6 ms·

the base model is 1600 usd? for an i5? It looks pretty neat but i feel like it's over priced right?

by bechampion 11y ago

TuringTest 11y ago
Where else can you get a security-focused preinstalled laptop with higher specs for less money?
- analognoise 11y ago
  If you don't own the system, from boot to microcode, you only get the illusion of security. You're essentially paying a premium to have someone else install an OS for you - color me unimpressed.
  - dandelion_lover 11y ago
    Security is not a boolean. It's all about how expensive is to attack you. Purism and QubesOS make it quite expensive.
    - dogma1138 11y ago
      Purism plays absolutely no role here it's an off the shelf laptop for all intents and purposes. And as far as QubesOS goes well it is still quite immature and has not received as much security scrutiny as say Linux. As some one who've used QubesOS for some times it's biggest downfall is the limitations of Xen in regards hardware utilization such as 3D acceleration. QubeOS does not offer a share virtualized hardware layer which can support acceleration which means that things like 3D acceleration are done through passthrough(this to some extent is a limitation of Xen, and it's portrayed as a security feature in QOS). Since it uses passthrough you can only assign a single AppVM to benefit from the acceleration and by default your physical GPU is assigned to Dom0 (it's actually a bit tricky to assign it to an AppVM). This leads to 3D acceleration being pretty much non existent in your actual applications and this is needed today for everything from browsing to even office use (MS Office 2013 and onward requires DX9/10 compatible GPU). So in day to day use you end up having pretty much all of your activity either done in Dom0 or if you decide to tweak (which reduces performance considerably since your main desktop loses 3D acc.) your system in a a single AppVM which some what defeats the benefit of QOS. And even if you have a multi GPU desktop any one who played around with multi-player single host gaming rigs using Xen and multiple GPU's knows just how much of a pain it is to do the passthrough properly, you have to ensure that the UEFI does not initializes the GPU's and once they are assigned to a guest that guest needs to be kept alive, you can't reassign those GPU's without a system reboot, and even suspending the guest might cause some issues as the GPU's are initialized. QubesOS is great in concept but it's still a far cry from a usable general purpose OS and until they either decide to do proper hardware virtualization and reduce the amount of isolation between individual AppVM's or the hardware industry needs to build a new standard for shared passthrough (necro IRQ's!). Considering that passthrough is actually becoming more and more limited in the consumer space to prevent cheap personal computing parts from being used in the data center space I don't think that the latter very likely.
      - throwaway7767 11y ago
        Qubes is very useable for day-to-day computing (though, being a linux desktop, might not be for everyone). It's just not a good fit for your usecase, because it includes gaming. I wouldn't hold my breath for this to change anytime soon. There are good reasons why the qubes GUI protocol is implemented the way it is, it's to keep untrusted data processing in dom0 to a minimum. Qubes OS is very useable, as long as you don't need 3D acceleration. My solution to this is to have a seperate gaming PC that's completely untrusted. The Qubes devs will not sacrifice the fundamental security properties of the system in the way you suggest to better service gamers.
        dogma1138 11y ago
        That would be a valid argument 10-15 years ago however today you need 3D acceleration for (MS) Office. Running YouTube at anything above 720p is difficult, 60fps isn't functional same goes for 1440/2160p. Other applications like graphical applications, video editing, CAD etc are also non functional. I don't know why have you brought up gaming I never did, but please don't even attempt to deny the fact that 3D acceleration is required for many many day to day use cases today that have nothing to do with gaming. If you use MS Office for work, if you do any sort of content creation, and if you just want to enjoy HD media QubesOS is not for you and those aren't some edge cases. Yes if you only use VIM ,Libre Doc's (And even Libre Office is using OpenCL these days for spreadsheets and many other things) and Gmail you can use QubesOS without any restrictions but if you need other thinks like for example even basic 3D modeling/slicing software for your 3D printer, Sketchup or Ligthroom well then sorry my dear.
