GrapheneOS Users Running QubesOS: Community Poll

p-marg

My Pixel 6a runs GrapheneOS, and I've been using it since May 2023. From the moment I got the phone, I started saving up for my next Pixel, knowing I'll want to upgrade when this one reaches end of life. I'll be ready to switch to a new Pixel and keep using GrapheneOS.

And this year, I'm making a significant move to escape surveillance capitalism by transitioning to QubesOS full-time on my Thinkpad.

My Thinkpad has two drives:

The internal NVMe drive running QubesOS
One additional NVMe drive I installed, running Fedora Silverblue

My question is: How many of you GrapheneOS users run QubesOS as a daily driver on the desktop, alongside GrapheneOS on a Pixel?

yore

p-marg I used to run QubesOS from an external drive to test out the waters. Turned out it wasn't for me for a number of reasons:

Running multiple VMs on my hardware was incredibly slow
It consumed a lot of power even when doing basic things
My threat model didn't require something like QubesOS and the performance hit wasn't worth it for me
In terms of security, I found GrapheneOS suffices for my needs. QubesOS's main security point is around isolating activities with (type 1) VMs but besides that, it suffered from some of the same pitfalls as other desktop Linux operating systems.

All this combined has led me to revert to a standard, Arch distribution with some security improvements such as using the linux-hardened kernel are enough for my threat model so I am pleased with my current setup. While QubesOS is certainly a solid OS for secure browsing, file viewing, etc especially with their well-designed disposable VMs, I find that some of these can be replicated on GrapheneOS, for example viewing unknown PDFs in GrapheneOS's viewer where PDF JavaScript is disabled.

But in the end, I think what matters most is the user's threat model before jumping the gun on something fairly intimidating to new users. It comes with its own learning curve, but if the user is willing to take some time to become familiar with QubesOS and doesn't suffer from the issues I faced, it's an interesting OS with some useful features and is certainly worth trying out.

Overlay1404

p-marg My question is: How many of you GrapheneOS users run QubesOS as a daily driver on the desktop, alongside GrapheneOS on a Pixel?

I have a lot of respect for users who daily drive Qubes but it would be a massive inconvenience for me and completely unnecessary for my threat model. Then again, I am a very recent convert to daily driving Linux, so baby steps....

p-marg

p-marg Also this is outdated, I use a 9a now, hehe!

ryrona

I do. GrapheneOS on my phone, QubesOS on my laptop.

I switched to QubesOS because I was more or less already doing what QubesOS does to support security domains with templates in a safe way. Just, I did it all manually with regular Linux distribution, using an external USB stick for verifying hash of all boot files and boot data between each boot, having packed the whole file system as a squashfs to allow the verification, using overlayfs with a temp filesystem to prevent the file system getting modified in normal operation, and using separate encrypted partitions for each security domain, only ever opening one between each verified boot. It was a pain, but it worked. Now we have QubesOS that actually offers all that out of the box, in a super easy to use way, that is far easier to install software updates to, and that allows running all security domains at the same time.

nonewhere

ryrona

Interesting setup having an encrypted partition for each domain. I wonder why QubesOS doesn't support this out of the box; this would prevent certain data from leaking even in the rare case dom0 gets compromised, no?

I guess you're setting up a pool for each of these partitions?

I do something similar-ish. I have the vmpool be just as is, physically mounted on my SSD. And then I have certain "private" qubes on a different pool mounted on a physical microSD card, encrypted.

I also boot dom0 live most of the time: unfortunately QubesOS and its default window manager log too much (open windows, the titles of these windows... yes... see https://github.com/QubesOS/qubes-issues/issues/4972, and you can see for yourself @ /home/admin/.cache/sessions/), which sucks for any sort of deniability.

elih

I've used QubesOS as my daily driver for nearly a decade and added GrapheneOS more recently. I've found that they make good complements.

Use of Xen as the hypervisor definitely makes Qubes a power hog, but this may be a small price to pay if Surveillance Capitalism is a part of your threat model. Since you basically have a network of virtual machines on a laptop, it's possible to filter and sort data flows internally with tools like pi-hole, opensnitch, wireshark, dedicated firewall VMs, multiple VPN gateways, and Whonix. I've found 16GB of RAM on a Thinkpad to be sufficient for everyday use (maybe a dozen VMs open at any given time, none that need GPU passthru) with no significant slowdown relative to other operating systems, but with only 8GB RAM it could be painful at times. Qubes 4.2 saw a lot of UI improvements, so it's much easier to use now than in the past, but there's still a learning curve and customizations to manage your exposure to Surveillance Capitalism will take an investment of time.

ryrona

nonewhere I also boot dom0 live most of the time

Wait, is it possible to boot dom0 in a fully immutable way? Or what do you mean?

