Re: [qubes-users] Qubes - Critique (long)

2019-03-16 Thread John Goold
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

On 3/16/19 6:35 PM, js...@bitmessage.ch wrote:
> 
>> [Question] So, what do other Qubes users do to protect their
>> families in case they die/get killed, get imprisoned, go
>> missing?
> 
> In addition to (very) occasional full backups using default qubes
> tools, i also backup important data to an external hard drive with
> a luks encrypted partition, so it can be easily accessed outside of
> qubes if needed.
> 
But that still needs someone (spouse, child, executor of your estate) to
have access to a key phrase (if that is the right term). What about
bank account numbers, etc. If you use KeePassX 2 or similar, what about
access to it?

Do you have the necessary passwords written down with instructions,
sealed in an envelope and stored in a safety deposit box? Something
else?

We tend to keep more and more financial, legal and medical information
on our personal computers rather than keeping paper copies (I am an old
guy but my wife and I keep everything in electronic form unless
required by law to keep a paper copy -- so I expect the "younger" crowd
probably tends to do so as well).

We keep at least two backups of such data -- copies to our shared file
server and backups to external drives.

One of our children has the master password to our password vaults --
there is a non-negligible possibility that both of us could be badly
hurt (or killed) in the same accident (e.g. plane or car crash).

Anyway, with our emphasis on Qubes and security, I was curious about
this other aspect of people's affairs. Do you have all your important
data locked down in Qubes so *only* you can get at it?

John
-BEGIN PGP SIGNATURE-

iQEzBAEBCAAdFiEEe8Wcf7Po7bts2Rl4jWN9/rQYsRwFAlyNmBMACgkQjWN9/rQY
sRyUAwgAggvJpp6yKTRGfsM+W3EmkAb/nS/reESCCFbyifgFgqr5b2IWclFzZyAi
Nra9Q3KiuCaj4rS4YduTE0HcEsFKNoj9fY/mkS+EalriIhyw4DWMeoupZ/q4Nun1
7pbLiPKDhJAccLo1ZNEsQQYpgGnUhUMeR3hFhdawgerss9TASt8lInmnfTNrp9ei
uv5l7LOc/sAgy0yEvqYqxJFKIA70xgThK/SWHcqwQx02TX5LCAPXAtM4VFNAw08U
BbL+wNUp8c/FcZ2dELtH2iy2Hyraj11b2UCDh7QXv/Uih6358hqkfIT+PZWpyVJq
DpLe09Ef5FuWltS4HGVqvDJl+4kjKg==
=urg+
-END PGP SIGNATURE-

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/dd6ac889-070c-cc83-6cc7-a5d1733cd78a%40gmail.com.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Qubes - Critique (long)

2019-03-16 Thread jsnow

Hi John,

John Goold:

* When launching a program from the Qubes menu, particularly if the
   target   appVM has to be started, the program often fails to be
   launched. This happens very frequently with the Text Editor.

   This is annoying as one waits a bit in case one is simply being
   impatient, or at least I do, so as not to launch two copies of the
   program by accident.


I experience that too on debian (i don't use fedora appvms). As Chris 
said it's a longstanding bug with gnome apps like nautilus and gedit.


Actually i much prefer the nemo window manager, i think it's great and 
much better than nautilus (dolphin works too but i don't like it as 
much). You can install whatever window manager you want in the template 
and use it in your appvms.


By the way does anyone know how to add the qubes specific functions 
(move/copy to vm, open in dispvm) to the context menu in nemo? It would 
be nice to not have to switch to nautilus for those functions (i know i 
can use cli for it too tho).



* Ignoring whonix (I do not use it... yet), there are two template VMs
   in the vanilla Qubes 4.0.1 installation: Fedora and Debian. However,
   they have not been treated equally, with Debian being the loser. The
   Qubes documentation indicates that Fedora was favoured for security
   reasons.


I'm also not sure about this. My understanding is that debian is 
actually better than fedora from a security standpoint because of how 
updates are done (fedora updates being more vulnerable to man in the 
middle attacks).



   At least for some people, it seems Debian is a necessity, but it is
   not given the attention it deserves. At a minimum, a GUI software
   installer should be included in the Qubes distribution which would
   make it much easier for people to install other software they feel
   inclined to use.


I'm not sure about the default debian template in 4.0, but i remember 
the default debian 8 template in 3.2 had a gui package install/update 
tool (labelled "Packages" or "Package Updates" or something like that). 
I remember using it a few times, but i mainly just use cli to install 
software.


If the new debian template doesn't have that by default, as airelemental 
said you can install one.



