# Linux Laptops? System76? Other options? **URL:** https://discuss.privacyguides.net/t/linux-laptops-system76-other-options/16557 **Category:** Off Topic **Tags:** hardware **Created:** 2024-01-29T19:55:06Z **Posts:** 79 ## Post 1 by @AnonymousIceCoffee — 2024-01-29T19:55:06Z My current laptop is nearly 10 years old and I’m looking to get something with a bit more power. I’m considering System76. Has anyone used their laptops? Are there any other laptops that you guys use? --- ## Post 2 by @exaCORE — 2024-01-29T19:56:15Z I use Framework, and personally have been very happy with their product: [https://frame.work](https://frame.work) --- ## Post 3 by @redoomed1 — 2024-01-29T19:58:32Z > [@AnonymousIceCoffee](#): > > Has anyone used their [System76] laptops? There is a fairly recent thread on this that you might want to check out: [Experience with System 76?](https://discuss.privacyguides.net/t/experience-with-system-76/16292) > [@AnonymousIceCoffee](#): > > Are there any other laptops that you guys use? I’m using a Lenovo Thinkpad for academic stuff. --- ## Post 4 by @anon29374801 — 2024-01-29T20:43:26Z Hard to give a suggestion without knowing your use case. Can you elaborate on what you will mainly do with this computer? “more power” can mean a lot depending on what tasks you use the computer for. > [@exaCORE](#): > > I use Framework, and personally have been very happy with their product: [https://frame.work](https://frame.work) Just beware they did have a recent [data leak.](https://www.tomshardware.com/software/security-software/modular-laptop-maker-framework-contacts-customers-after-phishing-scheme-hooks-internal-spreadsheet-packed-with-personal-data) Looks like social engineering and not an actual security flaw was the issue. > However, we are relieved to note that the leaked PII is claimed to consist solely of the following details: full name, email address, and the balance owed. Have to say though, if I was in the market for a laptop they would be who I would look at. Love the modularity. --- ## Post 5 by @Anvil — 2024-01-29T22:46:59Z Same. Mine’s a couple years old now still going strong. The new Framework 16 looks very cool. Also they have very good [linux support](https://frame.work/linux). Mine works pretty much flawlessly with Fedora. --- ## Post 6 by @xe3 — 2024-01-30T00:12:03Z Linux-focused laptop vendors: 1. System76 2. Framework 3. Tuxedo 4. Starlabs 5. Slimbook 6. Purism 7. Pinebook Major vendors that have pretty good linux support: 1. Dell XPS (“Developer Edition” comes pre-installed with Ubuntu) 2. In the past I believe Lenovo offered models with Ubuntu or Fedora, not sure if they still do. --- ## Post 7 by @pinkandwhite — 2024-01-30T00:43:06Z Purism is a meme, they have hardware switches that are theatre at best even if they work (and in the GOS rooms there have been reports that they don’t even work) The other vendors are mostly alright though imo --- ## Post 8 by @anon21489307 — 2024-01-30T02:29:08Z You might want to look at [**Ubuntu certified laptops**](https://ubuntu.com/certified/laptops). Anything on there is good for Ubuntu, not necessary Linux. Other than the Ubuntu certified laptops, I would buy Framwork. --- ## Post 9 by @dngray — 2024-01-30T04:53:52Z > [@anon21489307](#): > > You might want to look at [**Ubuntu certified laptops**](https://ubuntu.com/certified/laptops). Anything on there is good for Ubuntu, not necessary Linux. This is what I would do. Did some research with some other people on this: **1. Framework** Framework is bad with firmware updates. They are so bad, the 12th and 13th gen Intel computers have not gotten any updates since their release. [1](https://knowledgebase.frame.work/en_us/framework-laptop-bios-and-driver-releases-13th-gen-intel-core-BkQBvKWr3), [2](https://knowledgebase.frame.work/framework-laptop-bios-and-driver-releases-12th-gen-intel-core-Bkx2kosqq). The AMD models get updates a bit more frequently, but IIRC they are still all vulnerable to [Logofail](https://binarly.io/posts/The_Far_Reaching_Consequences_of_LogoFAIL/) according to their forums. They do not seem to take firmware security seriously and I’d recommend avoiding them. **2. StarLabs** No [Boot Guard](https://www.intel.com/content/dam/www/central-libraries/us/en/documents/below-the-os-security-white-paper.pdf). [AMD Platform Secure Boot](https://www.amd.com/en/technologies/pro-security) is the equivalent. **3. Purism** Circular logic. PureBoot cannot provide anti tampering by design. They are trying to check whether the firmware has been tampered with by trusting the measurements given to the TPM by the firmware, which the firmware can always lie about. No Boot Guard to talk about. Decrepit old hardware with no memory encryption. Overpriced. On top of that, the CPU is unfused. (The eFuse is to prevent tampering) **4. System76** HSI 0 on most models. Very concerning results on LVFS like BootGuard fuse not being blown. `fwupdmgr security` is not very reliable so that that with a grain of salt. However, exercise extreme caution with System76 because this does not look promising. They only just got secure [boot very recently](https://github.com/system76/firmware-open/issues/111#issuecomment-1571036528), some notes there about bricking if you have 10th gen or earlier. **5. Modern Dell Latitude/Precision** HSI 4 - Secure Cored - Regular firmware updates - vPro Enterprise models have [Memory Encryption](https://www.intel.com/content/www/us/en/architecture-and-technology/vpro/hardware-shield/total-memory-encrpytion.html) - Blows Fuses on security updates, preventing downgrade attacks - Minor issue of not measuring whether hyper-threading is enabled in the firmware or not. The Microphone toggle in the firmware doesn’t work. No deal breaker. The HSI level is going to be shown in GNOME: > **[Use fwupd to deploy Linux firmware updates and more | Red Hat Developer](https://developers.redhat.com/articles/2023/10/06/use-fwupd-deploy-linux-firmware-updates-and-more)** > > fwupd