4 ms·

I am looking forward to Spectrum which tries to make secure computing usable - https://spectrum-os.org/ https://spectrum-os.org/ .

fsflover 5y ago
Qubes is much more usable than people think. My daily driver for many years already. See also discussion of Spectrum OS on Qubes forum: https://forum.qubes-os.org/t/spectrum-os-discussion/1531 https://forum.qubes-os.org/t/spectrum-os-discussion/1531.
- rbanffy 5y ago
  > My daily driver for many years already. Would you like to share more about your experience? How resource-intensive is it, what you do, what would a normal workflow look like with it compared to, say, a Fedora desktop?
  - fsflover 5y ago
    If your work requires GPU acceleration, then you're out of luck [0]. Normal apps like a browser, LibreOffice work fine. Hardware virtualization is extremely secure [1] and also fast. Everything which works on Linux should work on Qubes, including drivers (which are usually isolated in their own VMs). You can also run several different Linux flavors simultaneously [2] and Windows [3], too. The downside is that you really need a lot of RAM for that (unless you try to minimize your VMs [4], which is an advanced feature). I have 32 GB, and I never run out of RAM. I love that you can explicitly compartmentalize your digital live into independent VMs with a great unified interface. I have "work" VM which contains all work stuff and "personal" VM for personal things. More thoughts from me: https://forum.qubes-os.org/t/how-to-pitch-qubes-os/4499/15 https://forum.qubes-os.org/t/how-to-pitch-qubes-os/4499/15. [0] https://www.qubes-os.org/faq/#can-i-run-applications-like-games-which-require-hardware-acceleration https://www.qubes-os.org/faq/#can-i-run-applications-like-ga... [1] https://www.qubes-os.org/security/xsa/ https://www.qubes-os.org/security/xsa/ [2] https://www.qubes-os.org/doc/templates/#official https://www.qubes-os.org/doc/templates/#official [3] https://www.qubes-os.org/doc/windows/ https://www.qubes-os.org/doc/windows/ [4] https://www.qubes-os.org/doc/templates/minimal/ https://www.qubes-os.org/doc/templates/minimal/
    - pabs3 5y ago
      I read that GPUs are adding virtualisation features, are Qubes likely to take advantage of that?
      - fsflover 5y ago
        If you mean second GPU passthrough then yes: https://forum.qubes-os.org/t/qubes-gpu-passthrough/661 https://forum.qubes-os.org/t/qubes-gpu-passthrough/661 https://forum.qubes-os.org/t/another-2-gpu-passthrough-post/2821 https://forum.qubes-os.org/t/another-2-gpu-passthrough-post/... See also: https://github.com/QubesOS/qubes-issues/issues/4321 https://github.com/QubesOS/qubes-issues/issues/4321.
        AnIdiotOnTheNet 5y ago
        No, that is not what is meant by GPU virtualization. GPU virtualization is the GPU equivalent of Intel's VT and AMD's AMD-V, it's virtualization supported by the hardware which allows the GPU to be used by multiple VMs as though they were exclusive. For some reason the GPU manufacturers have seen fit to limit this to expensive professional grade GPUs, but hopefully we'll see it in consumer hardware soon. Well, except I think Intel already has it in consumer chips, it's just that their GPUs are kinda shit so no one really cares.
        isodude 5y ago
        If you mean SR-IOV, that basically splits one PCI slot into several slots, which you then passthrough to the guest, which means in theory it should be supported. At least that's how the networks are treated, sadly I have not yet been able to utilize it on GPUs :)
    - krageon 5y ago
      > If your work requires GPU acceleration, then you're out of luck ok... > Normal apps like a browser, LibreOffice work fine Without GPU acceleration, a browser won't work fine
orblivion 5y ago
I like the idea of unifying configuration like that. Qubes does have templates but there are per-vm changes I want to make on top of them which adds a little more configuration work. NBD but not that smooth. Nix seems like a good fit for this problem, it's crossed my mind before. One could install everything on the "template" level safely (in theory?) and only run them in the VMs. I've never used Nix and I'd like to give it a try at some point. HOWEVER, I like that Qubes has Debian. I'm used to it, it's predictable, etc etc. Some of my work basically even depends on it. With Spectrum I'd have to be stuck with the quirks of Nix, which I understand are less friendly than Debian. If I have the option of falling back to the equivalent of a Debian template, I'd likely switch.
- fsflover 5y ago
  > there are per-vm changes I want to make on top of them which adds a little more configuration work You can use Salt to automate this work: https://www.qubes-os.org/doc/salt/ https://www.qubes-os.org/doc/salt/.
  - orblivion 5y ago
    Yeah I remember I tried looking into this and I gave up on it. Iirc I couldn't understand exactly how it worked, and/or it seemed like a large time investment. Not to mention how I manage it in a repository if I can't safely move anything in and out of dom0? Qubes I think could benefit from more resources for ramp-up documentation.
    - robcohen 5y ago
      I agree, I also gave it a shake and I could not grok it easily.

