Building a trustworthy laptop

Hello Lain, for a while I've been interested in building the most practically secure device possible. Here is my software and parts list after a lot of research: Required hardware >Thinkpad X230 >Wireless card that doesn't require binary blobs (Atheros) >Nitrokey 3A, used for unlocking device and verifying boot integrity. >8gb RAM minimum Software: >QubesOS (Not much better security than isolating every OS component into it's own hardware VM) Firmware: >Heads coreboot distribution Website: https://osresearch.net/ Interesting talk on the reasoning and methodology behind the project: https://trmm.net/Heads_33c3/ I chose the Thinkpad X230 because it is explicitly supported by QubesOS and the Heads coreboot distribution. I suggest an atheros wireless card because it's my belief that the less blobs in a system the better. I recommend Heads over normal coreboot because it allows you to cryptographically verify the integrity of the boot process, thus removing the possibility of your kernel being tampered with by someone modifying the (normally) unencrypted boot partition. It's a very interesting project so I suggest reading about it on the website. I'd love to hear some of Lain's thoughts on my conclusions and any suggestions on improvement.

>>23277 >any suggestions on improvement Without a threat model all you are doing is masturbation.

Qubes will be a pain in the ass, please consider using Qubes with a Thinkpad which is a W or T Series.

>>23277 Overall it's an okay configuration; depending on what your specific use case is, 'better' is more up to opinion. That being said, are you planning to move this laptop often and thus utilize its portability? There are other devices like some dual cpu towers that would offer far more cpu power, and upgradability via pcie, pci, and other various ports allowing you to plug in and fit to what you may need.

>>23279 I'll say that my threat model is very minimal, and that this is (for now) largely a pursuit born of interest, but I wouldn't dismiss it as masturbation. The world is becoming a less stable place, and governments are increasingly encroaching on one's privacy and one's daily life. As a Euroid, I'm increasingly uncomfortable with the relationship between data, government, and corporations. Should things go to soykaf, I would like to have a device within reach that can, if not guarantee, then greatly increase my chances my data and life remaining mine. >>23284 I would consider doing so, but one of the benefits of the X230 is that it is remarkably easy to flash the firmware. I've successfully flashed an X220, but when I attempted the same on my T420, it did not survive. X230 is also far more portable. >>23286 I'm nearly constantly on the move, so for me desktops are not very useful. I prefer to keep everything I need simple, such that it fits in a singular bag.

use openbsd and then run quebes on a virtual machine

>>23307 Qubes isn't meant to be virtualized

>>23307 >use openbsd and then run quebes on a virtual machine Good idea if the hypervisor openbsd has been working on for 20 years could run anything except headless openbsd. Maybe in 2044.

This picture looks very retarded. Mushroom clouds are formed by the natural convection of heat, that is parallel to the gravitational force vector, so: it won't lean sideways just because you made the explosion on a hillside. It will always be vertical.