7 ms·

PureOS: Freedom, Privacy, and Security

131 points by leephillips 6y ago

teodorlu 6y ago
I've been using Ubuntu as my primary OS for three years. I'm largely happy with the user experience. Should I switch to PureOS?
- boogies 6y ago
  It may depend on your hardware. If it wasn’t made to support Free software it likely doesn’t — particularly for firmware for WiFi cards or Nvidia graphics, which PureOS should not have packages for. Would appreciate an explanation from whoever was downvoting you before.
  - teodorlu 6y ago
    Thanks. I'm currently on a Thinkpad T490s. Intel WiFi and Intel graphics unless I'm mistaken.
    - boogies 6y ago
      No problem. I’d recommend trying it out live, you can get it at https://www.pureos.net/download/ https://www.pureos.net/download/ and then follow the installation instructions (https://tracker.pureos.net/w/installation_guide/live_system_installation/ https://tracker.pureos.net/w/installation_guide/live_system_...) from there if it works well (make sure to copy your /home directory/partition first if you want to keep it), or not install (and maybe try purifying Ubuntu or Debian a bit with the `vrms` package’s assistance) if it doesn’t.
    - fsflover 6y ago
      There are no laptops in the market which support free firmware for WiFi, except those from Purism. So PureOS (without installing additional non-free software) will not work for you. Alternatively one could use this: https://tehnoetic.com/tehnoetic-wireless-adapter-gnu-linux-libre-tet-n150 https://tehnoetic.com/tehnoetic-wireless-adapter-gnu-linux-l....
      - boogies 6y ago
        > There are no laptops in the market which support free firmware for WiFi, except those from Purism. There are at least the handful the FSF RYF certifies.¹ Unfortunately you do appear correct about Intel WiFi not having Free software support² (though that adapter certainly should). ¹https://ryf.fsf.org/categories/laptops https://ryf.fsf.org/categories/laptops ²https://h-node.org/wifi/catalogue/en/1/1/Intel-Corporation/undef/undef/undef/wifi-works/undef https://h-node.org/wifi/catalogue/en/1/1/Intel-Corporation/u...
        ipodopt 6y ago
        I recall running into issues with WiFi firmware from Purism. I installed the prop. driver and got some improvement. Although, I ended up upgrading the wifi chip altogether in the end.
        fsflover 6y ago
        The problem is the lack of freedom-respecting WiFi hardware which supports 802.11ac/ad/ah/ax: https://source.puri.sm/Librem5/community-wiki/-/wikis/Frequently-Asked-Questions#26-why-doesnt-the-librem-5-support-new-wi-fi-standards-80211acadahax https://source.puri.sm/Librem5/community-wiki/-/wikis/Freque....
        fsflover 6y ago
        Yes, there are indeed RYF-certified laptops supporting free WiFi firmware, but they are now vulnerable to Spectre, Meltdown etc, and not fixable. So unfortunately this is not very secure to use them...
reshie 6y ago
libreboot as well is interesting for your lower level stuff.
- bubblethink 6y ago
  libreboot is dead. There hasn't been any new hardware in more than a decade.
  - reshie 6y ago
    ok coreboot. libreboot was a means to simplify it. its "core" is still very alive.
    - fsflover 6y ago
      Coreboot is exactly what Purism laptops have.
96aeb1e335 6y ago
Being unable to connect to the Internet or any network due to a lack of WiFi support is a strong privacy and security protection mechanism indeed. And the freedom is provided by removing your choice to use nonfree WiFi drivers. Leaving that decision to you with a warning of its implications (ala Debian) is not really freedom because you'll make the wrong choice. Don't get me wrong, I'm a big fan of FOSS, but not of doublespeak.
- jancsika 6y ago
  > Leaving that decision to you with a warning of its implications (ala Debian) is not really freedom because you'll make the wrong choice. This is context dependent. Suppose I'm changing an existing laptop from Windows 10 to Debian for a user. Suppose I must install WiFi to convince the user the machine it as all useful. Suppose if I fail to get the machine to work, the user will eventually go out and get another Windows 10 machine. In this case the right choice is to install from nonfree. It's a compromise, sure, but it's clearly less bad than the alternatives and leads to significantly more freedom than the user had before. To not leave room in your philosophy for these cases-- and there are many-- is to create unnecessary rifts among allies. You're doing it right now by implying that Debian proponents aren't True Scotsman due to the existence of nonfree.
- risho 6y ago
  I feel like I must be misreading something, because your second paragraph appears to me to be the doublespeak you claim to dislike. The problem with "free software" fundamentalists is they care more about the freedom of the software than the freedom of the user. Part of free choice from a user perspective is the freedom to run proprietary blobs. Also when it comes to freedom to run or not run proprietary software there is no such thing as a wrong choice, just a personal choice. I would prefer you not force your freedom on me, so that I can be free to do as I please.
  - piaste 6y ago
    > I feel like I must be misreading something, because your second paragraph appears to me to be the doublespeak you claim to dislike. GP's first two paragraphs are very clear irony.
ipodopt 6y ago
A brick respects your privacy but it is not a very useful computation device. I bought a laptop from them and after about 6 months of struggling with PureOS I installed Ubuntu and it has been smooth sailing. One software issue I had with the PureOs install was a hard freeze during the booting about 60% of the time. I hope there is a newcomer to privacy crowd that is willing to air on the pragmatic side of things. Like somewhere between apple and purism.