   Using Linux and now Qubes, I not only do not shutdown the computer
   (i.e. power-off), but I do not logout -- I simply "Lock the Screen"
   and power-off my monitor.


I do the opposite, i reboot every day, and i never had any problems with 
copy and paste between qubes, and i very rarely have other problems like 
crashes. I would at least reboot after installing dom0 updates.



[Question] So, what do other Qubes users do to protect their families
 in case they die/get killed, get imprisoned, go missing?


In addition to (very) occasional full backups using default qubes tools, 
i also backup important data to an external hard drive with a luks 
encrypted partition, so it can be easily accessed outside of qubes if 
needed.


--
Jackie

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/5fdb49c0-bf55-98b3-8306-af7e4aeb4311%40bitmessage.ch.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Qubes - Critique (long)

2019-03-16 Thread Chris Laprise

On 3/16/19 1:39 PM, Andrew David Wong wrote:

I agree that backups are the best assurance, but this is in no way
Qubes-specific. I'd say the same thing about any operating system.


However, Qubes does require the use of snapshot-capable storage for
reasonable efficiency and this is not yet Linux' strength.



Here's where Chris and I disagree. I've been using Qubes' built-in
backup functionality for many years to great effect. Granted, I
usually run it overnight, so time and system load aren't concerns for
me. It just depends on your needs.


I was probably too vague here. The idea was that, apart from the issue 
of backups, storage integrity on a Linux COW layer (Thin LVM, Btrfs) 
isn't regarded as top-notch. But I think this is more true of Thin LVM 
than Btrfs. Someone wishing to guard against data loss on their 
Qubes+Linux system in the first place (which seems to be an issue for 
John) could be excused for thinking their options are not the best.



--

Chris Laprise, tas...@posteo.net
https://github.com/tasket
https://twitter.com/ttaskett
PGP: BEE2 20C5 356E 764A 73EB  4AB3 1DC4 D106 F07F 1886

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/bc140a0f-0ba9-79db-321a-42be5f8a8c03%40posteo.net.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Qubes - Critique (long)

2019-03-16 Thread Andrew David Wong
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Thank you, John, for sharing your thoughts with us, and thank you,
Chris, for taking the time for a detailed reply. I'll offer what I can
on just a few points.

On 16/03/2019 6.31 AM, Chris Laprise wrote:
> Hi John,
> 
> That's an interesting background and list of wants. I've been using
> Qubes for some time and can try to address a few of your issues.
> 
> [...]
> 
>> 
>> The kicker came when Firefox stopped playing Flash content in my
>>  untrusted appVM, complaining that I needed an up to date
>> version of Flash. I installed the most recent version, but that
>> did not solve the problem. The problem is/ was something to do
>> with Fedora (or the version of Firefox for Fedora or ??).
> 
> I haven't used Flash in a long time so I can't help there. In 
> general its best to find an alternative that doesn't rely on
> Flash, which is becoming a dead format. Typically Flash is replaced
> by HTML5 web apps (and most websites have made this switch 
> automatic).
> 

You might want to try the Google Chrome browser for this. (You may
need to enable its built-in flash functionality if it's disabled by
default.)

> [...]
> 
>> My Bottom Line:
>> 
>> I can live with most of the issues described above. What I
>> cannot live with (and worry about) are stability and reliability 
>> issues.
>> 

I, too, am primarily concerned about stability and reliability (after
security, of course).

> [...]
> 
>> 
>> I need some reasonable assurance that data corruption on disk
>> has a very low probability. I need some reasonable assurance
>> that the operating system (the combination of Xen and dom0) is 
>> stable.
> 

In my experience, the probability of data corruption on disk is no
higher (and perhaps even lower) on Qubes than on other more
conventional operating systems. The only kind of instability I've
experienced infrequently in the past on Qubes were crashes (e.g.,
spontaneous reboots), but I've never had any lost or corrupted data on
disk from such events. I've also experienced plenty of BSODs on
Windows, so I think Qubes is batting pretty well on stability.

> The best assurance is regular backups. I don't know what caused 
> your glitch but I've had vanishingly few on Qubes myself since 
> 2013.
> 

I agree that backups are the best assurance, but this is in no way
Qubes-specific. I'd say the same thing about any operating system.

> However, Qubes does require the use of snapshot-capable storage for
> reasonable efficiency and this is not yet Linux' strength.
> 

Here's where Chris and I disagree. I've been using Qubes' built-in
backup functionality for many years to great effect. Granted, I
usually run it overnight, so time and system load aren't concerns for
me. It just depends on your needs.

