• NaibofTabr@infosec.pub
    link
    fedilink
    English
    arrow-up
    3
    ·
    edit-2
    3 days ago

    I have run it on a laptop in the past, and I think it’s a good option for a mobile system that you may be using on public/unsafe wifi and/or if your laptop is your primary computer and is actively carrying sensitive data (e.g. PII, financial records, health records, etc) that you want to keep in a separate environment from normal activities (though my advice would still be to keep such data on an external drive that is normally unplugged). It’s not a good choice if you want to use that system for gaming - the hardware driver abstraction and segregation causes problems.

    I don’t really have a use case for it at the moment so I don’t have any systems running it. It’s OK for general use if you’re not doing anything particularly complicated. Document editing, web browsing, code development - no problem. I wouldn’t recommend it if you’re doing CAD/3D modeling, graphics, audio/video editing, &etc - it’s not really a good platform for doing creative work, too many complications.

    The base system is not particularly heavy, though obviously the more VMs you run concurrently the more resources you’ll need. It does require specific virtualization features for the CPU (documented in Choosing Hardware), which are not always available especially on laptop processors. My laptop had a mobile version of AMD Ryzen which worked. That was a 13" lightweight laptop, nothing too beefy, and it ran Qubes with a couple Debian VMs just fine.

    Once you understand the basics of using dom0 to control the other VMs (and that you don’t ever use dom0 for anything besides configuring and launching the other VMs) it’s fairly straightforward. You do have to get used to virtually unplugging any USB devices from one VM and then plugging them into another (no bridging VMs via USB, that would break data security) but it makes sense if you think of those VMs as separate computers.

    I think it’s great if you’re traveling a lot with a personal laptop and you won’t have control over the networks you connect to, because you can basically seal off any sensitive data from any external/untrusted connections in completely separate virtual environments. You can have VMs which just don’t ever have network access and so are “air gapped” by virtue of not even having network drivers installed, and then just manually transfer specific pieces of data as needed.