Which laptop PC should I get?

Phead

Since you mentioned it - how does your Framework machine compare to a Macbook noise wise? Over the years I've worked with many different brands, from HP over Dell to Asus and each and every single one of them had the same issue - annoying fan noises. How annoying is the fan in your Framework, especially under low work loads like browsing (no compiler stuff or anything CPU heavy)?

N1b

Phead how does your Framework machine compare to a Macbook noise wise

Under regular workload the fan doesn't turn on, I can't hear anything. But even when it does it's quite silent. Of course a Macbook air M1 or later is always silent since there's no fan, so wins by default.

Check this and this video out to get a good impression. I think fan noise won't be an issue, but maybe the design, aspect ratio or price might be...

xxx

Elgoog updating from the command line next time.

It has something to do with the gnome-software integration. Dnf works like apt.

Nanashi

Looking at your requirements, the short answer is: none.
The longer answer is: it depends.

If you're looking for security, your Mac is already secure.
If you're looking for privacy, your Mac, or any other ARM laptop, is definitely not the answer.

oci3o

This is how I see it.
Windows - Most secure, but requires a lot of work (365 E5 or GPO, plus Defender configs) - Never use those privacy scripts, they break things, and Microsoft just turn the settings back on.
ChromeOS - Excellent security out of the box, can be further hardened with Google Workspace enterprise.
macOS - Good for security, excellent hardware security, somewhat OK for privacy, needs an MDM to get its best security, which brings its own privacy issues, disable iCloud, use a VPN or NextDNS to block telemetry.
Linux - horrific security for the most part, secureblue tries to remediate this, avoid AMD CPUs if you need TPM, excellent privacy if you use the right distro, Ubuntu or Red Hat are the only two others if you want security, Ubuntu Pro helps with this as it can enforce compliance, still needs something like Landscape however.

I would stick with the mac and put some DNS blocking in place at the router level, or leverage a VPN to do this, log out of iCloud etc.
Frameworks are great because of how they are designed, but they are not the most secure laptops, far from it, I have an AMD one and I cant use TPM with secureblue because its not implemented in the kernel properly yet...

You could leverage VMs and run something like secureblue in that, I used to use Parallels a lot and it worked great but its closed source, UTM maybe a good shout but never really tried it.

tux_

oci3o Linux - horrific security for the most part,

Security against what?

Linux isn't a well defined thing in common parlance, there are hundreds of distributions with different objectives. The distros that I am familiar with (Debian and Arch derivatives) cater to power users and tend not to make decisions for the users. For instance, there is no firewall by default. It is you, the owner of the system, that decides if you want or need one. Does this make Linux "insecure?" Maybe, maybe not. I don't have firewalls on my workstations because they aren't needed. Typically there is not much application-level sandboxing because it isn't needed when running trusted software. There are tools like AppArmor and Bubblewrap, but it is a choice for you to make. It certainly isn't as needed as on Android, an OS targeted at laypeople mostly running commercial malware.

Eumenia

Psyonico It depends. If you update through KDE Discover or the GNOME version of that, it will tell you to reboot after every single update. If you update via terminal it won't specifically tell you, but I believe it's still considered better to reboot.

It doesn't prompt me to update if I update applications, only if I update something like core libraries or the Kernel itself

Psyonico

Eumenia that's interesting because that was not my experience when I was using Fedora, unless I just always had some sort of system upgrade ready. I used Fedora for about a year and a half and every time I saw an update notification it would be followed by a reboot recommendation.

Linux

N1b Do you need security and are willing to sacrifice privacy? Stay on MacOS.
If it's the other way around, check your budget and research online for devices with good Linux compatibility.

This implies that you need to sacrifice security if you use a open source operating system.

N1b

Linux yes because you have to sacrifice security on Linux, at least when it comes to hardware security and sandboxing. For reference start here.

Of course this deeply depends on the end user and OPSEC as well, but by default and for most Linux users it's true that they are less secure than MacOS users. I hate Apple because of privacy issues and misleading marketing, but I have to cut them some slack here.

successiveminkrwoj

Linux No. It's about the hardware and strong defaults.

Linux

N1b yes because you have to sacrifice security on Linux, at least when it comes to hardware security and sandboxing. For reference start here.

Of course this deeply depends on the end user and OPSEC as well, but by default and for most Linux users it's true that they are less secure than MacOS users. I hate Apple because of privacy issues and misleading marketing, but I have to cut them some slack here.

I agree that you are more secure per default on MacOS, because they enforce strighter sandboxing.
But I disagree with the article you have linked:

SecureBoot is possible on Linux and you can just chose a distro that is supporting it.
Bad apps that have to lax permissions is not the fault of the system itself but the fault of the application developers, just either use apps that have implemented portals or configure them manually with Flatseal to for example only access specific folders (this works like storage scopes in GOS even when the app dev doesn't support it)

DirtyDan

Psyonico There's a setting to allow updates to install without rebooting, but KDE recommends not enabling it.