> [...]
> 
> I hope this response helps you out some. Right now Qubes appears
> to be in a state that's mostly suitable for "security techies";
> There is certainly room for improvement and your critique has made
> me think that some new issues need to be opened to help address
> the usability issues.
> 

Agreed. I think that many of us have been motivated to become
"security techies" by our desire to use Qubes. This isn't a bad thing
in itself (it's good to learn new skills), but we don't want it to be
a requirement either.

- -- 
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org

-BEGIN PGP SIGNATURE-

iQIzBAEBCgAdFiEEZQ7rCYX0j3henGH1203TvDlQMDAFAlyNNKgACgkQ203TvDlQ
MDBuaBAAiaf05nx3+JYRaVibrmofz+8/auIs3xdHkEI0pXrAlKEg6+Q98k6lnnrw
SdK+vnGl249aINJI7uJ5swx6zK+rsCR1rXp25lBT6AFpwfTefbXrIcMVcuXGfj8F
XTWiyeb2Tw5ooKfrbYuXGTtrN9O4OQ/q5/r9GY2oSsj3/lf8KiMH7KkxFbgLMSUh
oCrZ2BrmvpqFm90paB4C4nqCfe/2HTDKjcIHSL01H0FfAhhGp0hLymwQtpVy0atr
80OKQc0LDc0i/w6tIhDQfWDVVAThVyEYF15tSUNDi6eE9BvNqijrN0zYs+La5pTS
AS1Cy1DHdO/ksM0U/083LDo592oKvHdME0XggbBwBVamLvp8wcf4qaLqy83XDbuR
1EgWaPoB5Y8xmQptPJd9ZV93do3p0MuYnpzU+JM6a6U02gW1DQA6apFMvPotxYYE
s9djUGQ7b13R+udbfDqVebrnlf5f+OovZJvZgdQI2gKOMBXe9ZfKAMH1zH8tDcyc
i15diwQ5tSjk70Fiiw/knrxtNDVcHnF/bFq1vQirAsSCCLQvS8CMue4zDzBOSvND
5OPCTdW5VXm7ieCoT+K2uHq+bVdqIf8vzBf67bkG+m1RXBnXLZvnSUbkgPWeBD2N
kbvgpBoKUVRoDi5q42EDVuPZ/M0h2sQPqUZZSTsQxETh7JiAg70=
=zU1k
-END PGP SIGNATURE-

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/3014fc66-e2f2-0dd6-1fea-9ae9542d0022%40qubes-os.org.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Qubes - Critique (long)

2019-03-16 Thread airelemental



Mar 16, 2019, 2:31 AM by jrg.desk...@gmail.com:

> Issues...
>
> * When launching a program from the Qubes menu, particularly if the
>  target   appVM has to be started, the program often fails to be
>  launched. This happens very frequently with the Text Editor.
>
Interesting, my experience is limited to mostly debian-based templates and for 
those, the only program that fails to start from the menu is gnome-terminal. 

>  Since I had been using Linux distributions based, directly or
>  indirectly, on Debian, when I first set up Qubes, I created my appVMs
>  based on Debian. That  was painful as I then had to install a lot of
>  basic software.
>
>  When I re-read the documentation, I realized the security reasons,
>  so I switched all my appVMs (except one!) back to Fedora. It was not
>  painful, but I would have rather have spent the time doing something
>  else.
>
>
I've never come across guidance favoring Fedora over Debian in the docs. Can 
you provide a link? 

>  Since Firefox and Flash were working fine on my Linux Mint laptop
>  (which I use "to play with"), I re-based my untrusted appVM on Debian
>  and, lo and behold, Firefox and Flash worked just fine. This, by the
>  way, was when I attempted to use Chromium.
>
This is how I used to get flash working too - chromium + some flash plugin on a 
debian-based appvm. Thankfully flash is dying and I don't need it anymore.

>  At least for some people, it seems Debian is a necessity, but it is
>  not given the attention it deserves. At a minimum, a GUI software
>  installer should be included in the Qubes distribution which would
>  make it much easier for people to install other software they feel
>  inclined to use.
>
I think the policy is that Qubes defers to the distro. So if the distro doesn't 
have a GUI installer, than the template won't, and it sounds like it would be 
out of scope for Qubes to provide a GUI installer.

On the flip side, if the distro has an optional GUI package manager, it should 
work. For example, for debian, have you tried installing synaptic in the 
template?