fsflover 5y ago

Qubes is much more usable than people think. My daily driver for many years already. See also discussion of Spectrum OS on Qubes forum: https://forum.qubes-os.org/t/spectrum-os-discussion/1531 https://forum.qubes-os.org/t/spectrum-os-discussion/1531.

rbanffy 5y ago
> My daily driver for many years already. Would you like to share more about your experience? How resource-intensive is it, what you do, what would a normal workflow look like with it compared to, say, a Fedora desktop?
- fsflover 5y ago
  If your work requires GPU acceleration, then you're out of luck [0]. Normal apps like a browser, LibreOffice work fine. Hardware virtualization is extremely secure [1] and also fast. Everything which works on Linux should work on Qubes, including drivers (which are usually isolated in their own VMs). You can also run several different Linux flavors simultaneously [2] and Windows [3], too. The downside is that you really need a lot of RAM for that (unless you try to minimize your VMs [4], which is an advanced feature). I have 32 GB, and I never run out of RAM. I love that you can explicitly compartmentalize your digital live into independent VMs with a great unified interface. I have "work" VM which contains all work stuff and "personal" VM for personal things. More thoughts from me: https://forum.qubes-os.org/t/how-to-pitch-qubes-os/4499/15 https://forum.qubes-os.org/t/how-to-pitch-qubes-os/4499/15. [0] https://www.qubes-os.org/faq/#can-i-run-applications-like-games-which-require-hardware-acceleration https://www.qubes-os.org/faq/#can-i-run-applications-like-ga... [1] https://www.qubes-os.org/security/xsa/ https://www.qubes-os.org/security/xsa/ [2] https://www.qubes-os.org/doc/templates/#official https://www.qubes-os.org/doc/templates/#official [3] https://www.qubes-os.org/doc/windows/ https://www.qubes-os.org/doc/windows/ [4] https://www.qubes-os.org/doc/templates/minimal/ https://www.qubes-os.org/doc/templates/minimal/
  - pabs3 5y ago
    I read that GPUs are adding virtualisation features, are Qubes likely to take advantage of that?
    - fsflover 5y ago
      If you mean second GPU passthrough then yes: https://forum.qubes-os.org/t/qubes-gpu-passthrough/661 https://forum.qubes-os.org/t/qubes-gpu-passthrough/661 https://forum.qubes-os.org/t/another-2-gpu-passthrough-post/2821 https://forum.qubes-os.org/t/another-2-gpu-passthrough-post/... See also: https://github.com/QubesOS/qubes-issues/issues/4321 https://github.com/QubesOS/qubes-issues/issues/4321.
      - AnIdiotOnTheNet 5y ago
        No, that is not what is meant by GPU virtualization. GPU virtualization is the GPU equivalent of Intel's VT and AMD's AMD-V, it's virtualization supported by the hardware which allows the GPU to be used by multiple VMs as though they were exclusive. For some reason the GPU manufacturers have seen fit to limit this to expensive professional grade GPUs, but hopefully we'll see it in consumer hardware soon. Well, except I think Intel already has it in consumer chips, it's just that their GPUs are kinda shit so no one really cares.
        isodude 5y ago
        If you mean SR-IOV, that basically splits one PCI slot into several slots, which you then passthrough to the guest, which means in theory it should be supported. At least that's how the networks are treated, sadly I have not yet been able to utilize it on GPUs :)
  - krageon 5y ago
    > If your work requires GPU acceleration, then you're out of luck ok... > Normal apps like a browser, LibreOffice work fine Without GPU acceleration, a browser won't work fine

orblivion 5y ago

I like the idea of unifying configuration like that. Qubes does have templates but there are per-vm changes I want to make on top of them which adds a little more configuration work. NBD but not that smooth. Nix seems like a good fit for this problem, it's crossed my mind before. One could install everything on the "template" level safely (in theory?) and only run them in the VMs. I've never used Nix and I'd like to give it a try at some point. HOWEVER, I like that Qubes has Debian. I'm used to it, it's predictable, etc etc. Some of my work basically even depends on it. With Spectrum I'd have to be stuck with the quirks of Nix, which I understand are less friendly than Debian. If I have the option of falling back to the equivalent of a Debian template, I'd likely switch.

fsflover 5y ago
> there are per-vm changes I want to make on top of them which adds a little more configuration work You can use Salt to automate this work: https://www.qubes-os.org/doc/salt/ https://www.qubes-os.org/doc/salt/.
- orblivion 5y ago
  Yeah I remember I tried looking into this and I gave up on it. Iirc I couldn't understand exactly how it worked, and/or it seemed like a large time investment. Not to mention how I manage it in a repository if I can't safely move anything in and out of dom0? Qubes I think could benefit from more resources for ramp-up documentation.
  - robcohen 5y ago
    I agree, I also gave it a shake and I could not grok it easily.