Re: [qubes-users] Qubes/class, Was: slightly off-topic: self-resetting OS idea

['Антон Чехов' via qubes-users]

On Wednesday, August 28, 2019 at 11:07:57 PM UTC+2, qtpie wrote:
>
> panina: 
> > 
> > 
> > On 8/26/19 6:27 PM, 799 wrote: 
> >> Hello 
> >> 
> >> David Hobach   tri...@hackingthe.net >> 
> >> schrieb am Mo., 26. Aug. 2019, 11:22: 
> >> 
> >> On 8/26/19 10:24 AM, panina wrote: 
> >> > Hi! 
> >> > 
> >> > This is not strictly Qubes-OS related, rather inspired by Qubes. 
> >> > 
> >> > I've been struggling with some parts of Qubes usage. Most of the 
> time, 
> >> > it is overkill for me, and putting some strain on my computer. 
> The 
> >> > bugginess is also quite annoying, whenever I just need to do some 
> >> > everyday work. 
> >> > I've been thinking I'd like some form of dual-boot solution, or 
> >> possibly 
> >> > a Live USB that could be used. 
> >> > Most of the time I work with ssh and webapps, so the only 
> persistent 
> >> > data I need to work will fit on a smartcard. 
> >> > 
> >> > My thought is to have an installation that mounts most of the 
> root 
> >> > partition as readonly, and uses ramdisks wherever the system 
> wants to 
> >> > write (e.g /var/log). I'm also thinking it should be possible to 
> get a 
> >> > fingerprint or somesuch of the root partition, and use my TPM2 to 
> >> check 
> >> > this. 
> >> > 
> >> > The system should also have a possibility to update itself, that 
> I can 
> >> > choose to do in environments that I feel is safe. 
> >> > 
> >> > I am wondering if anyone knows of an OS that works like this? Or 
> if 
> >> > anyone knows of tools that might accomplish parts of this? 
> >> 
> >> Ehm... You're describing Qubes OS with disposable VMs there? The 
> >> fingerprinting is essentially AEM? 
> >> 
> >> If you need to keep your data on an external disk (SDCard), you can 
> use 
> >> either a manual approach with qvm-copy, permanently attach the disk 
> >> to a 
> >> single disposable VM with a fixed name or use an automated solution 
> >> such 
> >> as [1]. You might also want to look into qvm-pool. 
> >> 
> >> [1] https://github.com/3hhh/qcrypt 
> >> 
> >> 
> >> I don't know why people are complaining about the "bugginess" and that 
> >> it needs more performance. 
> >> 
> >> If you buy the right hardware you'll not run into lots of bugs and get 
> >> enough performance to run qubes. You can buy a Lenovo T530/430, W530, 
> >> X230 for not much money, add a SSD some RAM and you'll not run into 
> >> performance problems (normal use). 
> > 
> > This is a view that I see quite a lot. It is a whole different 
> > discussion. Hence the re-subjecting. 
> > 
> > Firstly, this view completely lacks class analysis. Not everyone can 
> > afford to buy the newest shiny. A lot of us have to use whatever we can 
> > get our hands on. 
> > Whenever a secure OS is mentioned, Qubes is the go-to. Everyone comes 
> > here. The approach that you have to buy new, specific hardware to have a 
> > functioning OS means anyone poor, or in a country with a poor dollar 
> > exchange rate, is left behind. 
> Panina, I hate to say this since class awareness is sorely lacking in 
> tech, but in this case I dont agree with you. You dont need to buy the 
> latest and/or shiny. If you look up any of the models mentioned 
> previously on ebay (Lenovo T530/430, W530, X230) and upgrade those with 
> an SSD you can have a fine Qubes laptop for $300 that will last you many 
> years. I am personally using qubes for a few years on a laptop from 2014 
> just like this. Maybe this could be mentioned more clearly in the docs, 
> many people seem to think that they need a new i7 with 16GB+ of ram. 
> That is absolutely not the case. 
>
> $300 is very different from $1500 but still definitely not free. If I 
> take 'latest and shiny' a little less literal and by 'whatever we can 
> get our hand on' you mean a laptop you can get for less than $200 or 
> even for free, then I retract my point. However this is not really qubes 
> can do something about. Hardware related projects have minimum hardware 
> requirements, that hardware often (not always) costs money, and money is 
> a class issue which it shouldnt be. 
>
> Maybe somebody on the mailinglist works at a big company with lots of 
> qubes-compatible laptops that get written of soon and these could be 
> distributed trough the Qubes project? Or maybe somebody knows a 
> foundation coordinating this kind of project or helping people out with 
> hardware some other way? 
>
>
Just a little addition to the devices already mentioned:
I've been using a T420 (16GB RAM) with Qubes4 for as long as it has been 
available and it is working very well. There are a few things (suspend & 
resume, backlight is never really off) that aren't working right now but 
nothing too serious. It cost me 150€ and this laptop is widely available 
(of course, there are always exceptions).