is a Linux daemon for updating device firmware. Explore ways to enumerate devices, query security levels, and control the fwupd daemon to deploy updates --- ## Post 10 by @sha123 — 2024-01-30T08:24:13Z Would recommend to stay away from Linux focused vendors, because some of them don’t even get the minimum of security right. Choose a laptop from a reputable brand like Dell, Microsoft or Lenovo and preferably a secured-core device which will provide a good security baseline. Dell and Microsoft also provide longer firmware updates than other brands, but I don’t know how Linux support is on Microsoft devices. --- ## Post 11 by @Anvil — 2024-01-30T14:35:48Z > Framework is bad with firmware updates. They are so bad, the 12th and 13th gen Intel computers have not gotten any updates since their release. It seems like Framework has been releasing beta firmware updates for 12th gen laptops, so if security is a priority for you, you could install those [1](https://community.frame.work/t/12th-gen-intel-core-bios-3-06-beta/25726), [2](https://community.frame.work/t/12th-gen-intel-core-bios-3-08-beta-release/43244). I actually seem to get beta updates by default on my 11th gen laptop using fwupdmgr in linux. --- ## Post 12 by @dngray — 2024-01-30T14:52:55Z Does seem the beta release [v3.08](https://community.frame.work/t/12th-gen-intel-core-bios-3-08-beta-release/43244) addresses logofail and perhaps things will speed up [with the 11th gen](https://community.frame.work/t/11th-gen-intel-core-bios-3-19-release/36119). > We’ve been delayed on BIOS updates due to issues we found in the update process, especially on Linux, and due to staffing constraints at our ODM partner. We’re working with them to enable more consistent staffing for sustaining work on launched programs. Note that there is a matching firmware update in progress for 12th Gen Intel Core, and the release schedule has been slow due to these issues. The last CVEs I see for 11th gen were in 2022, in v3.17. I’m sure there were some others in 2023. --- ## Post 13 by @seize — 2024-01-31T03:07:52Z It looks like Lenovo still offer _some_ Linux devices (Only one laptop, and a few mini PCs). [https://www.lenovo.com/us/en/d/linux-laptops-desktops/](https://www.lenovo.com/us/en/d/linux-laptops-desktops/) --- ## Post 14 by @dumpster — 2024-01-31T04:29:07Z > [@dngray](#): > > **4. System76** > [@dngray](#): > > They only just got secure [boot very recently](https://github.com/system76/firmware-open/issues/111#issuecomment-1571036528) Unfortunately [it isn’t a proper implementation](https://github.com/system76/firmware-open/blob/3e19b73397c27cf88b048902a3f080f584d0f851/docs/uefi.md#secure-boot): > Note that the Secure Boot support present is only intended for allowing Microsoft Windows installation checks to pass. It should not be relied on for system security due to limitations of the implementation. --- ## Post 15 by @curious78 — 2024-01-31T19:23:55Z Thank you for this list and all the other comments in this tread. To my anecdotal view/recall, it seems that hardware discussions on privacy forums break down into 4 differentiating preference camps: 1- install Linux on anything, maybe something already at hand, maybe for the sake of not allowing a device to go to the landfill. 2-install Linux on a laptop that is known to work well which leads to lists like the Ubuntu or Qubes compatibility lists. 3-focus on using Linux on a device with a proper HSI, probably HSI:4 which leads to basically Dell, Lenovo, etc. 4-focus on neutering Intel ME and avoidance of AMD PSP which leads to many of the Linux niche shops including some very old laptops. Is there any way to accomplish HSI:4 hardware + neutered IME? Or, is it more realistic to focus on HSI:4 with hardware-compatible Linux distro and consider an IME vuln to be a distraction (since associated zerodays would be notably costly to delpoy)? Threat model = average privacy conscious person not working in a critical-information job, keep personal stuff private (family photos, etc), avoidance of ad-tech surveillance, avoid ransomware attacks, but also avoid privacy invasion trends/creep (near-term future resilience). --- ## Post 16 by @exaCORE — 2024-01-31T19:48:35Z For most people IME is not a concern because finding 0 days in it is very difficult and expensive and wouldn’t be ‘wasted’ on an average person. --- ## Post 17 by @purplecactus — 2024-02-01T05:00:00Z believe Lenovo does this still. i ordered a thinkpad with Fedora preinstalled last year --- ## Post 18 by @dngray — 2024-02-01T05:24:52Z > [@curious78](#): > > Is there any way to accomplish HSI:4 hardware + neutered IME? No, because you need some of that firmware for the newer features. > [@exaCORE](#): > > For most people IME is not a concern because finding 0 days in it is very difficult and expensive and wouldn’t be ‘wasted’ on an average person. and even then it’s arguable whether giving up all the newer security features is even better. Note there’s never ever been any “evidence” that ME is somehow spyware, it’s a misconception “free” folks spread because “haven’t seen source code”. The realistic truth is x86\_64 has patents. Not really worth worrying about open platform until RISC-V is common or something less encumbered. --- ## Post 19 by @jonah — 2024-02-01T06:40:34Z Not sure what you’re all talking about because _numerous_ well-documented security vulnerabilities in IME have been found (here’s one [list](https://en.wikipedia.org/wiki/Intel_Management_Engine#Security_vulnerabilities) of them). Whether it’s _spyware_ or not is up for debate, but it **is** a concern and should **absolutely** be disabled if you have the option regardless of whether it’s a _spooky_ backdoor or spyware, **in the simple interest of attack surface reduction.