How do the grapheneos devs keep their pc secure?

Sandman

It is often discussed here that desktop pc's and their os are insecure because of the lack of propper verified boot, no real sandboxing, etc. This is also often stated by the official grapheneos account. So, how do the grapheneos devs keep their pc's secure? I'd imagine they don't use their phones to code.

raccoondad

Sandman I'm not at all related to the dev team but I would assume they keep their OS signing key offline

akc3n

Sandman So, how do the grapheneos devs keep their pc's secure?

user539 Yes, the real question.
What os does the devs use on their pc/laptop

In general, at this level of high stakes, it would only make sense that - not just the developers, but also the rest of us project core members - keep this type of information private.

user539

Yes, the real question.
What os does the devs use on their pc/laptop

JollyRancher

A secure desktop depends on your threat model.

If you want to protect against internet/network attacks then any computer without a modem is going to be high impenetrable.

If you want something online, Qubes OS is basically the best out there short of bespoke solutions.

Ultimately though it comes down to your threat model and what your concerns are.

rellhom

JollyRancher

have you tried QubesOS? from a user perspective does it feel like using any other Linux distro?

akc3n

rellhom QubesOS? from a user perspective does it feel like using any other Linux distro?

Technically, Qubes OS is not Linux, but a Xen-based virtualization hypervisor with templates based on Linux distributions.

It's a lot of work to setup and takes extra steps to get things done in comparison. IMHO and should only be used for users with a specific threat model.