For the fun of it, I purchased a G505S as well 

Re: [qubes-users] Qubes/class, Was: slightly off-topic: self-resetting OS idea

[Guest]

At 14:04 29/08/2019, unman wrote:
>I have to point out that you can run Qubes fine with HDD and 12GB RAM -
>even 8GB is doable.
>quick ebay suggests you can get x230 with *that* config regularly for less than
>$200 - i7 with 16GB went for $175 recently.
>If you drop down to an i5 (still workable) you can come in at less than
>$100.
>I know people who are using burners at these specs they have acquired
>for free - worth the UX pain for the added security. There's always a
>trade off.

Just to throw this out there - not everyone has access to ebay or any thriving 
second hand market for that matter ;-/
I know I would jump for joy, if I could get my hands on such hardware at THAT 
price. 

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/E1i3LDT-0006Hk-IH%40node1.secure-shield.at.

Re: [qubes-users] Qubes/class, Was: slightly off-topic: self-resetting OS idea

[unman]

On Mon, Aug 26, 2019 at 05:27:00PM +, qtpie wrote:
> panina:
> > 
> > 
> > On 8/26/19 6:27 PM, 799 wrote:
> >> If you buy the right hardware you'll not run into lots of bugs and get
> >> enough performance to run qubes. You can buy a Lenovo T530/430, W530,
> >> X230 for not much money, add a SSD some RAM and you'll not run into
> >> performance problems (normal use).
> > 
> > This is a view that I see quite a lot. It is a whole different
> > discussion. Hence the re-subjecting.
> > 
> > Firstly, this view completely lacks class analysis. Not everyone can
> > afford to buy the newest shiny. A lot of us have to use whatever we can
> > get our hands on.
> > Whenever a secure OS is mentioned, Qubes is the go-to. Everyone comes
> > here. The approach that you have to buy new, specific hardware to have a
> > functioning OS means anyone poor, or in a country with a poor dollar
> > exchange rate, is left behind.
> Panina, I hate to say this since class awareness is sorely lacking in
> tech, but in this case I dont agree with you. You dont need to buy the
> latest and/or shiny. If you look up any of the models mentioned
> previously on ebay (Lenovo T530/430, W530, X230) and upgrade those with
> an SSD you can have a fine Qubes laptop for $300 that will last you many
> years. I am personally using qubes for a few years on a laptop from 2014
> just like this. Maybe this could be mentioned more clearly in the docs,
> many people seem to think that they need a new i7 with 16GB+ of ram.
> That is absolutely not the case.
> 
> $300 is very different from $1500 but still definitely not free. If I
> take 'latest and shiny' a little less literal and by 'whatever we can
> get our hand on' you mean a laptop you can get for less than $200 or
> even for free, then I retract my point. However this is not really qubes
> can do something about. Hardware related projects have minimum hardware
> requirements, that hardware often (not always) costs money, and money is
> a class issue which it shouldnt be.
> 

I have to point out that you can run Qubes fine with HDD and 12GB RAM -
even 8GB is doable.
quick ebay suggests you can get x230 with *that* config regularly for less than
$200 - i7 with 16GB went for $175 recently.
If you drop down to an i5 (still workable) you can come in at less than
$100.
I know people who are using burners at these specs they have acquired
for free - worth the UX pain for the added security. There's always a
trade off.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/20190829120425.GB8218%40thirdeyesecurity.org.

