. Add to list of programs available in this Qube.

Or. Facebook?

2 Likes

I don’t understand what do you mean by “tab”.

Qubes OS would definitely benefits from UX work, but it seems there are not many working on open source projects.

Maybe the application “Software” should be in the Fedora template menu entry for the default installation, so newcomer can easily figure how to add programs.

2 Likes

I have 2 qubes installs. One is actually for privacy, and the other is a test lab. I think qubes is a fun virtualization lab, where you can be operating in a GUI locally and interacting with your VMs. I wish more UX attention was focused on this. I desperately need folders in my qubes manager or some better organizational system, ive resorted to giving them symbolic prefixes to make filtering easier.

Also, while this is possible, ive noticed no OS is really tinkering with it: The 11th+ gen i915 gpus support true SR-IOV and intel has posted some stuff in github to indicated that the VFs can be assigned to outputs, even ones that don’t exist physically (they might electrically). If you combined this with the dummy monitor driver that the looking-glass dev is tinkering with I think you could accelerate 3-7 qubes on the i7/i9 gpus. You can either go the IVSHMEM or h264/h265 streaming route. At the very least you could just use it for ffmpeg in a qube

I’ve successfully gotten it work work in a windows VM using patched i915 kernel module on arch linux

1 Like
  • Move back to KDE as default.

  • Tap the full speed of external drives. Rework sys-usb, removing speed bottleneck.

  • Rework sys-usb to play well with external peripherals like drawing tablets.

Productivity boosters:

  • Make an API such that 3rd party runners like Krunner, Ulauncher can make plugins that access appvms.

  • A more robust native runner that runs in Dom0, and streamlines tasks in appvms.

  • Streamlined attached/detach USB devices. Make it easier to script:

  • Direct calls to get drive data:

  • Direct calls to get drive description and UUID of attached devices.

  • Direct calls for sys-usb device ID.

  • Integrated Appimage, Snap, Flatpak support. Make it easy to install these containers and keep them updated in appvms thru the updater.

And last but not least…

Peace of mind when crossing boarders in the modern dystopia the world is spiraling into.

5 Likes

I’m still pretty new to Xen, but couldn’t spice channels provide better USB speed than the current USB/IP method? Perhabs an IVSHMEM device could provide better drawing tablet functionality.

1 Like

Solene, thank you for what you are doing.

My use of the term Tabs is a bit like Favorites in a browser. With a quick click or two, one creates Tab for a specific webpages. But a Tab for quick access to a program.

I wanted to work up some examples with exact description, but I have been hampered by storms which have made power - intermittently available, internet less available, my need to do errands for other people. I am both old and lazy.

Thank you, Solene for your efforts.

4 Likes

Could we move the backup thread into a separate thread?

4 Likes
  • Easier handling of HiDPI displays (and multi-screen multi-DPI setups).
  • Easy switching for light and dark mode
  • Gnome as DE
3 Likes