6 ms·

Do you daily drive Qubes? I'd be curious to hear about your experiences. I've been following the project from the sidelines for years, but haven't taken the l

Do you daily drive Qubes? I'd be curious to hear about your experiences. I've been following the project from the sidelines for years, but haven't taken the leap.

eptcyka 9mo ago
Do you hate GPU acceleration? Do you hate using most hardware? Do you like using Xorg? Then Qubes is for you. This is in jest, but those are my pain points - the AMD thinkpad I have can't run it, the Intel one melts yubikeys when decoding h264 video. The default lock screen can't read capital letters from the yubikeys static password entry. Qubes has a certain user that it caters to, I really wish they could get enough money to be able to cater to more use cases. It is not difficult to use it if it works for you.
- fsflover 9mo ago
  GPU acceleration is coming: https://github.com/QubesOS/qubes-issues/issues/8552 https://github.com/QubesOS/qubes-issues/issues/8552 > Do you hate using most hardware? Nobody uses "most hardware". You may be unlucky with your hardware, then it's a problem. Or you can specifically buy hardware working with the OS you want. > Do you like using Xorg? What's wrong with Xorg?
  - eptcyka 9mo ago
    > What's wrong with Xorg? Lock screens that crash. Lock screens that can’t handle input from a yubikey?
    - fsflover 9mo ago
      There are no crashes on lock screen with Qubes. Concerning Yubikey, see this: https://doc.qubes-os.org/en/latest/user/security-in-qubes/mfa.html https://doc.qubes-os.org/en/latest/user/security-in-qubes/mf...
fsflover 9mo ago
Yes, I daily drive Qubes. It's an amazing feeling to feel in full control over your computing and not being afraid to open any links or attachments. Here is my Qubes OS Elevator Pitch: https://forum.qubes-os.org/t/how-to-pitch-qubes-os/4499/15 https://forum.qubes-os.org/t/how-to-pitch-qubes-os/4499/15 It's slow for tasks requiring GPU, but allowing GPU for chosen, trusted VMs is planned: https://github.com/QubesOS/qubes-issues/issues/8552 https://github.com/QubesOS/qubes-issues/issues/8552
JCattheATM 9mo ago
Just FYI, there are some people that vastly exaggerate the security it provides. For the most part, you're just as safe using flatpak versions of applications.
- fsflover 9mo ago
  When was the last Flatpak escape? Last VM escape from VT-d virtualization, which Qubes uses by default, was found in 2006 by the Qubes founder, https://en.wikipedia.org/wiki/Blue_Pill_(software) https://en.wikipedia.org/wiki/Blue_Pill_(software)
  - JCattheATM 9mo ago
    The most recent VM escape from VT-d virtualization was in 2022[0]. Escapes are not the only vulnerability. QSB-108 allows for reading the memory of other qubes running on the host[1]. [0] https://nvd.nist.gov/vuln/detail/CVE-2020-15565 https://nvd.nist.gov/vuln/detail/CVE-2020-15565 [1] https://www.qubes-os.org/news/2025/07/11/qsb-108/ https://www.qubes-os.org/news/2025/07/11/qsb-108/
    - fsflover 9mo ago
      Apart from the fact that this is extremely rare, the first vulnerability is not a complete escape. For example, any offline vault VM storing secrets stayed secure. This is just not happening with any other security approach. Speculative sidechannel attacks have nothing to do with OS or compartmentalization technology, since they are the problem of CPUs. Nothing can help here, so this is irrelevant to this discussion. Except that Qubes Air will save you in the future: https://www.qubes-os.org/news/2018/01/22/qubes-air/ https://www.qubes-os.org/news/2018/01/22/qubes-air/
      - JCattheATM 9mo ago
        > Apart from the fact that this is extremely rare, So are bubblewrap escapes, which is the sandbox flatpak uses. > the first vulnerability is not a complete escape. It could potentially lead to one, and being able to obtain information from other VMs defeats much of the point of isolation, and so defeats much of the point of why people use qubes. > For example, any offline vault VM storing secrets stayed secure. This is just not happening with any other security approach. That's not true. Strong MAC would suffice, no VT-d needed. > Speculative sidechannel attacks have nothing to do with OS or compartmentalization technology Of course they do, in fact they have more to do with it than solutions like flatpak, which is why Qubes releases security advisories and patches to address those vulnerabilities.