Re: [qubes-users] Qubes/class, Was: slightly off-topic: self-resetting OS idea

[qtpie]

panina:
> 
> 
> On 8/26/19 6:27 PM, 799 wrote:
>> Hello
>>
>> David Hobach mailto:trip...@hackingthe.net>>
>> schrieb am Mo., 26. Aug. 2019, 11:22:
>>
>> On 8/26/19 10:24 AM, panina wrote:
>> > Hi!
>> >
>> > This is not strictly Qubes-OS related, rather inspired by Qubes.
>> >
>> > I've been struggling with some parts of Qubes usage. Most of the time,
>> > it is overkill for me, and putting some strain on my computer. The
>> > bugginess is also quite annoying, whenever I just need to do some
>> > everyday work.
>> > I've been thinking I'd like some form of dual-boot solution, or
>> possibly
>> > a Live USB that could be used.
>> > Most of the time I work with ssh and webapps, so the only persistent
>> > data I need to work will fit on a smartcard.
>> >
>> > My thought is to have an installation that mounts most of the root
>> > partition as readonly, and uses ramdisks wherever the system wants to
>> > write (e.g /var/log). I'm also thinking it should be possible to get a
>> > fingerprint or somesuch of the root partition, and use my TPM2 to
>> check
>> > this.
>> >
>> > The system should also have a possibility to update itself, that I can
>> > choose to do in environments that I feel is safe.
>> >
>> > I am wondering if anyone knows of an OS that works like this? Or if
>> > anyone knows of tools that might accomplish parts of this?
>>
>> Ehm... You're describing Qubes OS with disposable VMs there? The
>> fingerprinting is essentially AEM?
>>
>> If you need to keep your data on an external disk (SDCard), you can use
>> either a manual approach with qvm-copy, permanently attach the disk
>> to a
>> single disposable VM with a fixed name or use an automated solution
>> such
>> as [1]. You might also want to look into qvm-pool.
>>
>> [1] https://github.com/3hhh/qcrypt
>>
>>
>> I don't know why people are complaining about the "bugginess" and that
>> it needs more performance.
>>
>> If you buy the right hardware you'll not run into lots of bugs and get
>> enough performance to run qubes. You can buy a Lenovo T530/430, W530,
>> X230 for not much money, add a SSD some RAM and you'll not run into
>> performance problems (normal use).
> 
> This is a view that I see quite a lot. It is a whole different
> discussion. Hence the re-subjecting.
> 
> Firstly, this view completely lacks class analysis. Not everyone can
> afford to buy the newest shiny. A lot of us have to use whatever we can
> get our hands on.
> Whenever a secure OS is mentioned, Qubes is the go-to. Everyone comes
> here. The approach that you have to buy new, specific hardware to have a
> functioning OS means anyone poor, or in a country with a poor dollar
> exchange rate, is left behind.
Panina, I hate to say this since class awareness is sorely lacking in
tech, but in this case I dont agree with you. You dont need to buy the
latest and/or shiny. If you look up any of the models mentioned
previously on ebay (Lenovo T530/430, W530, X230) and upgrade those with
an SSD you can have a fine Qubes laptop for $300 that will last you many
years. I am personally using qubes for a few years on a laptop from 2014
just like this. Maybe this could be mentioned more clearly in the docs,
many people seem to think that they need a new i7 with 16GB+ of ram.
That is absolutely not the case.

