Re: [qubes-users] Re: Qubes - Critique (long)

2019-06-27 Thread Marc Griffiths
Thanks for your input Brendan, David, Chris.

Having switched to KDE, the laptop is now completely stable, and in my
opinion far more usable than XFCE.

I'm also running Trisquel on a Thinkpad X200 flashed with Libreboot, which
feels more secure although requires more care over choosing what to
install. I would be keen to see a laptop that supports Libreboot and is
powerful enough to run Qubes.

What are your thoughts on LXD? Lightweight enough to run on an X200/T400,
although of course not offering the same compartmentalization as XEN,
sharing the same kernel etc

[and yes something can 'feel' more secure, insight deeper into the stack
results in more trust]


Marc Griffiths
marc.d.griffi...@gmail.com



On Mon, 20 May 2019 at 20:58,  wrote:

> On Friday, May 10, 2019 at 2:09:09 PM UTC-4, Chris Laprise wrote:
> > On 5/10/19 12:16 PM, Marc Griffiths wrote:
> > > Next step for me is ordering a T400, which doesn't have Intel
> Management
> > > Engine, supports Libreboot, and has proven itself as an uncrashable
> > > workhorse. I used to run Windows and SUSE on this laptop back in
> > > 2008-2011, it never crashed, despite running a complex J2EE dev
> > > environment. I will miss having 16GB RAM, but the i7 I can happily
> part
> > > with.
> >
> > I doubt that Qubes will install or run on a T400. Qubes was initially
> > developed on Sandy Bridge-era hardware, and the requisite virtualization
> > features in chipsets was still maturing up to that point.
> >
> > I feel obliged to mention that if you want to avoid management engines
> > and a raft of other processor vulns, you should look to the AMD 15h
> > generation of chips (circa 2013). In the form of a Lenovo G505s A10,
> > installing Qubes first requires re-flashing the firmware with
> > Coreboot... an exercise that I'm about to try. :)
>
> As much as is really quantifiable...what percent of the real-world risk of
> the Intel ME to end-user is related to the fact that the
> manufacturer-whitelisted networking chipsets are directly usable by the
> firmware, primarily in support of the AMT feature set (and anything
> remotely hijacking via AMT, potentially without local compromise)?
>
> Which is to say: isn't one important mitigation of remote pwnage the
> disabling and/or removing (as appropriate) of the manufacturer-supplied
> network connections? Without a custom firmware, one can always use a
> USB-based wifi/ethernet connection..and with custom firmware (when
> possible) you can bypass the hardware whitelist and supply your own
> third-party wifi/bt card that the local AMT portion of the firmware has not
> been designed to talk to.
>
> Brendan
>
> --
> You received this message because you are subscribed to the Google Groups
> "qubes-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to qubes-users+unsubscr...@googlegroups.com.
> To post to this group, send email to qubes-users@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/qubes-users/d84a4fe5-1dcf-4c77-b86a-663672532fcd%40googlegroups.com
> .
> For more options, visit https://groups.google.com/d/optout.
>

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/CAPsYiwpVzO%3DN1Siver%2BYrKhsULLTTbVZmw59vm9utBxO%2BcLp-A%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Re: Qubes - Critique (long)

2019-05-10 Thread Marc Griffiths
Hi everyone. Nice critique John. To throw in my perspective as an
experienced Linux user switching to Qubes as sole laptop OS a few months
back. Primary usecase for me is #1 increased security when using crypto
exchanges and #2 the feeling of spinning up an environment that I have
confidence in being private, for the writing of personal notes and
reflections.

The concept is awesome, perfectly designed for protection against malicious
applications, websites and devices. Although it offers no protection
against Intel Management Engine.

My experience of installing on a Lenovo Yoga 720 was seamless, everything
worked including the touch screen. However, I experienced a lot of random
browser crashing. Chromium dead birds on a fairly regular basis. Vivaldi,
Chromium, and Firefox browser windows disappearing without error, on both
Fedora and Debian. Upgrading to Fedora 29, and upgrading dom0 didn't
resolve the problem. A few times the desktop became unresponsive, and while
I was able to ctrl+alt+F2 to dom0, it wasn't clear how I could view
processes running on a particular VM.

I'd be interested in knowing what audience Qubes is aimed at. With the
rapidly increasing public awareness on cyber-security and privacy, Qubes
could very easily find itself in high demand. At present though it's only
going to appeal to experienced Linux users, which is a shame, because it
wouldn't be that much work to make it far more accessible.

If the Qubes team is interested in a larger audience, I would suggest:

   - Include Ubuntu based VM as default, or at least make the process of
   adding a Ubuntu template significantly easier
   - Include a brief getting started guide that covers essentials such as
   cross VM copy/paste, accessing devices, upgrading software etc
   - If we're limited to XFCE, then include guides on customising to be
   more like other environments. Most critical for me was adding shortcuts for
   switching desktops and moving windows between desktops: System tools >
   Window Manager > Keyboard
   - A guide on the limitations: what does Qubes protect you from, what
   does it not protect you from, what are the next steps to improve security.
   Having a colour-coded grid to communicate this would be excellent.

Next step for me is ordering a T400, which doesn't have Intel Management
Engine, supports Libreboot, and has proven itself as an uncrashable
workhorse. I used to run Windows and SUSE on this laptop back in 2008-2011,
it never crashed, despite running a complex J2EE dev environment. I will
miss having 16GB RAM, but the i7 I can happily part with.

Marc Griffiths

marc.d.griffi...@gmail.com



On Sun, 31 Mar 2019 at 11:18,  wrote:

> Chris mentioned:
>
> "The current Firefox ESR does have a tendency to freeze temporarily when
> memory gets low. I'm considering switching to the non-ESR 'firefox'
> package in Debian to see if the newer versions are better in this respect."
>
> My computer (Intel NUC7i7) has 32 GB RAM, so I doubt I am having low
> memory issues -- but I suppose with my tendency to open a lot of tabs, it
> could happen.
>
> I finally got around to trashing the ESR version of Firefox and installing
> the latest "regular" release. It is too early to tell (less than a day),
> but I have not run into a problem yet (I had been running into the problem
> at least once or twice a day).
>
> --
> You received this message because you are subscribed to the Google Groups
> "qubes-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to qubes-users+unsubscr...@googlegroups.com.
> To post to this group, send email to qubes-users@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/qubes-users/9fbf11f4-2ca3-45f5-ba11-b708b405ba3a%40googlegroups.com
> .
> For more options, visit https://groups.google.com/d/optout.
>

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/CAPsYiwrunua7mm-4vES16ocftMzAbEnKRMevN5Nqoyeb_OpxDQ%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.