> * Screenshot only appears to work from Qubes Tools. I can "add"
>  "Screenshot" to appVMVs based on Fedora (but not on Debian). But it
>  does not work -- The dialog comes up but, having chosen to select an
> area, I cannot do so.
>  Subsequent attempts to use Screenshot do not even present a dialog.
>
>  Although I have not seen this documented anywhere (which does not
>  mean it is not), it seems logical -- dom0 owns the screen (monitor),
>  so it makes sense that it handles screenshots. However, that means
>  screenshots are saved in dom0 and have to be moved (or, I suppose,
>  copied) to the desired appVM. It seems a bit awkward. If one is in a
>  program in an appVM and decides a screenshot would be nice, it is
>  probably focussed on that window or a portion of it. Since the OS
>  displaying the window "knows" what it is displaying, it seems logical
>  that some kind of screenshot could be made by that OS, but restricted
>  to its window.
>
It *would* be nice if you could right-click a file in dom0 and send to VM using 
the VM picker. Useful for screenshots and log files, for GUI-inclined users.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/La6VTzm--3-1%40tutanota.com.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Qubes - Critique (long)

2019-03-16 Thread John Goold
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

On 3/16/19 7:42 AM, Mike Keehan wrote:

> 
> As for Flash, it is a pain.  Our BBC still uses it extensively, so
> I have to manually download it occasionally and copy the library
> file into the appVMs .mozilla directory when necessary.
> 
Hi Mike,

What a coincidence!  I live in Canada, but use the BBC website on a
daily basis for news and interesting articles. It is really the
only reason I need Flash.

Cheers,
John
-BEGIN PGP SIGNATURE-

iQEzBAEBCAAdFiEEe8Wcf7Po7bts2Rl4jWN9/rQYsRwFAlyNAl0ACgkQjWN9/rQY
sRwJNAf7BWyeG2BfTKJTSFFjTafLrv384+foZ3D1SVEQ587GSaGr8xReuxa8pbaw
Vz4qb0+BnMgr7jQ9audWijZWmhwJGx/IuLmUxbrKfQ2s6RhvvKCeBWox9oWrsT5p
Lh9J8Ek3QCNStSFNPhIqUT3dXLouYeQ3LQCzXbNafV4HTMyvMzmNkkGKZnWmdnIm
45TiHzx1jiRLH30VjgtSgD55QEyGzi6bMPjIK/n9IdQrgmN/evvvF7PSWsQiE3au
C6SyH9RBhfPAzHYY6gopbUcbr2R7sYUugIlu6cA25O0av5vzX+wxxV0ZrwIqvAOq
w5HuvElorhVHTAbEjR22brJZVtnZBA==
=J3rz
-END PGP SIGNATURE-

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/c259349c-4dfd-c777-5fc3-5b22736aef8a%40gmail.com.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Qubes - Critique (long)

2019-03-16 Thread Mike Keehan
On Fri, 15 Mar 2019 21:31:02 -0500
John Goold  wrote:

> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA256
> 
> *A Critique of Qubes*
> 
Hi John,

What a nice read, thank you.  I have a very similar background, and age,
so I was very interested to read your story.

I've been using Qubes now for a few years, and love it.  Have had very 
little problem with it; have used and restored using the builtin backup
scheme; and have updated without problem using just the normal,
stable repositories.

The one thing I can suggest that I do differently to you, is that I
power down my laptop, and boot up afresh each day.  Have always done
this during my professional life (wasn't any choice early on as there
was no suspend option), and I can say that I have not experienced any
of the launch issues you described, nor any copy/paste issues between
VMs, not that I do much of that.

As for Flash, it is a pain.  Our BBC still uses it extensively, so I
have to manually download it occasionally and copy the library file
into the appVMs .mozilla directory when necessary.

Anyway, best of luck,

   Mike.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/20190316124251.274962b1.mike%40keehan.net.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Qubes - Critique (long)

2019-03-16 Thread Chris Laprise

Hi John,

That's an interesting background and list of wants. I've been using 
Qubes for some time and can try to address a few of your issues.



On 3/15/19 10:31 PM, John Goold wrote:

Issues...

* When launching a program from the Qubes menu, particularly if the
   target   appVM has to be started, the program often fails to be
   launched. This happens very frequently with the Text Editor.

   This is annoying as one waits a bit in case one is simply being
   impatient, or at least I do, so as not to launch two copies of the
   program by accident.


This well-known bug appears to center on programs based on Gtk+ and/or 
Gnome. The only way to consistently avoid it is to install Qt/KDE or 
other non-Gtk+ software in the templates. KDE works well and Debian+KDE 
is what the Whonix templates are based on.


