On Mon, Jul 22, 2019 at 11:40:39AM -0400, Chris Laprise wrote: > On 7/21/19 5:44 PM, Lorenzo Lamas wrote: > > Very nice to finally have a certified Qubes laptop! > > > > Personally, for me it would be nice if there was a more powerful > > alternative in the future. I'm currently using something with about the > > same resource power and I find myself often wishing I had something > > faster because Qubes is quite heavy compared to a standard OS. It would > > be great to have a quad core CPU(and a proper one, not one of those > > power-saving U line from Intel), 32GB RAM or more and a NVMe SSD instead > > of SATA. > > Also, there is the issue of the CPU being a 3rd gen Intel i CPU. Maybe > > this is specifically chosen because later CPU's are harder to get blob > > free, I don't know the details. However, Intel had quite a few side > > channel vulnerabilities over the past year, and this year they dropped > > microcode update support for 1st gen CPU's, so there is a pretty high > > chance they will drop 2nd gen support next year and 3rd gen support the > > year after that. > > There is even one statement from Intel out there that they've tentatively > already dropped support for 3rd gen (which is what the X230 and its 'sister' > the T430s uses). > > The Lenovo G505s should be slightly more powerful than the X230, and its AMD > A10 processor is significantly less prone to attack. > > The only problems with it are that HEADS doesn't work (not a big > disadvantage, given how vulnerable X230's older TPM is), and to install > Qubes you need to flash it with a Coreboot config that requires you to add > an un-signed graphics driver (I think if enough people posted SHA256 hashes > of the driver it wouldn't be a big problem). > > It also accepts ECC RAM, which reduces the DDR3 side-channel vulnerabilities > somewhat. > > So the alternative to the 2012 laptop is the 2013 laptop. A bit > underwhelming. > > - > > The overall problem here is none of these open source OS projects are true > integrators or designers, not when it has anything to do with hardware. This > is why Qubes project will identify USB controller isolation as a major > issue, but then do nothing about it (note the X230 is lacking a secondary > USB controller). They'll say Intel or X86 is fundamentally insecure, but > won't begin to describe what a good alternative would look like at the > component level; without that, there's nothing into which the hardware > people to sink their teeth or even notice Qubes. >
You are wrong about the x230 lacking a secondary USB controller, if you mean " a second controller". The x230 has controllers which can be allocated to two distinct usb qubes. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/20190722155351.f4d3jxyu7xwg75xd%40thirdeyesecurity.org.