        rolandr 11y ago
        OK - I will deny it, just by the simple fact that for the last 6 months I have used Qubes exclusively, including daily use of MS Office 2013 (and more recently Office 2016) for work within a Windows 7 HVM (I have not opted to use the Qubes Windows tools yet). The experience has been entirely satisfactory, and I have not regretted it. I assume that if Office does make use of DirectX, there is a software rendering pipeline fallback that works fine (but perhaps not at 200 fps). For convenience, I have also used Inkscape and Gimp - other content creation software, I suppose - within the Windows HVM session without any problems. At one point, I even made use of a professional level parametric CAD software package within an HVM session - it worked, even if admittedly it would had some fancier rendering options available with a dedicated GPU. Your complaints about lack of 3D acceleration seem to reflect your personal preferences, and are not an actual requirement for making use of MS Office or many other software packages. My six months of production level use provides simple proof by existence. There are some things - games included - that do need something like GPU passthrough, but your view of the situation is either outdated or simply wrong.
  - nickpsecurity 11y ago
    Security is relative to certain threats. Many people worried about Chinese or Russians stealing IP will be less worried about US subversion. Likewise, for Chinese companies the open Loongson systems probably reduce risk of Western subversion. High assurance like separation kernels reduce risk against high end attackers or kernel 0-days whike mandatory controls contain app-level attacks which are max skills of many damaging attackers. So, all or nothing is wrong way to look at INFOSEC. I mean, if it's nation states, best to avoid computers in favor of trusted people, paper, and memory. ;) However, many methods provide a meaningful increase of security or just recoverability. Worth remembering. This particular product: too much risk in it for me to say if it does. People are probably safer with OpenBSD or hardened Linux/BSD on high-end embedded board or old workstation.
- dogma1138 11y ago
  This is security theater marketed for a steep markup. Until they can get get an oss version of all the firmware it's just as secure as any off the shelf laptop with a clean install of the OS of your choosing. If you want more security get an old Lenovo/IBM think pad mod the bios chip and get libreboot. The cpu, graphics card, hdd, Ethernet and more have more lines of code in them than your OS kernel most likely and that code rarely gets audited even internally.
  - random778 11y ago
    True (to an extent), but take into account how much more expensive putting together a small amount of units (compared to say Dell) is. One really needs to go through the costing of something, even a simple PCB, to realize the orders of magnitude difference there is. Unfortunately the firmware issue is also true. If a million people bought this laptop (at 2x the price of a XPS 13) they might be able to convince someone to open up some of that firmware. But that's not going to happen.
    - dogma1138 11y ago
      They more likely than not using a chinese OEM laptop, i really doubt that they spin their own motherboard even peripheral connectors require a ton of RF compliance these days. You can get a decent core i7/i5 OEM laptop made for about 500$ these days http://www.alibaba.com/product-detail/Quad-core-ultrabook-i7-Oem-ultrabook_60390499090.html?spm=a2700.7724838.30.187.otqEMO http://www.alibaba.com/product-detail/Quad-core-ultrabook-i7... Add to that some case customization and build in their specific features like wireless "kill switches" (AKA that switch all laptops used to have when wireless used to cut your battery time by half and you needed to use them on planes) and you can still get it made well under 600$, 250-300% markup is very steep in the current hardware industry.
      - nickpsecurity 11y ago
        I'd wonder about the quality of that one. Copy-cat chips and components are a huge problem with Chinese suppliers.
random778 11y ago
Yep, it's double what a similar Dell XPS 13 costs.
skrowl 11y ago
I was interested until I saw the price as well. I'll install Xen on something myself and save half, thanks.