- deleted 6y ago
  [deleted]
- elagost 6y ago
  System76 also sells laptops with a Linux OS, Coreboot BIOS, and a "disabled" Intel Management Engine. (There's no true way to disable it, but any dangerous parts are removed, rendering it useless) System76 is not a newcomer, though - they've got 15 years of history. I've bought from them and found the experience to be superb.
  - bubblethink 6y ago
    The ME side is not so clear anymore. Pre-nehalem, it could be truly disabled. Up to skylake, it could be "cleaned". Up to cometlake, it could be "asked" to disable itself. From tigerlake onwards, it is quite essential since tigerlake removes S3 sleep, and ME is needed for efficient modern standby.
  - ipodopt 6y ago
    It is true that they are more pragmatic. But still no dice for me. Perhaps, I should be more careful what I wish for, haha. Both System76 and Purism have a "We teach you to fix it" support attitude. So when you run into trouble you are going to have to expend effort. They both have their share of bugs. All I want is something that gets out of my way and works. I don't need the latest specs. As long as they hit a reasonable base the more ethical the better. I do software development on Linux. I don't feel like that is a big ask to have a trouble free Linux laptop. And I knew this when I was making my purchase. At the time Purism was advertising a "luxury" laptop experience coupled with the equivalent price tag. But I got it and 7 days later it wouldn't boot because of a rather nasty software bug (which I am not sure has been resolved [I think it is a rather nasty race condition since its happens indeterministically]) due to their specific configuration. They also lied about the battery life on the website (I get less then two hours and they adv. five hours). And the WiFi doesn't really work no matter what you do as the chassis severally attenuates the signal. Which for me, as a "digital nomad" in SA at the time really really hurt. If I where to do my laptop purchase again ATM I would get a Dell. Something like this: https://www.dell.com/en-us/work/shop/workstations-isv-certified/new-precision-7550-mobile-workstation/spd/precision-15-7550-laptop/xctop755015us_vivp?configurationid=016d1c0b-bd11-4781-81f0-5a74c20c7369 https://www.dell.com/en-us/work/shop/workstations-isv-certif...
anonypla 6y ago
Personally I think QubeOS is probably the best option in terms of Privacy and Security at this stage. If your hardware can handle it (16GB RAM would be best). I would seriously consider QubeOS over PureOS if privacy and security are your concerns. It works pretty well and I've been using it for a while now on not so recent hardware without much issues. Their compartmentalization and seamless virtualization is just amazing and I don't think any other distro offers this with so much convenience.
- _kbh_ 6y ago
  I love qubes my only gripe is that they use the zen hypervisor instead of a minimal formally verified os such as sel4 which I think would go a long way in strengthening the isolation between “domains/containers/etc”.
  - simonebrunozzi 6y ago
    Xen, not Zen.
  - fsflover 6y ago
    What are your problems with Xen? They explain their choice very well: https://www.qubes-os.org/faq/#why-does-qubes-use-xen-instead-of-kvm-or-some-other-hypervisor https://www.qubes-os.org/faq/#why-does-qubes-use-xen-instead....
    - _kbh_ 6y ago
      SEL4 would be a better choice because it is formally verified, there is a much smaller chance of vulnerabilities in SEL4 vs Xen because of this.
      - fsflover 6y ago
        From the above link: What about safe languages and formally verified microkernels? In short: these are non-realistic solutions today. We discuss this in further depth in our Architecture Specification document: https://www.qubes-os.org/attachment/wiki/QubesArchitecture/arch-spec-0.3.pdf https://www.qubes-os.org/attachment/wiki/QubesArchitecture/a....
barnacled 6y ago
This is nice and all and I am being 'that guy' nit picking but I hate the use of 'OS' when this is actually a Linux distribution. It is really confusing as in some cases an 'xxxOS' really is a new OS but more so these days it means 'xxx Linux distribution'. Also given their links to fsf who insist on 'GNU/linux' it is amusing to see the name contain neither GNU nor Linux. As a huge Linux fanboy (I contribute to the kernel minorly as a hobby) I can also see the positive side - using Linux is such a foregone conclusion that we don't even need to mention it any more :)
mjgs 6y ago
I’m a big fan of Linux, and I’ve been thinking and wanting to go full Linux for a while, but there just doesn’t seem to be a single laptop in existence that only runs free software. Every thread I read just turns into an infinite rabbit hole.
- goodcanadian 6y ago
  It's probably not as bad as it appears. I currently have a Lenovo ThinkPad running Ubuntu with no problems, and it is not the first laptop I've run Linux on. Honestly, if you are not using bleeding edge or obscure hardware, you are probably ok. The only time I've had hardware problems with Linux in the last 10 years was a video card (on desktop) that could not initially output audio over HDMI. After a few months, the driver was updated, and all was fine.
  - mjgs 6y ago
    I’ve had very good results using Ubuntu in the cloud. And I have played around with the desktop version a bit. What I was referring to in my comment was when I have researched to try to find a laptop that runs completely free software including all firmware etc, it gets very confusing. I’m not even sure if such a machine exists. I wish there was a site similar to https://caniuse.com https://caniuse.com but for laptops that run Linux.