On my Fedora KDE install via Discover store, I get prompted to reboot for all system updates, which also includes all system-level apps. Flatpaks, snaps, AppImages, etc can update without a reboot. I moved as much stuff to flatpak as possible but I still have 1-2 updates a day where I'm prompted to reboot.

Gotta say, it becomes tedious, especially when you have LUKS encryption enabled since you can't just walk away during the update.

Typical morning for me:

Power on laptop.
Wait.
Enter LUKS password.
Wait.
Enter user password.
Open Discover store and check for updates.
Wait.
Update all. Wait for them to finish. Click restart when prompted since it only sometimes does it on its own.

Wait for laptop to reboot.
Enter LUKS password.
System updates.
Wait for laptop to reboot again.
Enter LUKS password.
Wait.
Enter user password.
Check for other updates such as distrobox updates and appimage updates.

I use to try to update at night before shutting down, but the updates come so often that I'm still usually prompted to update and reboot in the morning anyway.

I'm aware that I can skip the reboot by updating from the terminal. But it's very unclear when I should be rebooting. I've read so many mixed things where some say you only need to reboot for anything kernel related and others recommend always updating since not rebooting creates system instability.

I've been too scared to break my system so I keep rebooting, but the constant rebooting is very disruptive.

Eumenia

Psyonico that's interesting because that was not my experience when I was using Fedora, unless I just always had some sort of system upgrade ready. I used Fedora for about a year and a half and every time I saw an update notification it would be followed by a reboot recommendation.

DirtyDan On my Fedora KDE install via Discover store, I get prompted to reboot for all system updates, which also includes all system-level apps. Flatpaks, snaps, AppImages, etc can update without a reboot. I moved as much stuff to flatpak as possible but I still have 1-2 updates a day where I'm prompted to reboot.

Maybe RPM packages also always need restarts because they are Mord tief to the system?
Another reason to favor Flatpack

Elgoog

DirtyDan It is even worse if you share your machine with someone who boots to Windows. Then, even if you wait until the end of your work session to install updates, you need to reboot and shutdown once more, or your Windows-using friend will get very ugly error messages when trying to boot Windows.

Revliss

Nothing beats a MacB for battery life to compute ratio. OSX is an improved BSD distro, so it's rather secure, however, you have constant telemetry, constant server checks, scans, hidden files and a large amount of logging. So definitely not private.

Revliss

The most secure and private open source OS of the moment is android (Grapheme, than AOSP). Next is probably BSD, than LTS Unix distro (Fedora, than Ubuntu).

Base Linux is not secured: you have to recompile with proper kernel flags, harden malloc, lock the bootloader and dive into days long setup of seccomp profiles, firewall rules, etc...

Anyways, even if you do get the perfect security for your threat model, all of that breaks once you install anything: new app = new code = new vulnerability, that includes anything 'apt install', 'npm -i', 'pip', etc..

So your best bet if you are against state actors is everything offline in Faraday cages planned for satellites: around 4 or 5 layers of grounded aluminum foil should do but you better calculate that. Remember you have 3 300W 2.5Ghz TX antenna: CPU, GPU, RAM. I don't know how capable that is but a VHF 25W can be heard 10km away without miltary equipment. Sound proof the cages as well, as fans can be used for TX.

venti334

If you need 10+ hours and upgradeable storage, your options are pretty limited on the Windows side. Most thin laptops solder everything now. Look at a ThinkPad or a Framework if you actually want to swap SSDs yourself.

Elgoog

N1b I can also put different Linux OSes (and Windows for gaming) on the SSD expansion modules and run them air gapped from each other....

Is that unique to Framework laptops?

Psyonico

Elgoog Is that unique to Framework laptops

Windows won't let you install to a drive it thinks is a USB drive, so Framework must be doing something to their expansion modules to make it not look like its connected via USB.

I've tried installing windows to a sata ssd connected via a sata to USB adapter before is how I know this.

N1b

Elgoog Is that unique to Framework laptops?

Yes and no, you can install Linux on an external SSD and have that setup for any Laptop. It will probably be more performant this way as the tiny external SSDs from Framework throttle quickly whrn pushed hard in multitasking.

What makes Framework unique is that their expansion cards are inserted flush in the laptop (at the expense of one port) so you don't have something stick out or a cable that might disconnect. Your laptop remains as mobile as usual.

Psyonico Windows won't let you install to a drive it thinks is a USB drive, so Framework must be doing something to their expansion modules to make it not look like its connected via USB.

Nothing special here, you can install Windows 11 via Rufus on any external drive using the portable setting. This would also work on non Framework SSDs.

tux_ Security against what?

Check the link I shared further up, I think they refer to hardware security, verified boot and proper sandboxing which can hardly be achieved on any Linux vs GOS. It's definitely not the case for most Linux vs GOS users and increasing security on Linux is far less convenient.

zache

Shendai +1 For the T480. It can also be flashed with Libreboot or Heads.

« Previous Page Next Page »