The steps on Debian 9:

$ sudo apt-get remove gnome*
$ sudo apt-get install gnome-icon-theme task-kde-desktop
$ su -c "echo export XDG_CURRENT_DESKTOP=KDE >/etc/profile.d/qkde.sh"


After that, you'll need to adjust the Applications tab in the template's 
Settings, and possibly for some of the VMs that are based on it.


(Also switching dom0 to KDE is an option, and this has solved a raft of 
usability issues for me.)




* When a USB device is attached to an appVM, there is an appropriate
   notification. When it is detached, there is a notification that the
   device is being detached, but no notification to indicate that it has
   been successfully detached  so how long should one wait before
   unplugging it?


There is probably no delay required but a couple of seconds suffices for me.



* Ignoring whonix (I do not use it... yet), there are two template VMs
   in the vanilla Qubes 4.0.1 installation: Fedora and Debian. However,
   they have not been treated equally, with Debian being the loser. The
   Qubes documentation indicates that Fedora was favoured for security
   reasons.


IIRC there is mention that Fedora was chosen for convenience, not 
security. Fedora actually presents a security problem for Qubes and 
there is an open issue for moving Qubes off of it.


The problem with the Debian template is that its not preconfigured with 
an array of familiar apps, and when you do add them some of the default 
file/app associations remain set to unfriendly substitutes (like text 
files being associated to emacs, pictures set to imagemagik or gimp, 
etc.). Switching to KDE has set these associations to reasonable defaults.


Its also doesn't have the full set of kernel firmware packages installed 
but that's easy to remedy.




   Since I had been using Linux distributions based, directly or
   indirectly, on Debian, when I first set up Qubes, I created my appVMs
   based on Debian. That  was painful as I then had to install a lot of
   basic software.

   When I re-read the documentation, I realized the security reasons,
   so I switched all my appVMs (except one!) back to Fedora. It was not
   painful, but I would have rather have spent the time doing something
   else.


I would like to know where it says this about security. Most Qubes users 
consider Debian to be (in general) more secure. The open issue for 
migration away from Fedora is at:


https://github.com/QubesOS/qubes-issues/issues/1919



   The kicker came when Firefox stopped playing Flash content in my
   untrusted appVM, complaining that I needed an up to date version of
   Flash. I installed the most recent version, but that did not solve
   the problem. The problem is/ was something to do with Fedora (or the
   version of Firefox for Fedora or ??).


I haven't used Flash in a long time so I can't help there. In general 
its best to find an alternative that doesn't rely on Flash, which is 
becoming a dead format. Typically Flash is replaced by HTML5 web apps 
(and most websites have made this switch automatic).



* Screenshot only appears to work from Qubes Tools. I can "add"
   "Screenshot" to appVMVs based on Fedora (but not on Debian). But it
   does not work -- The dialog comes up but, having chosen to select an
area, I cannot do so.
   Subsequent attempts to use Screenshot do not even present a dialog.

   Although I have not seen this documented anywhere (which does not
   mean it is not), it seems logical -- dom0 owns the screen (monitor),
   so it makes sense that it handles screenshots. However, that means
   screenshots are saved in dom0 and have to be moved (or, I suppose,
   copied) to the desired appVM. It seems a bit awkward. If one is in a
   program in an appVM and decides a screenshot would be nice, it is
   probably focussed on that window or a portion of it. Since the OS
   displaying the window "knows" what it is displaying, it seems logical
   that some kind of screenshot could be made by that OS, but restricted
   to its window.

   If not, why is it possible to "add" Screenshot to an appVM?


Qubes doesn't limit which apps can be installed in templates. So this is 
considered more of a "sensible 

[qubes-users] Re: i9-9980XE or i9-7980XE on Gigabyte X299 DESIGNARE EX or AMD 2990WX TR on Gigabyte X399 DESIGNARE EX?

2019-03-16 Thread Foppe de Haan
On Saturday, March 16, 2019 at 12:11:13 AM UTC+1, jrsm...@gmail.com wrote:
> There's nothing even close to these on the HCL, but would like to know if 
> anyone has attempted either of these with 4.0.1 and succeeded.  These are 
> essentially the same base hardware as given in the BoM for the recently 
> announced System76 Thelio Major open source hardware desktop systems.

other TR-based systems have been used (see 
https://github.com/QubesOS/qubes-issues/issues/4309), and beyond that you just 
need kernel support, which there is. So you should be fine (with either, though 
the former will ofc set you back well over a grand more, for less i/o, threads).

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/4166ca92-87c5-477f-b953-310e78a1731d%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.