On 7/21/19 5:44 PM, Lorenzo Lamas wrote:
Very nice to finally have a certified Qubes laptop!
Personally, for me it would be nice if there was a more powerful
alternative in the future. I'm currently using something with about the
same resource power and I find myself often wishing I had something
faster because Qubes is quite heavy compared to a standard OS. It would
be great to have a quad core CPU(and a proper one, not one of those
power-saving U line from Intel), 32GB RAM or more and a NVMe SSD instead
of SATA.
Also, there is the issue of the CPU being a 3rd gen Intel i CPU. Maybe
this is specifically chosen because later CPU's are harder to get blob
free, I don't know the details. However, Intel had quite a few side
channel vulnerabilities over the past year, and this year they dropped
microcode update support for 1st gen CPU's, so there is a pretty high
chance they will drop 2nd gen support next year and 3rd gen support the
year after that.
There is even one statement from Intel out there that they've
tentatively already dropped support for 3rd gen (which is what the X230
and its 'sister' the T430s uses).
The Lenovo G505s should be slightly more powerful than the X230, and its
AMD A10 processor is significantly less prone to attack.
The only problems with it are that HEADS doesn't work (not a big
disadvantage, given how vulnerable X230's older TPM is), and to install
Qubes you need to flash it with a Coreboot config that requires you to
add an un-signed graphics driver (I think if enough people posted SHA256
hashes of the driver it wouldn't be a big problem).
It also accepts ECC RAM, which reduces the DDR3 side-channel
vulnerabilities somewhat.
So the alternative to the 2012 laptop is the 2013 laptop. A bit
underwhelming.
-
The overall problem here is none of these open source OS projects are
true integrators or designers, not when it has anything to do with
hardware. This is why Qubes project will identify USB controller
isolation as a major issue, but then do nothing about it (note the X230
is lacking a secondary USB controller). They'll say Intel or X86 is
fundamentally insecure, but won't begin to describe what a good
alternative would look like at the component level; without that,
there's nothing into which the hardware people to sink their teeth or
even notice Qubes.
--
Chris Laprise, [email protected]
https://github.com/tasket
https://twitter.com/ttaskett
PGP: BEE2 20C5 356E 764A 73EB 4AB3 1DC4 D106 F07F 1886
--
You received this message because you are subscribed to the Google Groups
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/qubes-users/8cd5347b-a30d-3af6-a254-e059be7a4907%40posteo.net.