$300 is very different from $1500 but still definitely not free. If I
take 'latest and shiny' a little less literal and by 'whatever we can
get our hand on' you mean a laptop you can get for less than $200 or
even for free, then I retract my point. However this is not really qubes
can do something about. Hardware related projects have minimum hardware
requirements, that hardware often (not always) costs money, and money is
a class issue which it shouldnt be.

Maybe somebody on the mailinglist works at a big company with lots of
qubes-compatible laptops that get written of soon and these could be
distributed trough the Qubes project? Or maybe somebody knows a
foundation coordinating this kind of project or helping people out with
hardware some other way?

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/qk3lj9%243imk%241%40blaine.gmane.org.

Re: [qubes-users] Qubes/class, Was: slightly off-topic: self-resetting OS idea

[799]

Hello,

panina  schrieb am Di., 27. Aug. 2019, 10:17:

>
>
>
> This is a view that I see quite a lot. It is a whole different discussion.
> Hence the re-subjecting.
> Firstly, this view completely lacks class analysis. Not everyone can
> afford to buy the newest shiny. A lot of us have to use whatever we can
> get our hands on.
>

Honestly I don't know what other people on this list use for hardware.
But if I look arround what my coworkers, customers, friends, family ..
everyone arround me is using, I am the one who is owning very old and very
cheap hardware (x230).
As such my assumption that most people are using newer and shinyer hardware
than me ;-)

Whenever a secure OS is mentioned, Qubes is the go-to. Everyone comes here.
> The approach that you have to buy new, specific hardware to have a
> functioning OS means anyone poor, or in a country with a poor dollar
> exchange rate, is left behind.
>

This is a constructed scenario. You will always find someone who will be
left behind.
If people who can afford to buy "shiny" new hardware would be used cheap
hardware which will likely do the same job, they can even buy 3 devices
instead of one and give it away for free. Win.
Also there is no need at all to buy new hardware if you want to run Qubes,
even more it makes sense to buy older hardware.
But even if you need to spent a few bucks it would not stop me and should
not stop you from investing into your security and privacy.

If Qubes was one of many options, this would cause less damage. But
> right now, there aren't many alternatives. So privacy and secure tech
> becomes an economic issue, a luxury
>

Why? As mentioned you can run Qubes on a very cheap laptop. I don't really
think that those "hardware" costs are really the reason why people are NOT
running Qubes.

>> I firmly claim that basic privacy should be a human right.

Yes, I agree.



> Furthermore, Qubes currently concentrates on Intel hardware.


Because it is easy to get and that's what most users are using. I think it
is rather unlikely that this will change in the near future.
But afaik I know it is also running on AMD CPUs.

I do not in any way feel that this is a sane choice right now. I feel it
> would be rather stupid to buy new hardware right now that has Intel
> processors.
>

You don't have to, but all alternatives (if there are any) would cost more
money or lead to the fact that I am unable to run qubes.

Too many security issues, and new ones popping up all the time.
>

What are you referring to and how are those security issues related to
Qubes or Qubes specific. If there is a problem with the Intel hardware,
with the xen hypervisor, or Linux bugs, this has nothing to do with Qubes.

So my second problem is: this approach would assume that I agree with
> every choice that the Qubes team does, which I don't.
>

You don't have to, but the good thing is that you can take the part you
like and tweak the part you don't like it improve on top of what you get.

[799]

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/CAJ3yz2vi_jaEUeUM-OwL02YSC5mRQoDHtEV-RgCzcwr3xE4j5w%40mail.gmail.com.