Do you daily drive Qubes? I'd be curious to hear about your experiences. I've been following the project from the sidelines for years, but haven't taken the leap.

eptcyka 9mo ago

Do you hate GPU acceleration? Do you hate using most hardware? Do you like using Xorg? Then Qubes is for you. This is in jest, but those are my pain points - the AMD thinkpad I have can't run it, the Intel one melts yubikeys when decoding h264 video. The default lock screen can't read capital letters from the yubikeys static password entry. Qubes has a certain user that it caters to, I really wish they could get enough money to be able to cater to more use cases. It is not difficult to use it if it works for you.

fsflover 9mo ago
GPU acceleration is coming: https://github.com/QubesOS/qubes-issues/issues/8552 https://github.com/QubesOS/qubes-issues/issues/8552 > Do you hate using most hardware? Nobody uses "most hardware". You may be unlucky with your hardware, then it's a problem. Or you can specifically buy hardware working with the OS you want. > Do you like using Xorg? What's wrong with Xorg?
- eptcyka 9mo ago
  > What's wrong with Xorg? Lock screens that crash. Lock screens that can’t handle input from a yubikey?
  - fsflover 9mo ago
    There are no crashes on lock screen with Qubes. Concerning Yubikey, see this: https://doc.qubes-os.org/en/latest/user/security-in-qubes/mfa.html https://doc.qubes-os.org/en/latest/user/security-in-qubes/mf...

fsflover 9mo ago

Yes, I daily drive Qubes. It's an amazing feeling to feel in full control over your computing and not being afraid to open any links or attachments. Here is my Qubes OS Elevator Pitch: https://forum.qubes-os.org/t/how-to-pitch-qubes-os/4499/15 https://forum.qubes-os.org/t/how-to-pitch-qubes-os/4499/15 It's slow for tasks requiring GPU, but allowing GPU for chosen, trusted VMs is planned: https://github.com/QubesOS/qubes-issues/issues/8552 https://github.com/QubesOS/qubes-issues/issues/8552

JCattheATM 9mo ago

Just FYI, there are some people that vastly exaggerate the security it provides. For the most part, you're just as safe using flatpak versions of applications.

fsflover 9mo ago
When was the last Flatpak escape? Last VM escape from VT-d virtualization, which Qubes uses by default, was found in 2006 by the Qubes founder, https://en.wikipedia.org/wiki/Blue_Pill_(software) https://en.wikipedia.org/wiki/Blue_Pill_(software)
- JCattheATM 9mo ago
  The most recent VM escape from VT-d virtualization was in 2022[0]. Escapes are not the only vulnerability. QSB-108 allows for reading the memory of other qubes running on the host[1]. [0] https://nvd.nist.gov/vuln/detail/CVE-2020-15565 https://nvd.nist.gov/vuln/detail/CVE-2020-15565 [1] https://www.qubes-os.org/news/2025/07/11/qsb-108/ https://www.qubes-os.org/news/2025/07/11/qsb-108/
  - fsflover 9mo ago
    Apart from the fact that this is extremely rare, the first vulnerability is not a complete escape. For example, any offline vault VM storing secrets stayed secure. This is just not happening with any other security approach. Speculative sidechannel attacks have nothing to do with OS or compartmentalization technology, since they are the problem of CPUs. Nothing can help here, so this is irrelevant to this discussion. Except that Qubes Air will save you in the future: https://www.qubes-os.org/news/2018/01/22/qubes-air/ https://www.qubes-os.org/news/2018/01/22/qubes-air/
    - JCattheATM 9mo ago
      > Apart from the fact that this is extremely rare, So are bubblewrap escapes, which is the sandbox flatpak uses. > the first vulnerability is not a complete escape. It could potentially lead to one, and being able to obtain information from other VMs defeats much of the point of isolation, and so defeats much of the point of why people use qubes. > For example, any offline vault VM storing secrets stayed secure. This is just not happening with any other security approach. That's not true. Strong MAC would suffice, no VT-d needed. > Speculative sidechannel attacks have nothing to do with OS or compartmentalization technology Of course they do, in fact they have more to do with it than solutions like flatpak, which is why Qubes releases security advisories and patches to address those vulnerabilities.