** I probably wouldn’t use tools which go _beyond_ (e.g. by ‘neutralizing’ IME firmware) the “supported” method of disabling IME by setting the [HAP](https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable-bit) bit though, due to potential unforeseen consequences. Basically… if your device gives you the option in the BIOS or whatever, do it, _but_… probably not something most people need to worry about otherwise. More reading on the topic of IME elsewhere: [How can I have a computer without Intel ME?](https://discuss.privacyguides.net/t/intel-me-and-more/14803) * * * > [@curious78](#): > > Threat model = average privacy conscious person not working in a critical-information job, keep personal stuff private (family photos, etc), avoidance of ad-tech surveillance, avoid ransomware attacks, but also avoid privacy invasion trends/creep (near-term future resilience). Anyways, all of this being said, it doesn’t sound like hardware vulnerabilities are even a likely threat for you? Seems like you’ll be alright with any hardware given you’re running modern Linux. I wouldn’t go overboard with this kind of stuff unless you just enjoy it. --- ## Post 20 by @dngray — 2024-02-01T07:03:30Z > [@jonah](#): > > Not sure what you’re all talking about because _numerous_ well-documented security vulnerabilities in IME have been found (here’s one [list](https://en.wikipedia.org/wiki/Intel_Management_Engine#Security_vulnerabilities) of them). Whether it’s _spyware_ or not is up for debate, but it **is** a concern and should **absolutely** be disabled if you have the option regardless of whether it’s a _spooky_ backdoor or spyware, **in the simple interest of attack surface reduction.** I mean intentional backdoors put by “insert security agency”. Every thing has vulnerabilities, even open source firmware. TLDR most of the misconceptions come from a particular part AMT which is meant for fleet management. The issue is if you want those newer features, in the higher HSI levels you need some firmware to do that. > [@jonah](#): > > probably wouldn’t use tools which go _beyond_ (e.g. by ‘neutralizing’ IME firmware) the “supported” method of disabling IME by setting the [HAP](https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable-bit) bit though, due to potential unforeseen consequences. Right, and that tool is unmaintained and hasn’t been tested since Coffee Lake (8th gen intel). If your CPU is that old then it’s going to be unsupported anyway. --- ## Post 21 by @sha123 — 2024-02-01T07:49:48Z > [@jonah](#): > > Not sure what you’re all talking about because _numerous_ well-documented security vulnerabilities in IME have been found Every software has vulnerabilities and so does most hardware. > [@jonah](#): > > but it **is** a concern and should **absolutely** be disable No it shouldn’t, since it will make important security features unavailable. The only thing which should be deactivated is remote functionality, which is deactivated in non-enterprise environments anyway by default. > [@jonah](#): > > in the simple interest of attack surface reduction. It increases attack surface, due to having less security features, which outweigh the downsides. > [@jonah](#): > > Seems like you’ll be alright with any hardware given you’re running modern Linux. Running modern Linux doesn’t mitigate missing hardware security features, lack of good firmware or lack of firmware updates in any meaningful way. --- ## Post 22 by @curious78 — 2024-02-01T23:27:22Z > [@sha123](#): > > The only thing which should be deactivated is remote functionality, which is deactivated in non-enterprise environments anyway by default. How can this be verified? --- ## Post 23 by @curious78 — 2024-02-01T23:38:22Z > [@jonah](#): > > Anyways, all of this being said, it doesn’t sound like hardware vulnerabilities are even a likely threat for you? Seems like you’ll be alright with any hardware given you’re running modern Linux. > > I wouldn’t go overboard with this kind of stuff unless you just enjoy it. It is probably true that hardware vulnerabilities like IME are not a threat to me but there is something near my core that is fairly bothered by IME and PSP and the access they potentially have. * * * Would like to expand the discussion to AMD PSP, if possible. I read this recently over at [anonymousplanet.org](http://anonymousplanet.org): “we recommend the use of AMD CPUs instead of Intel CPUs.” “AMD laptops could be more interesting as some provide the ability to disable AMD PSP (the AMD equivalent of Intel IME) from the BIOS/UEFI settings by default. And, because AFAIK, AMD PSP was audited and contrary to IME was not found to have any “evil” functionalities[306](https://anonymousplanet.org/guide.html#fn:304)” “AMD PSP does not provide any remote management capabilities contrary to Intel IME.” Does anyone agree with this? Would you recommend AMD over Intel? Does anyone have knowledge of laptops that allow disabling PSP in BIOS? Can it be confirmed to be disabled? Can anyone confirm that PSP dose not have remote management capabilities? Thanks --- ## Post 24 by @dngray — 2024-02-02T15:50:50Z > [@curious78](#): > > I read this recently over at [anonymousplanet.org](http://anonymousplanet.org): Anonymous planet isn’t really a good source of anything. They come up with arbitrary reasons for a lot of things based on hearsay. They’ve also got a tendency to have a very confused threat model “one minute not protect you from NSA”, next minute “do this thing to make you NSA proof”, depending on the frame of mind of the writer and which contributor it was. > [@curious78](#): > > “AMD PSP does not provide any remote management capabilities contrary to Intel IME.” Which again shows how little they know about it. That’s a part of [AMT](https://en.wikipedia.org/wiki/Intel_Active_Management_Technology) and not available in non [vPro CPU](https://en.wikipedia.org/wiki/Intel_vPro)s. The fact is Ryzen Pro is in very few laptops, so doubtful anyone has checked those units, but they certainly advertise a [similar feature](https://www.amd.com/en/technologies/security-manageability) in their professional CPUs. The problem is people in privacy communities hear **remote management** and lose their shit. This is not a privacy issue, the “remote management” would be managed _by you_, as you are the owner 100%. It’s not some special magical backdoor for employees at Intel/AMD. It is designed for an IT management team which might be managing 500 of these laptops for an enterprise. Anyone who has managed an enterprise server will be aware of things like [iLO](https://en.wikipedia.org/wiki/HP_Integrated_Lights-Out), [DRAC](https://en.wikipedia.org/wiki/Dell_DRAC), [MegaRAC](https://en.wikipedia.org/wiki/MegaRAC) (or more generally known by it’s non-brand name as [IPMI](https://en.wikipedia.org/wiki/Intelligent_Platform_Management_Interface)). That is what the feature is for, and why it is only in “professional CPU” like vPro and Ryzen Pro, which are only in some business grade models eg: Thinkpad workstations, Latitudes, Precisions etc. That is however the kind of CPU you need if you want to reach the higher HSI levels - like HSI 4. > [@curious78](#): > > Does anyone agree with this? Would you recommend AMD over Intel? Not particularly, anything that could happen with Intel is just as equally possible with AMD. > [@curious78](#): > > Does anyone have knowledge of laptops that allow disabling PSP in BIOS? Can it be confirmed to be disabled? Cannot be done. In any case things like MEcleaner are ancient anyway and not really applicable to any modern cpu beyond 8th gen intel. --- ## Post 25 by @null — 2024-02-02T18:13:28Z Here is all Linux + Coreboot vendors that I know of - Starlabs (Non Clevo) - NovaCustom (Heads option) - System76 - Purism (Heads option aka) - Nitrokey (Heads option same as NovaCustom. They also sell a desktop with Coreboot) - MALIBAL (they sell Tuxedo’s InfinityBook with Coreboot pretty much) edit: [Lmao](https://www.youtube.com/watch?v=Tk_qg-_mFtQ) --- ## Post 26 by @curious78 — 2024-02-02T22:58:31Z > [@dngray](#): > > The problem is people in privacy communities hear **remote management** and lose their shit. This made me laugh out loud. Love it. Thank you for your your comments. --- ## Post 27 by @anonymous124 — 2024-02-02T23:39:26Z When I was shopping for one a year ago, I found “Laptops with Linux” to be the best, considering customization, price and reliable reviews. I have since found their laptop and customer service to be perfect. No issues. I highly, highly recommend. Not only to the standard user, but to the privacy extremist who wants their laptop shipped with the removed camera/mic and wifi/bluetooth module, with Kali pre-installed. They have a deal with Mullvad if you want to get a subscription voucher. I genuinely felt injustice on their behalf… seeing that nobody has yet mentioned them. > **[Buy a Linux laptop - Custom laptops with Ubuntu or Linux Mint](https://laptopwithlinux.com/linux-laptops/)** > > Want to buy a Linux laptop? The best preinstalled Linux laptops of 2025. Go for freedom, choose Open Source! ✓Free Shipping ✓14-days Reflection! --- ## Post 28 by @anon73250778 — 2024-02-03T15:24:16Z I currently use an Asus laptop. This is the [list](https://wiki.archlinux.org/title/Laptop/ASUS) that Arch wiki says what works and what wont. There are lists for other manufacturers as well. - They install Linux well. - The non-Nvidia GPUs work great out of the box for Fedora. My current laptop’s fingerprint sensor doesnt work with Linux. There is another [list](https://linux-hardware.org/) for what parts work and what doesnt. I was not aware of the site before my purchase. * * * Alternatively, the Steam Deck is a capable Linux device and you can exit into Arch. The optics of having a Steam Deck for a portable computer looks bad for work though. Valve does good work with Linux but isnt really privacy centric. Im thinking the GPD small laptop devices should also work fine? --- ## Post 29 by @anon39779771 — 2024-02-13T21:36:20Z > [@xe3](#): > > Framework Framework Linux battery life varies wildly based on reviews. > **[[TRACKING] Linux battery life tuning](https://community.frame.work/t/tracking-linux-battery-life-tuning/6665)** > > Ubuntu: There is now an official guide for Optimizing Ubuntu Battery Life on the Framework Knowledgebase written by Linux Support Lead @Matt_Hartley! If you are using Ubuntu, that is the recommended course of action. For other distros: There are... > **[Power optimizations under Windows: lower temps, longer battery life](https://community.frame.work/t/power-optimizations-under-windows-lower-temps-longer-battery-life/19505)** > > Not all users seem to be happy with battery life or noise emissions of their Framework Laptop. They both can be caused by a too busy CPU. That in turn may be the result of resource hungry background processes or not optimally configured power... > **[Reddit - The heart of the internet](https://www.reddit.com/r/framework/comments/w96xda/whats_the_deal_with_this_battery_life/?rdt=33960)** > > > I find the battery life on my framework 13 really bad (ubuntu installed).

There's some issue where the battery drains fairly quickly in suspend which requires enabling "deep sleep" mode, but it still drains a lot faster than other laptops I've had.