Re: [qubes-users] Qubes/class, Was: slightly off-topic: self-resetting OS idea

[panina]

On 8/26/19 6:27 PM, 799 wrote:
> Hello
> 
> David Hobach mailto:trip...@hackingthe.net>>
> schrieb am Mo., 26. Aug. 2019, 11:22:
> 
> On 8/26/19 10:24 AM, panina wrote:
> > Hi!
> >
> > This is not strictly Qubes-OS related, rather inspired by Qubes.
> >
> > I've been struggling with some parts of Qubes usage. Most of the time,
> > it is overkill for me, and putting some strain on my computer. The
> > bugginess is also quite annoying, whenever I just need to do some
> > everyday work.
> > I've been thinking I'd like some form of dual-boot solution, or
> possibly
> > a Live USB that could be used.
> > Most of the time I work with ssh and webapps, so the only persistent
> > data I need to work will fit on a smartcard.
> >
> > My thought is to have an installation that mounts most of the root
> > partition as readonly, and uses ramdisks wherever the system wants to
> > write (e.g /var/log). I'm also thinking it should be possible to get a
> > fingerprint or somesuch of the root partition, and use my TPM2 to
> check
> > this.
> >
> > The system should also have a possibility to update itself, that I can
> > choose to do in environments that I feel is safe.
> >
> > I am wondering if anyone knows of an OS that works like this? Or if
> > anyone knows of tools that might accomplish parts of this?
> 
> Ehm... You're describing Qubes OS with disposable VMs there? The
> fingerprinting is essentially AEM?
> 
> If you need to keep your data on an external disk (SDCard), you can use
> either a manual approach with qvm-copy, permanently attach the disk
> to a
> single disposable VM with a fixed name or use an automated solution
> such
> as [1]. You might also want to look into qvm-pool.
> 
> [1] https://github.com/3hhh/qcrypt
> 
> 
> I don't know why people are complaining about the "bugginess" and that
> it needs more performance.
> 
> If you buy the right hardware you'll not run into lots of bugs and get
> enough performance to run qubes. You can buy a Lenovo T530/430, W530,
> X230 for not much money, add a SSD some RAM and you'll not run into
> performance problems (normal use).

This is a view that I see quite a lot. It is a whole different
discussion. Hence the re-subjecting.

Firstly, this view completely lacks class analysis. Not everyone can
afford to buy the newest shiny. A lot of us have to use whatever we can
get our hands on.
Whenever a secure OS is mentioned, Qubes is the go-to. Everyone comes
here. The approach that you have to buy new, specific hardware to have a
functioning OS means anyone poor, or in a country with a poor dollar
exchange rate, is left behind.
If Qubes was one of many options, this would cause less damage. But
right now, there aren't many alternatives. So privacy and secure tech
becomes an economic issue, a luxury. I firmly claim that basic privacy
should be a human right.

However, this is a completely different discussion.

Furthermore, Qubes currently concentrates on Intel hardware. I do not in
any way feel that this is a sane choice right now. I feel it would be
rather stupid to buy new hardware right now that has Intel processors.
Too many security issues, and new ones popping up all the time.
So my second problem is: this approach would assume that I agree with
every choice that the Qubes team does, which I don't.

> 
> As David mentioned Qubes will do exactly what you need if you're using
> disposable VMs.
> Regarding the fingerprinting, you can use AEM (Anti Evil Maid) or write
> your own script.
> I tried something which will fingerprint all files in /boot and gpg sign
> the signature which is then stored in the LUKS encrypted root partition.
> 
> You can then free booting into Qubes check the current boot Partition
> against the fingerprints.
> https://github.com/one7two99/my-qubes/tree/master/docs/boot-protect
> 
> Not sure if this is really secure, would be nice to have this checked by
> someone who knows more about security.
> 
> [799]
> 
> -- 
> You received this message because you are subscribed to the Google
> Groups "qubes-users" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to qubes-users+unsubscr...@googlegroups.com
> .
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/qubes-users/CAJ3yz2vkPZAv4pTQzTn9_W%2Bp_yC5_ZtOz3rmdvi59on60u88Qw%40mail.gmail.com
> .

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qube