Contents VS dotfiles

I've been using Qubes for the past 2 years while going to school, and I found it really fun and helpful. A lot of professors had me download random closed source software from random websites during the pandemic, and it was easier to download it to a VM than to convince them about Free Software. More than that though it's been really helpful just for my own workflow. I can hit a keybind and start working from essentially a fresh linux install. It's easier to stay on task when each VM is designed to only do one kind of task. It's also nice having debian, fedora, windows, kali, and whonix all easily accessible on the same machine.

The main sticking point for me is that Qubes is reasonably secure from _myself_. I make mistakes. I first started using linux with an Ubuntu install that I broke a year later because I accidentally added in a space when typing `rm -rf ~/Arduino` which made it `rm -rf ~ /Arduino`. On Qubes I can `sudo rm -rf /` on the VM I'm using right now and not break a sweat. I have a keybind to spawn a disposable "airgapped" VM to deal with sensitive or untrusted data, and it helps knowing that even if I mess up with whatever I'm doing, the VM will keep everything reasonably contained.

Some cool things that Qubes has outside of just VMs are its features enabled by the communication between VMs. Notable ones are Split GPG (https://www.qubes-os.org/doc/split-gpg/) which let you use a VM as if it were a smartcard for GPG and Split SSH (https://github.com/Qubes-Community/Contents/blob/master/docs...) which let you isolate your private SSH keys from your VM running your SSH client.

There are some sticking points around Qubes. For instance, I use Tailscale to connect my computers to each other from anywhere. Tailscale's install scripts add their keys to my VM's package manager for updates and installs. The proper way to do this in Qubes is to clone a TemplateVM, run Tailscale's install script, update, install, and then base an AppVM off of it. But that creates an entire new OS taking up storage and requiring updates. You can hack a way around this in an AppVM which saves a considerable amount of space, but it takes a lot of upfront time to do and requires you to manually update it.

Another sticking point is hardware acceleration. The desktop environment has access to hardware acceleration, so it runs fine, but opening videos in AppVMs is all software decoded. I'm on a Thinkpad T580 and it can run 1080p videos, but the fans turn on and can't do 4K. When I want to game or do something GPU heavy I either stream from my tower or completely switch over.

Overall, I'm really happy with Qubes and I'm planning to stick with it on my laptops.

They do not run on ram, you have to use a script to make a virtual ram disk and mount it and use it for a disposable if you have enough ram. As for setting mullvad, you have a few options, and it's not recommended to combine a VPN with Tor.

For Windows 11, please see: - https://github.com/Qubes-Community/Contents/blob/master/docs/os/windows/windows-vm41.md - https://github.com/Qubes-Community/Contents/blob/master/docs/os/windows/windows-tools41.md - https://forum.qubes-os.org/t/windows-11-in-qubes/6759

> It is slow as molasses on hardware where even Windows 10 and Gnome are both fast...

I haven't had that problem. There's no GPU acceleration, so anything heavy on the GPU is a problem, but in terms of general use, I don't find it slower than Linux on the iron.

> and to make it usable you have to keep relaxing the security to the point where it is probably less secure than regular OS.

How so? What settings? I don't run with a USB Qube all the time for just my HID devices, but I light it up when I'm doing anything else on USB. I haven't had issues with having to turn down a bunch of security settings either.

> And don't even bother if you have to use scaling other than 100%, sure you can scale the DOM0 but the rest of the VMs are not scaled and there is no documentation on how to do it.

Yes there is. https://github.com/Qubes-Community/Contents/blob/master/docs...

> What we need are simple sandboxes that isolate GUI applications into chroot environment and keep them away from other applications and documents.

The history of local root exploits ("Cheap and easy!") would argue that doing such a thing and relying on the kernel is just security theater.

Yes, you can remove them via the standard package manager depending on which particular template. Note that you should be careful when removing some packages because of some Qubes dependencies. Not entirely sure if it's still an issue, but I'll link to this resource just in case

Thank you, but this isn't what I'm going for. I'm going for the documented solution, which was working on previous versions of Qubes.

I've installed Windows 10 in a Standalone VM, to use some necessary work applications. Everything is working fine, but I can't attach USB devices. To fix this, my understanding is that it is necessary to install Qubes Windows Tools. Following the instructions (https://github.com/Qubes-Community/Contents/blob/master/docs/os/windows/windows-tools41.md), I've successfully downloaded the Qubes Windows Tools installation disk iso and done a checksum to verify it.

How To make a VPN Gateway in Qubes

dots