And then the battery life in general isn't very good; I'd say ~2 hours at full brightness with some video streaming... Unless you need x86 applications you should consider buying a tablet with a keyboard and thus essentially turning it into laptop. Maybe buy a mouse too. iPad’s generally have great security, but so does a Pixel Tab with GrapheneOS installed. Just some food for thought. There may be drawbacks for your workflow if you rely on desktop software like the Adobe suite, Office, though you may be able substitue them with alternative or web-based apps. --- ## Post 30 by @exaCORE — 2024-02-13T21:38:38Z > [@anon39779771](#): > > Framework Linux battery life varies wildly based on reviews. I was able to get a lot more battery life by using these suggestions: [Optimizing Fedora Battery Life](https://knowledgebase.frame.work/en_us/optimizing-fedora-battery-life-r1baXZh) --- ## Post 31 by @anon39779771 — 2024-02-13T21:50:45Z That is also good. Didn’t know there were multiple guides. But even then, the fact that this is not working by default is concerning, this particular tester found that the default Fedora battery usage is extraordinarily high compared to other distros in his tests: [https://youtu.be/S4Dr8qVHDmc](https://youtu.be/S4Dr8qVHDmc) Also this is really subjective but I would rather have an easily repairable versatile IO that is not changable than their current implementation. Most other things are fine. --- ## Post 32 by @exaCORE — 2024-02-13T21:56:10Z I don’t use Fedora (I run Arch), so I cant comment on the Fedora thing. The reason it isn’t by default is because: 1. It is a unique tlp config based on system specs 2. It significantly throttles gpu and cpu when on battery (i get some stuttering in some situations in KDE), however the trade off is worth it IMO --- ## Post 33 by @anon46412288 — 2024-02-14T06:10:59Z what about using power-profiles-daemon? i don’t have framework/system76 laptops but on my laptop power-profiles-daemon’s battery saver does seem to work and reduce power usage --- ## Post 34 by @exaCORE — 2024-02-14T06:14:50Z I’ve heard of that, but don’t know much about it. Does it offer as much customizability as TLP? --- ## Post 35 by @anon46412288 — 2024-02-14T06:17:13Z it offers 3 preset options : Power Saver, Balanced and Performance modes. paired with KDE powerdevil it can be customised a lot but by itself it doesn’t do much ig. I just use the presets. --- ## Post 36 by @exaCORE — 2024-02-14T06:21:02Z The big thing that helped me get better battery life was throttling the GPU and CPU, disabling boost, and setting the CPU battery mode to superpowersaver (or something along those lines). Id be interested in knowing if power profile daemon allows one to configure these settings. also, another nice thing about Framework is that you can cap the charge amount in the bios (I have it capped at 90% to help preserve the battery a little longer). --- ## Post 37 by @anon46412288 — 2024-02-14T06:23:52Z i’m not sure if i can cap my battery level in BIOS but on my laptop KDE powerdevil has an option to cap charge (however the cap is reset after every reboot). --- ## Post 38 by @Regime6045 — 2024-02-14T12:40:18Z I recall that in the documentation for the AMD laptop they said you should use `power-profiles-daemon` rather than `tlp`. edit: Here [Optimizing Ubuntu Battery Life](https://knowledgebase.frame.work/en_us/optimizing-ubuntu-battery-life-Sye_48Lg3) > For Framework Laptop 13 AMD Ryzen™ 7040 Series configurations, you will absolutely want to use power-profiles-daemon for the absolute best experience. Do NOT use TLP. Without getting too detailed, there are things happening behind the scenes that require PPD for the best experience for our Linux customers. --- ## Post 39 by @anon46412288 — 2024-02-14T13:32:53Z I wonder what those details are that make power-profiles-daemon better. :thinking: --- ## Post 40 by @Regime6045 — 2024-02-14T13:57:35Z There’s actually a _long_ thread on it: [[TRACKING] PPD v TLP for AMD Ryzen 7040 - Linux - Framework Community](https://community.frame.work/t/tracking-ppd-v-tlp-for-amd-ryzen-7040/39423/) I think my tl;dr (just read the first and last few posts) is that: - “a contact on AMD’s side has expressed that TLP will likely interfere with AMD’s suspend” - some users are nevertheless reporting better battery life with `tlp` - someone (Mario Limonciello) has patched `power-profiles-daemon` with optimizations specifically for the Framework laptop, his pull requests have now been accepted and should be part of the next release (v0.14) of ppd. --- ## Post 41 by @retouch — 2024-02-14T23:17:35Z > [@dngray](#): > > **StarLabs** > > No [Boot Guard](https://www.intel.com/content/dam/www/central-libraries/us/en/documents/below-the-os-security-white-paper.pdf). Any change to the likelihood of this point being addressed by StarLabs, given [recent Qubes certification](https://www.qubes-os.org/news/2024/01/10/starlabs-starbook-qubes-certified/)? > [@dngray](#): > > Modern Dell Latitude/Precision Just for my notes, “modern” here means after a certain year, or generation? --- ## Post 42 by @Valynor — 2024-02-15T00:30:12Z If used is an option: 2nd hand intel Macbook Pros (2015-2020) unironically make _excellent_ Linux laptops and are not very expensive. --- ## Post 43 by @Regime6045 — 2024-02-15T09:21:43Z (re: patch to improve battery life on AMD Framework) What timing, today this landed in power-profiles-daemon (v0.20). > This PR is now merged upstream is part of the 0.20 release. Several people have reported battery life improvements between 2x and 3x from this change request. Users of rolling distros like Arch or OpenSUSE should get it soon, Fedora and Ubuntu with the upcoming releases hopefully. --- ## Post 44 by @PoorPocketsMcNewHold — 2024-02-15T09:30:02Z Surprised nobody suggested the MNT Reform (and Pocket reform, but that’s a palm PC there) > **[MNT Reform Laptop - MNT Research Shop](https://shop.mntre.com/products/mnt-reform?taxon_id=13)** > > MNT Reform is uniquely designed to be as open and transparent as possible, and to support a free and open source software stack from the ground up. But again, I’m unable to provide a decent security analysis on it, nor if the company is on par with privacy truly. --- ## Post 45 by @anon73250778 — 2024-02-15T11:28:51Z If only the battery were easily replacable… --- ## Post 46 by @Valynor — 2024-02-15T14:37:16Z Depending on the model it’s actually not that hard, see iFixit videos. --- ## Post 47 by @anon94009837 — 2024-04-29T10:34:20Z I’d like to mention NovaCustom too. - At least 5 years firmware updates after **your** purchase - Boot Guard will be [implemented](https://forum.qubes-os.org/t/novacustom-nv41-laptop-review/23434/68) with their next Dasharo firmware update - Will be able to achieve [up to