the base model is 1600 usd? for an i5? It looks pretty neat but i feel like it's over priced right?

TuringTest 11y ago

Where else can you get a security-focused preinstalled laptop with higher specs for less money?

analognoise 11y ago
If you don't own the system, from boot to microcode, you only get the illusion of security. You're essentially paying a premium to have someone else install an OS for you - color me unimpressed.
- dandelion_lover 11y ago
  Security is not a boolean. It's all about how expensive is to attack you. Purism and QubesOS make it quite expensive.
  - dogma1138 11y ago
    Purism plays absolutely no role here it's an off the shelf laptop for all intents and purposes. And as far as QubesOS goes well it is still quite immature and has not received as much security scrutiny as say Linux. As some one who've used QubesOS for some times it's biggest downfall is the limitations of Xen in regards hardware utilization such as 3D acceleration. QubeOS does not offer a share virtualized hardware layer which can support acceleration which means that things like 3D acceleration are done through passthrough(this to some extent is a limitation of Xen, and it's portrayed as a security feature in QOS). Since it uses passthrough you can only assign a single AppVM to benefit from the acceleration and by default your physical GPU is assigned to Dom0 (it's actually a bit tricky to assign it to an AppVM). This leads to 3D acceleration being pretty much non existent in your actual applications and this is needed today for everything from browsing to even office use (MS Office 2013 and onward requires DX9/10 compatible GPU). So in day to day use you end up having pretty much all of your activity either done in Dom0 or if you decide to tweak (which reduces performance considerably since your main desktop loses 3D acc.) your system in a a single AppVM which some what defeats the benefit of QOS. And even if you have a multi GPU desktop any one who played around with multi-player single host gaming rigs using Xen and multiple GPU's knows just how much of a pain it is to do the passthrough properly, you have to ensure that the UEFI does not initializes the GPU's and once they are assigned to a guest that guest needs to be kept alive, you can't reassign those GPU's without a system reboot, and even suspending the guest might cause some issues as the GPU's are initialized. QubesOS is great in concept but it's still a far cry from a usable general purpose OS and until they either decide to do proper hardware virtualization and reduce the amount of isolation between individual AppVM's or the hardware industry needs to build a new standard for shared passthrough (necro IRQ's!). Considering that passthrough is actually becoming more and more limited in the consumer space to prevent cheap personal computing parts from being used in the data center space I don't think that the latter very likely.
    - throwaway7767 11y ago
      Qubes is very useable for day-to-day computing (though, being a linux desktop, might not be for everyone). It's just not a good fit for your usecase, because it includes gaming. I wouldn't hold my breath for this to change anytime soon. There are good reasons why the qubes GUI protocol is implemented the way it is, it's to keep untrusted data processing in dom0 to a minimum. Qubes OS is very useable, as long as you don't need 3D acceleration. My solution to this is to have a seperate gaming PC that's completely untrusted. The Qubes devs will not sacrifice the fundamental security properties of the system in the way you suggest to better service gamers.
      - dogma1138 11y ago
        That would be a valid argument 10-15 years ago however today you need 3D acceleration for (MS) Office. Running YouTube at anything above 720p is difficult, 60fps isn't functional same goes for 1440/2160p. Other applications like graphical applications, video editing, CAD etc are also non functional. I don't know why have you brought up gaming I never did, but please don't even attempt to deny the fact that 3D acceleration is required for many many day to day use cases today that have nothing to do with gaming. If you use MS Office for work, if you do any sort of content creation, and if you just want to enjoy HD media QubesOS is not for you and those aren't some edge cases. Yes if you only use VIM ,Libre Doc's (And even Libre Office is using OpenCL these days for spreadsheets and many other things) and Gmail you can use QubesOS without any restrictions but if you need other thinks like for example even basic 3D modeling/slicing software for your 3D printer, Sketchup or Ligthroom well then sorry my dear.
        rolandr 11y ago
        OK - I will deny it, just by the simple fact that for the last 6 months I have used Qubes exclusively, including daily use of MS Office 2013 (and more recently Office 2016) for work within a Windows 7 HVM (I have not opted to use the Qubes Windows tools yet). The experience has been entirely satisfactory, and I have not regretted it. I assume that if Office does make use of DirectX, there is a software rendering pipeline fallback that works fine (but perhaps not at 200 fps). For convenience, I have also used Inkscape and Gimp - other content creation software, I suppose - within the Windows HVM session without any problems. At one point, I even made use of a professional level parametric CAD software package within an HVM session - it worked, even if admittedly it would had some fancier rendering options available with a dedicated GPU. Your complaints about lack of 3D acceleration seem to reflect your personal preferences, and are not an actual requirement for making use of MS Office or many other software packages. My six months of production level use provides simple proof by existence. There are some things - games included - that do need something like GPU passthrough, but your view of the situation is either outdated or simply wrong.
- nickpsecurity 11y ago
  Security is relative to certain threats. Many people worried about Chinese or Russians stealing IP will be less worried about US subversion. Likewise, for Chinese companies the open Loongson systems probably reduce risk of Western subversion. High assurance like separation kernels reduce risk against high end attackers or kernel 0-days whike mandatory controls contain app-level attacks which are max skills of many damaging attackers. So, all or nothing is wrong way to look at INFOSEC. I mean, if it's nation states, best to avoid computers in favor of trusted people, paper, and memory. ;) However, many methods provide a meaningful increase of security or just recoverability. Worth remembering. This particular product: too much risk in it for me to say if it does. People are probably safer with OpenBSD or hardened Linux/BSD on high-end embedded board or old workstation.
dogma1138 11y ago
This is security theater marketed for a steep markup. Until they can get get an oss version of all the firmware it's just as secure as any off the shelf laptop with a clean install of the OS of your choosing. If you want more security get an old Lenovo/IBM think pad mod the bios chip and get libreboot. The cpu, graphics card, hdd, Ethernet and more have more lines of code in them than your OS kernel most likely and that code rarely gets audited even internally.
- random778 11y ago
  True (to an extent), but take into account how much more expensive putting together a small amount of units (compared to say Dell) is. One really needs to go through the costing of something, even a simple PCB, to realize the orders of magnitude difference there is. Unfortunately the firmware issue is also true. If a million people bought this laptop (at 2x the price of a XPS 13) they might be able to convince someone to open up some of that firmware. But that's not going to happen.
  - dogma1138 11y ago
    They more likely than not using a chinese OEM laptop, i really doubt that they spin their own motherboard even peripheral connectors require a ton of RF compliance these days. You can get a decent core i7/i5 OEM laptop made for about 500$ these days http://www.alibaba.com/product-detail/Quad-core-ultrabook-i7-Oem-ultrabook_60390499090.html?spm=a2700.7724838.30.187.otqEMO http://www.alibaba.com/product-detail/Quad-core-ultrabook-i7... Add to that some case customization and build in their specific features like wireless "kill switches" (AKA that switch all laptops used to have when wireless used to cut your battery time by half and you needed to use them on planes) and you can still get it made well under 600$, 250-300% markup is very steep in the current hardware industry.
    - nickpsecurity 11y ago
      I'd wonder about the quality of that one. Copy-cat chips and components are a huge problem with Chinese suppliers.

random778 11y ago

Yep, it's double what a similar Dell XPS 13 costs.

skrowl 11y ago

I was interested until I saw the price as well. I'll install Xen on something myself and save half, thanks.