131 points by leephillips 6y ago

I've been using Ubuntu as my primary OS for three years. I'm largely happy with the user experience. Should I switch to PureOS?

boogies 6y ago
It may depend on your hardware. If it wasn’t made to support Free software it likely doesn’t — particularly for firmware for WiFi cards or Nvidia graphics, which PureOS should not have packages for. Would appreciate an explanation from whoever was downvoting you before.
- teodorlu 6y ago
  Thanks. I'm currently on a Thinkpad T490s. Intel WiFi and Intel graphics unless I'm mistaken.
  - boogies 6y ago
    No problem. I’d recommend trying it out live, you can get it at https://www.pureos.net/download/ https://www.pureos.net/download/ and then follow the installation instructions (https://tracker.pureos.net/w/installation_guide/live_system_installation/ https://tracker.pureos.net/w/installation_guide/live_system_...) from there if it works well (make sure to copy your /home directory/partition first if you want to keep it), or not install (and maybe try purifying Ubuntu or Debian a bit with the `vrms` package’s assistance) if it doesn’t.
  - fsflover 6y ago
    There are no laptops in the market which support free firmware for WiFi, except those from Purism. So PureOS (without installing additional non-free software) will not work for you. Alternatively one could use this: https://tehnoetic.com/tehnoetic-wireless-adapter-gnu-linux-libre-tet-n150 https://tehnoetic.com/tehnoetic-wireless-adapter-gnu-linux-l....
    - boogies 6y ago
      > There are no laptops in the market which support free firmware for WiFi, except those from Purism. There are at least the handful the FSF RYF certifies.¹ Unfortunately you do appear correct about Intel WiFi not having Free software support² (though that adapter certainly should). ¹https://ryf.fsf.org/categories/laptops https://ryf.fsf.org/categories/laptops ²https://h-node.org/wifi/catalogue/en/1/1/Intel-Corporation/undef/undef/undef/wifi-works/undef https://h-node.org/wifi/catalogue/en/1/1/Intel-Corporation/u...
      - ipodopt 6y ago
        I recall running into issues with WiFi firmware from Purism. I installed the prop. driver and got some improvement. Although, I ended up upgrading the wifi chip altogether in the end.
        fsflover 6y ago
        The problem is the lack of freedom-respecting WiFi hardware which supports 802.11ac/ad/ah/ax: https://source.puri.sm/Librem5/community-wiki/-/wikis/Frequently-Asked-Questions#26-why-doesnt-the-librem-5-support-new-wi-fi-standards-80211acadahax https://source.puri.sm/Librem5/community-wiki/-/wikis/Freque....
      - fsflover 6y ago
        Yes, there are indeed RYF-certified laptops supporting free WiFi firmware, but they are now vulnerable to Spectre, Meltdown etc, and not fixable. So unfortunately this is not very secure to use them...