DeletedUser499

I did, but its too full on for a daily driver and simply got in the way.
I found I spent so much time getting things to work in Qubes, when Tails will do it off the bat.
I use Tails from an SD card, with the read only/locked toggle selected.

lars

I understand what Qubes is trying to achieve, and I think it represents a modern approach to application isolation. However, I'm running heavyweight applications on modest hardware, and I just don't feel I need what Qubes offers enough to take the hit on resource usage.

If I did, I suspect I could achieve the same thing with virtualization or container technology that I already use and understand, rather than learning something new, that may or may not work for me.

Lars.

23Sha-ger

ryrona
If you boot from RO media, like a cd or PXE network share,
this is possible. However dom0 is usually the "trusted" part.
You can always boot from a freshly installed drive and plug
the containers after.

nonewhere

ryrona

OverlayFS. https://forum.qubes-os.org/t/qubes-in-tmpfs/11127/86

ryrona

nonewhere OverlayFS. https://forum.qubes-os.org/t/qubes-in-tmpfs/11127/86

Yeah, that is exactly how you turn any Linux distribution into becoming immutable. You just mount a tmpfs-backed overlayfs on top of the read-only mounted actual root file system. In fact, you can even convert the root file system to a single erofs/squashfs file, to really really make it read-only, and even sign and verify it all with Secure Boot or similar if you want to be sure at each boot it definitely isn't modified at all. But, this works well for your average Linux distribution, because you can just create a separate encrypted partition to hold all your files you want to save, instead of using your home directory for this (since the home directory too isn't persisted). But it is less clear for me if it works well with QubesOS and the ability to create new qubes. But it seems they say, no I does not, and that we have to create the qubes while having booted the dom0 in non-immutable mode. And then there is of course the risk that data from already existing cubes will leak to dom0 storage at that point. But I guess it is maybe just a few directories like "/var/lib/qubes" that need to be moved to a separate writable partition for this whole setup to work maybe. I thought I would experiment with that at some point in time, but it looks the community is already doing so.

nonewhere

There is also https://codeberg.org/andersonarc/reliant-system which seems very promising but haven't had the chance to try it yet.

RedDeath

At one point, I considered using QubeOS, but after researching various websites and consulting with artificial intelligence, I realised that this Linux distribution is terrible for playing video games. Personally, I value privacy and security, but I also like to play video games, such as Wuthering Waves, and I would have a lot of problems playing that game on QubeOS. That's why I prefer the Linux Mint distribution, which is based on Debian. I know and am aware that the other day on X, the GrapheneOS developers were criticising Debian for being less secure than Fedora, since Fedora already uses SELinux by default. However, Fedora is more unstable than Linux Mint. For someone like me who uses the computer for things such as basic photo and video editing, classes and tutorials via videoconferencing, watching series and films online, using office software (OnlyOffice covers these needs for me) and playing video games, it doesn't matter if Linux Mint is less secure than Fedora Cinnamon. I value stability over security. It is of no use to me to use a secure operating system if with every new update I have to fix bugs and ask other users in the community for help, for that, I'd rather use Linux Mint and install Kaspersky antivirus, which they recently announced is now available for home users who use Linux.

ryrona

RedDeath At one point, I considered using QubeOS, but after researching various websites and consulting with artificial intelligence, I realised that this Linux distribution is terrible for playing video games. Personally, I value privacy and security, but I also like to play video games, such as Wuthering Waves, and I would have a lot of problems playing that game on QubeOS.

Yeah, no video acceleration on QubesOS at all.

I think games should run fine on SecureBlue, from what I have heard, if you want to try to upgrade your security and privacy a bit. I am going to try SecureBlue for that purpose myself soon.

RedDeath I'd rather use Linux Mint and install Kaspersky antivirus, which they recently announced is now available for home users who use Linux.

It is better to learn to only install software or open files from trusted sources, than to rely on antivirus software. Antivirus software isn't that great. Antivirus software with cloud scanning functionality is also compromising your privacy a lot, as random files may be sent to their cloud service for scanning.

p-marg

ryrona I actually use Secureblue now, haven't tested gaming yet.

Graphite1

I use Qubes, but only as an offline station.

NetRunner88

You can game with Qubes but you need a second GPU and pass it through the VM.
It is doable, there is a thread on the forum.

But..

I haven't tested and you need to take time