@OvalZero
whats the benefit?
In a nutshell:
- It will enable more comanies to use qubes
- It will connect freelancers that do not have websites or only blog based websites that dont rank for “qubes os consulting” on google to companies that use qubes
- It will generate funding for the Qubes OS project (thats why openbsd and debian have such a list) because business customers will want features they can fund, as well as make donations to their new favorite OS
for a more detailed answer please see the posts above, where the question has been answered and discussed excessively.
As the thread is very long, I’d recommend just copying the URL into chatgpt and asking it to summarize the thread.
But most $CUSTOMERS I had the pleasure to deal with
Did you work in consulting for Qubes OS projects? Can you give us some anonymized infos about what you did?
which one to pick
most likely one that is listed under the country / continent they reside in, as for the clients I had for high security requirement projects, they generally don’t hire from outside of their legal zones (as in german customers will first go with german companies / freelancers, then with ones from the EU and then from the west and will most likely not do business with companies from the east). Because of this, debian and openbsd’s lists are sorted by countries.
After this, depending on your legal requirements, some companies are not allowed to work with freelancers and might look for a company that can handle the legal ramifications of human error, or simply because they need a team for a larger project.
And so on.
I run a IT company and there is a bit of a process to choosing whom I hire when I outsource work, but it essentially boils down to that.
will complain loud and vocal…
…about the company he had an issue with, not the list itself. When I have an issue with a freelancer or company I found on the openbsd list, I do not complain about the list itself or openbsd having such a list. If I hire a bad consultant off that list I might complain in the openbsd forum / mailing list.
After that it remains to discuss what to do with that information. It might simply be an enemy of yours who does not like your dog barking at night.
And he will ask, why there is no quality assurance
No, because he read the disclaimer on top of the list and because quality assurance is not realistic.
Every CEO who ever hired a company or freelancer from a list, such as the OpenBSD consulting list, knows that - first off because its written on top, and second because there is no such thing as quality assurance for a list of freelancers and companies that provide consluting services. If they say they do its a fake “IT certification thing” that will not keep out bad players either.
Neither will relying ranking on google, which btw, as described above, is UTTERLY easy for “qubes os consulting” at the moment.
It will be that kind of person that buys security as a product.
I dont follow - what kind of person?
Every company / freelancers / journalist / human rights lawyer that does not work in IT security since MANY years has to buy IT security, because UNDERSTANDING IT security takes many years. Expecting potential clients to learn this themselves is unrealistic and also very dangerous, as beginners make many mistakes.
Why would anyone do this?
Because they run companies and have problems with industrial espionage / totalitarian governments / human rights violations and alike and want to implement Qubes OS in order to defend against such issues.
read the docs and do as much as you can yourself
If that were a thing, there would be no consultants for IT in general, as you can teach yourself any topic in IT, not just security. This is not realistic however.
Companies commonly specialize in one thing and buy other things. If you specialize in writing software for a specific usecase, it is not realistic to “learn” IT security and expect a good result within a reasonable timeframe. There are people in this thread that do have that kind of knowledge and can help such companies acchieve the goal of configuring and then using Qubes reasonably securely.
Start with googling if necessary. If you want security, forget „ease“ and „time saving“.
This is not realistic for companies, human rights activists, human rights lawyers, journalists and so on. As a german I could not help myself but make this comparison (we compare everything to cars for whatever reason ) - you could also say “if you want to drive to work learn how to fix your own car”.
Companies and freelancers, journalists, human rights activists, lawyers, whisteblowers and alike have a RIGHT to reasonable IT security! Qubes OS is not a snakeoil product. Client companies and people can not decide themselves what is snake oil and what is not, because it is not their area of expertise.
Makeing Qubes OS more popular, more accessible and easier to start with by providing consulting is important in order for people and companies to have better IT security, which is one of the primary goals of Qubes OS - to provide IT security to people who need it, not only to those who understand it.
They should NOT ONLY be entitled to have this level of security by learning something themselves, and then start relying on it without fully understanding it and makeing mistakes that may cost them their companies, their freedom or even their lifes.
Qubes OS is a wonderful project that helps to protect companies and individuals around the globe, but it is not easy to understand for non technical people. “Learning it yourself” because you need it right now will lead to potentially drastic mistakes.
A list of consultants will connect companies and such people with experienced Qubes OS consulting companies and freelancers, which helps generate additional funding for Qubes OS which further enhances the usability and security of Qubes OS. Everyone wins.
OpenBSD, which is an equally security focused project as Qubes OS, came to the same conclusion, which is why they have such a list: OpenBSD: Support and Consulting