reshie 6y ago

libreboot as well is interesting for your lower level stuff.

bubblethink 6y ago
libreboot is dead. There hasn't been any new hardware in more than a decade.
- reshie 6y ago
  ok coreboot. libreboot was a means to simplify it. its "core" is still very alive.
  - fsflover 6y ago
    Coreboot is exactly what Purism laptops have.

96aeb1e335 6y ago

Being unable to connect to the Internet or any network due to a lack of WiFi support is a strong privacy and security protection mechanism indeed. And the freedom is provided by removing your choice to use nonfree WiFi drivers. Leaving that decision to you with a warning of its implications (ala Debian) is not really freedom because you'll make the wrong choice. Don't get me wrong, I'm a big fan of FOSS, but not of doublespeak.

jancsika 6y ago
> Leaving that decision to you with a warning of its implications (ala Debian) is not really freedom because you'll make the wrong choice. This is context dependent. Suppose I'm changing an existing laptop from Windows 10 to Debian for a user. Suppose I must install WiFi to convince the user the machine it as all useful. Suppose if I fail to get the machine to work, the user will eventually go out and get another Windows 10 machine. In this case the right choice is to install from nonfree. It's a compromise, sure, but it's clearly less bad than the alternatives and leads to significantly more freedom than the user had before. To not leave room in your philosophy for these cases-- and there are many-- is to create unnecessary rifts among allies. You're doing it right now by implying that Debian proponents aren't True Scotsman due to the existence of nonfree.
risho 6y ago
I feel like I must be misreading something, because your second paragraph appears to me to be the doublespeak you claim to dislike. The problem with "free software" fundamentalists is they care more about the freedom of the software than the freedom of the user. Part of free choice from a user perspective is the freedom to run proprietary blobs. Also when it comes to freedom to run or not run proprietary software there is no such thing as a wrong choice, just a personal choice. I would prefer you not force your freedom on me, so that I can be free to do as I please.
- piaste 6y ago
  > I feel like I must be misreading something, because your second paragraph appears to me to be the doublespeak you claim to dislike. GP's first two paragraphs are very clear irony.

ipodopt 6y ago

A brick respects your privacy but it is not a very useful computation device. I bought a laptop from them and after about 6 months of struggling with PureOS I installed Ubuntu and it has been smooth sailing. One software issue I had with the PureOs install was a hard freeze during the booting about 60% of the time. I hope there is a newcomer to privacy crowd that is willing to air on the pragmatic side of things. Like somewhere between apple and purism.