HSI:3](https://forum.qubes-os.org/t/novacustom-nv41-laptop-review/23434/70) after BootGuard is implemented - No memory encryption unfortunately --- ## Post 48 by @anon73250778 — 2024-04-29T11:02:06Z > [@anon94009837](#): > > No memory encryption unfortunately Is the need for memory encryption for advanced protection, like when someone got physical access to your computer and wants to do a complete memory dump (of the RAM) to get certain encryption keys? --- ## Post 49 by @anon94009837 — 2024-04-29T11:29:34Z Yes, protects mainly against physical attacks on hardware. --- ## Post 50 by @anon73250778 — 2024-04-30T09:55:00Z Ok so this recent post had me on a bit of chasing a rabbit hole. Right now I am looking at HP Mini PC from an older generation (i3-1215U) (because somehow it is the only one available brand new through online retail where I am. What hardware can I get at least an HSI-3 level of security? The enterprise hardware of Dell, HP and Lenovo? Anyone care to post what the HSI score of their daily driver is? Mine is… HSI-0, unfortunately… :face_with_raised_eyebrow: :thinking: :dizzy_face: :confounded: :persevere: like… all of them… The “trash” PC i have for work has I think at least HSI-2 Definitely something to look at in the future, on my next upgrade cycle. --- ## Post 51 by @anon94009837 — 2024-04-30T10:33:23Z > [@anon73250778](#): > > What hardware can I get at least an HSI-3 level of security? Well as I said above, NovaCustom will have HSI-3 by default soon so that is an option. Framework laptops (13th Gen) achieve HSI-3. They can achieve HSI-4, assuming you get the vPro enabled CPU. I would not recommend Framework for now though as they have a bad history with shipping firmware updates. (Intel 13th Gen has not recieved a firmware update from launch) They would be a good option in the future however when they sort out their firmware updates and ship them consistently. (Outdated firmware leads to Framework laptops showing HSI-0) Dell, Lenovo and HP enterprise hardware is the same deal as Framework (HSI-4 with vPro CPU, HSI-3 without) but they ship firmware updates consistently. I have an HP Pavillion (a non-enterprise laptop aafik) lying around with HSI-3 though so maybe HP consumer laptops also have a good standard for security. I recieve firmware updates on it too. --- ## Post 52 by @anon46412288 — 2024-05-06T10:34:05Z > [@anon73250778](#): > > What hardware can I get at least an HSI-3 level of security? The enterprise hardware of Dell, HP and Lenovo? You can check [fwupd’s site](https://fwupd.org/lvfs/hsireports/devices) for hardware security of various laptops. (Note : The results are uploaded by endusers of the devices so may not be 100% accurate. However I was able to verify that my laptop has the same HSI security as listed on fwupd’s site.) Theoretically all of the listed manufacturers’ enterprise hardware should be good enough and reach a HSI3 level of security. For example the [ThinkPad E16 Gen 1](https://fwupd.org/lvfs/hsireports/device?host_vendor=LENOVO&host_family=ThinkPad+E16+Gen+1&host_product=21JN0008HV) meets this HSI level. For Linux, a laptop that supports fwupd firmware updates is a must. Some laptops offer bootable CDs for manual firmware updates, but that isn’t the same level of support as automatic updates. Also, I would avoid system76 since [none of their laptops receive updates via fwupd](https://fwupd.org/lvfs/vendors/#system76) despite them marketing themselves as a Linux focussed laptop company. For a while they had their [custom firmware updater](https://blogs.gnome.org/hughsie/2018/05/09/system76-and-the-lvfs/) for updating all device firmware. --- ## Post 53 by @anon73250778 — 2024-05-06T14:46:00Z So I dug in a bit deeper with my various systems. Turns out I need to download the firmware from the manufacturer’s website and then flash the BIOS into my devices. My laptop daily driver went from HSO-0 to at least an HSI-1 but my gaming machine remains sadly HS:0. Fair enough. Having an up to date BIOS → `sudo fwupdmgr update` command–\> reboot improved my security. Turns out I was neglecting my hardware/firmware updates and should check the entire computer in my home. I have a new computer coming from a more enterprise focused brand and it should improve my non-gaming daily driver usage. I now have a proper option to just have a VLAN separated Windows 11 gaming machine with no other activity whatsoever. --- ## Post 54 by @dumpster — 2024-05-06T16:45:58Z > For a while they had their [custom firmware updater](https://blogs.gnome.org/hughsie/2018/05/09/system76-and-the-lvfs/) for updating all device firmware. It still exists, and is FOSS, with official deb binaries and unofficial rpms. It’s on AUR, too. I’ve never had any trouble getting it (at least its CLI) working on any of the distros I’ve tried. > **[GitHub - system76/firmware-update: System76 Firmware Update Utility](https://github.com/system76/firmware-update)** > > System76 Firmware Update Utility The biggest issue with them is it seems most of their hardware is HSI-0 or 1. Also some devices rely on DKMS (unsupported in Fedora Atomic), and it seems firmware updates are infrequent or rare on many devices. --- ## Post 55 by @a_user — 2024-05-07T01:19:56Z What about 2015-2020 Intel iMacs? I’d like to extend the life of mine once Apple is done with it in a few years. Worth nothing that I was particularly interested in installing Fedora Silverblue on it. --- ## Post 56 by @anon46412288 — 2024-05-07T13:30:08Z > [@dumpster](#): > > It still exists, and is FOSS, with official deb binaries and unofficial rpms. It’s on AUR, too. I’ve never had any trouble getting it (at least its CLI) working on any of the distros I’ve tried. While the firmware updater that they use is FOSS, the method they use to update does not even follow the UEFI spec. They use a proprietary tool to flash their firmware. From the blog post that I linked : > Discussions got stuck when we found out they currently use a nonfree firmware flash tool called `afuefi` rather than use the UEFI specification called `UpdateCapsule`. --- ## Post 57 by @Average_Joe — 2024-07-08T22:19:26Z > [@AnonymousIceCoffee](#): > > My current laptop is nearly 10 years old and I’m looking to get something with a bit more power. I’m considering System76. > > Has anyone used their laptops? Are there any other laptops that you guys use? Just curious how you went with this? I’ve gone through the thread but did nobody mention buying a regular Windows PC laptop and hardening the Windows install as much as possible and then using a sandbox App to run Linux in??? --- ## Post 58 by @curious78 — 2024-08-09T19:18:54Z > [@dngray](#): > > **5. Modern Dell Latitude/Precision** > > HSI 4 > > - Secure Cored > - Regular firmware updates > - vPro Enterprise models have [Memory Encryption](https://www.intel.com/content/www/us/en/architecture-and-technology/vpro/hardware-shield/total-memory-encrpytion.html) > - Blows Fuses on security updates, preventing downgrade attacks > - Minor issue of not measuring whether hyper-threading is enabled in the firmware or not. The Microphone toggle in the firmware doesn’t work. No deal breaker. I see on [Dell.com](http://Dell.com) that there are [XPS’s available with IME disabled and Ubuntu pre-installed](https://www.dell.com/en-us/shop/laptops/13/spd/xps-13-9340-laptop). I imagine if IME is disabled and out-of-band management is not present then the laptop would lack memory encryption, correct? What else would this lack? Might it have a reasonable HSI? (Yes, I am one of those people that remain uncomfortable with the IME.) I like to evade the pervasive financial surveillance when I can. Does anyone know how to source new Dell XPS laptops as anonymously as possible, ie: -walk into a store and buy with cash -order with crypto and ship someplace that is not your home I can’t see anyplace that sells this XPS Linux version in-person for cash and Monero does not appear to be an option on [Dell.com](http://Dell.com) (shocker). Has anyone bought a Linux non-IME Dell XPS via [AnonShop](https://anonshop.app)? I can’t see this version for sale on Amazon, though. Have you ordered one via AnonShop from [Dell.com](http://Dell.com)? It is a long-shot, but has anyone seen these for sale at any tech conferences maybe being offered as developer laptops? --- ## Post 59 by @asanyan — 2024-08-09T20:07:34Z I always see conflicting information regarding this. Most of the newer security features seem to be related to protection against persistence or physical attacks, and many of the firmware vulnerabilities already require root access to exploit, meaning that the underlying system is already fully compromised if the vulnerability can be exploited. Exceptions to this are CPU vulnerabilities that allow for information disclosure by unprivileged users, but there are kernel mitigations and microcode updates available to help mitigate them. Am I wrong here? Have there been firmware vulnerabilities in the past that allowed for RCEs or privilege escalation from unprivileged to kernel or above? edit: Qubes even recommends laptops from 2012. I trust that they wouldn’t recommend these devices if they were that insecure --- ## Post 60 by @dngray — 2024-08-10T08:15:58Z > [@curious78](#): > > I see on [Dell.com](http://Dell.com) that there are [XPS’s available with IME disabled and Ubuntu pre-installed](https://www.dell.com/en-us/shop/laptops/13/spd/xps-13-9340-laptop). I imagine if IME is disabled and out-of-band management is not present then the laptop would lack memory encryption, correct? What else would this lack? Might it have a reasonable HSI? It needs to be vPro to have the memory encryption, and I doubt you can disable IME meaningfully on any modern CPUs, so don’t bother. > (Yes, I am one of those people that remain uncomfortable with the IME.) Then don’t use x86, if they wanted to put a backdoor in there they could just put it at an even lower level. All alternative platforms will have something similar to IME. That is life. That IME option on the dell website, is about disabling some of the remote management stuff you might want to use as an enterprise, it does not “disable ME”, as you cannot on a modern platform, so it’s not the same thing as ME cleaner or what have you. > [@asanyan](#): > > edit: Qubes even recommends laptops from 2012. I trust that they wouldn’t recommend these devices if they were that insecure They don’t recommend them so much as they’ve been tested. I wouldn’t be wanting to use a laptop from 2012 for some perceived threat vs a real threat which is an APT giving you some persistent malware. The latter is far more likely. Don’t use a platform from 2012 and expect it to be secure. --- ## Post 61 by @anon49578468 — 2024-08-11T15:45:05Z I would also recommend Framework. Their firmware release cadence has improved a lot ([source](https://fwupd.org/lvfs/vendors/#framework)), plus you can always replace parts with permanent hardware issues (like AMD zen series processor vulnerabilities). Additionally, Linux is a first class citizen in their universe, and Atomic distros like Bluefin are very well supported out of the box (with working fingerprint readers, secure boot, camera, etc.) --- ## Post 62 by @dumpster — 2024-08-11T16:44:40Z I agree that the Framework is pretty good: linux support, repairability, bios security (HSI-3). It was downright refreshing opening up a laptop that respects my desire to do so. But there’s one big downside I’ve found: it’s flimsy. The Framework 13 at least (haven’t tried the 16). The case is so thin it feels like you could snap it in half with your hands if you tried. It’s very light, which is nice, but the flimsiness has become an issue for me. I’ve had 2 keyboards fail on me. Granted, I put above average wear on them, being a heavy typer and rearranging some keycaps. But all of my key failures have occurred near the bottom edges (right and left) of the keyboard, and other users have reported [similar