deleted 6y ago
[deleted]
elagost 6y ago
System76 also sells laptops with a Linux OS, Coreboot BIOS, and a "disabled" Intel Management Engine. (There's no true way to disable it, but any dangerous parts are removed, rendering it useless) System76 is not a newcomer, though - they've got 15 years of history. I've bought from them and found the experience to be superb.
- bubblethink 6y ago
  The ME side is not so clear anymore. Pre-nehalem, it could be truly disabled. Up to skylake, it could be "cleaned". Up to cometlake, it could be "asked" to disable itself. From tigerlake onwards, it is quite essential since tigerlake removes S3 sleep, and ME is needed for efficient modern standby.
- ipodopt 6y ago
  It is true that they are more pragmatic. But still no dice for me. Perhaps, I should be more careful what I wish for, haha. Both System76 and Purism have a "We teach you to fix it" support attitude. So when you run into trouble you are going to have to expend effort. They both have their share of bugs. All I want is something that gets out of my way and works. I don't need the latest specs. As long as they hit a reasonable base the more ethical the better. I do software development on Linux. I don't feel like that is a big ask to have a trouble free Linux laptop. And I knew this when I was making my purchase. At the time Purism was advertising a "luxury" laptop experience coupled with the equivalent price tag. But I got it and 7 days later it wouldn't boot because of a rather nasty software bug (which I am not sure has been resolved [I think it is a rather nasty race condition since its happens indeterministically]) due to their specific configuration. They also lied about the battery life on the website (I get less then two hours and they adv. five hours). And the WiFi doesn't really work no matter what you do as the chassis severally attenuates the signal. Which for me, as a "digital nomad" in SA at the time really really hurt. If I where to do my laptop purchase again ATM I would get a Dell. Something like this: https://www.dell.com/en-us/work/shop/workstations-isv-certified/new-precision-7550-mobile-workstation/spd/precision-15-7550-laptop/xctop755015us_vivp?configurationid=016d1c0b-bd11-4781-81f0-5a74c20c7369 https://www.dell.com/en-us/work/shop/workstations-isv-certif...

anonypla 6y ago

Personally I think QubeOS is probably the best option in terms of Privacy and Security at this stage. If your hardware can handle it (16GB RAM would be best). I would seriously consider QubeOS over PureOS if privacy and security are your concerns. It works pretty well and I've been using it for a while now on not so recent hardware without much issues. Their compartmentalization and seamless virtualization is just amazing and I don't think any other distro offers this with so much convenience.

_kbh_ 6y ago
I love qubes my only gripe is that they use the zen hypervisor instead of a minimal formally verified os such as sel4 which I think would go a long way in strengthening the isolation between “domains/containers/etc”.
- simonebrunozzi 6y ago
  Xen, not Zen.
- fsflover 6y ago
  What are your problems with Xen? They explain their choice very well: https://www.qubes-os.org/faq/#why-does-qubes-use-xen-instead-of-kvm-or-some-other-hypervisor https://www.qubes-os.org/faq/#why-does-qubes-use-xen-instead....
  - _kbh_ 6y ago
    SEL4 would be a better choice because it is formally verified, there is a much smaller chance of vulnerabilities in SEL4 vs Xen because of this.
    - fsflover 6y ago
      From the above link: What about safe languages and formally verified microkernels? In short: these are non-realistic solutions today. We discuss this in further depth in our Architecture Specification document: https://www.qubes-os.org/attachment/wiki/QubesArchitecture/arch-spec-0.3.pdf https://www.qubes-os.org/attachment/wiki/QubesArchitecture/a....

barnacled 6y ago

This is nice and all and I am being 'that guy' nit picking but I hate the use of 'OS' when this is actually a Linux distribution. It is really confusing as in some cases an 'xxxOS' really is a new OS but more so these days it means 'xxx Linux distribution'. Also given their links to fsf who insist on 'GNU/linux' it is amusing to see the name contain neither GNU nor Linux. As a huge Linux fanboy (I contribute to the kernel minorly as a hobby) I can also see the positive side - using Linux is such a foregone conclusion that we don't even need to mention it any more :)

mjgs 6y ago

I’m a big fan of Linux, and I’ve been thinking and wanting to go full Linux for a while, but there just doesn’t seem to be a single laptop in existence that only runs free software. Every thread I read just turns into an infinite rabbit hole.

goodcanadian 6y ago
It's probably not as bad as it appears. I currently have a Lenovo ThinkPad running Ubuntu with no problems, and it is not the first laptop I've run Linux on. Honestly, if you are not using bleeding edge or obscure hardware, you are probably ok. The only time I've had hardware problems with Linux in the last 10 years was a video card (on desktop) that could not initially output audio over HDMI. After a few months, the driver was updated, and all was fine.
- mjgs 6y ago
  I’ve had very good results using Ubuntu in the cloud. And I have played around with the desktop version a bit. What I was referring to in my comment was when I have researched to try to find a laptop that runs completely free software including all firmware etc, it gets very confusing. I’m not even sure if such a machine exists. I wish there was a site similar to https://caniuse.com https://caniuse.com but for laptops that run Linux.