issues](https://community.frame.work/t/resolved-framework13-keyboard-has-intermittent-keys/33279). My case overall has warped a bit, and that may be a contributing factor. It’s good these parts can be replaced, but if they need to be replaced over and over, the financial and environmental benefits of repairability become dubious. --- ## Post 63 by @anon49578468 — 2024-08-12T19:55:01Z Yup, have heard similar complaints (although my unit seems fine, but I do use an external keyboard mostly). I think these are teething problems with QA for a company that is still struggling with mass production (although the scale of failure is larger than what I would want). Newer Framework 13 amd seem to be better in quality for me. --- ## Post 64 by @anon86901519 — 2024-08-12T20:44:00Z Just trying to get some actionable consensus here: so if security is one’s primary concern when trying to find the best hardware to run Linux, go with Dell? --- ## Post 65 by @anon73250778 — 2024-08-13T00:39:55Z Dell is probably the least scummiest of the bigger reliable tech hardware manufacturers. --- ## Post 66 by @dumpster — 2024-08-13T00:49:23Z Specifically Dell’s professional lines: Latitude or Precision. XPS is decent, too. Don’t expect a cheap Inspiron to have the security features you want. And Framework is a decent option as well. --- ## Post 67 by @anon86901519 — 2024-08-13T01:53:13Z @HauntSanctuary Thanks – that’s definitely good to know. When comparing Dell to System 76 or Framework, which of the three is better from a security standpoint? @dumpster what makes Latitude/Precision better than XPS? And if you had to pick one (ignoring price, focusing on security), how would you choose between Framework/System76 and those Dells? --- ## Post 68 by @Cyber-Typhoon — 2024-08-13T03:32:02Z Not sure I can draw this line that clear with my current understand about the laptop market. I don’t see HP and Lenovo that behind from Dell in security aspects with certain offerings. --- ## Post 69 by @anon49578468 — 2024-08-13T07:59:11Z My recommendation is buy a framework if they exist in your region and/or you can afford it. Small product line means better support, nowadays they have decent firmware updates, and they won’t abandon support for your system suddenly. (HSI 3) Second best would be buying a dell since they have great linux support, deliver firmware on time, and less likely to abandon updates for latitude and other enterprise laptops. (Can go upto highest HSI levels) I would stay away from Lenovo, their linux compatibility has suffered and their firmware releases are also a bit of a mess. Similarly I would stay away from System76, and any other rebrand of Clevo Laptops, since their security is miserable (often HSI 0) A big factor should be your budget and threat model. Dell laptops with very high security (secured core, memory encryption) are absurdly priced, and you can get way better specs in similar price from framework. Find the balance that wirks for you. If budget no constraint, I’d buy the highest spec dell vpro line laptop, and set myself up as its admin using their free management software. This would allow me to do out of band uodates, remote management, etc on my machine. You’d be able to operate it even if the OS burns down/ becomes unbootable/ is corrupted. --- ## Post 70 by @Average_Joe — 2024-09-09T20:00:07Z > [@dumpster](#): > > Specifically Dell’s professional lines: Latitude or Precision. XPS is decent, too. Don’t expect a cheap Inspiron to have the security features you want. > > And Framework is a decent option as well. I appreciate your reply! **This is a great point to mention and to be honest, it should be included as a “universal recommendation” in this community.** Buying premium hardware from any company should be a must to get the best security/privacy! --- ## Post 71 by @Average_Joe — 2024-09-09T20:24:53Z > [@dumpster](#): > > Specifically Dell’s professional lines: Latitude or Precision. XPS is decent, too. Don’t expect a cheap Inspiron to have the security features you want. **It’s hard when nobody is posting links to specific products.** I did a lot of searching and could someone please tell me if this is something that would be a good choice? > **[Dell Precision 3590 Workstation | Dell USA](https://www.dell.com/en-us/shop/cty/pdp/spd/precision-15-3590-laptop)** > > Dell Precision 3590 mobile Workstation with intel core ultra processors & up to NVIDIA RTX 500 Ada professional graphics. EDIT: I’m NOT affiliated with Dell in any way. From my research this seems to be the best unit without spending too much. --- ## Post 72 by @jonah — 2024-09-10T02:05:07Z For this kind of money I feel like a Framework 16 has more appealing specs. --- ## Post 73 by @anon48875053 — 2024-09-10T04:49:34Z Yeah, for like 99.99% of people, the upgradability and repairability of Framework laptops make a lot more sense than the marginal security gains that come with other, more secure laptops. --- ## Post 74 by @Cyber-Typhoon — 2024-09-10T14:31:49Z > [@anon48875053](#): > > for like 99.99% of people Unfortunately, I’m on those 0.01%. It has been more than a year that Framework is on the talks to add [support for Oculink in their 16" laptop](https://community.frame.work/t/oculink-expansion-bay-module/31898) option and personally I sent two emails to them more than 2 years ago asking for this feature. In the mean time since April this year we are able to get a Lenovo Thinkbook 14 and 16 with the Oculink port hotplug. If some day Framework add the Oculink support for the 13" option I maybe consider getting it but until there I’ll reside in the 0.01%. --- ## Post 75 by @Average_Joe — 2024-09-16T11:06:36Z > [@jonah](#): > > For this kind of money I feel like a Framework 16 has more appealing specs. > [@anon48875053](#): > > Yeah, for like 99.99% of people, the upgradability and repairability of Framework laptops make a lot more sense than the marginal security gains that come with other, more secure laptops. I appreciate your replies! Wow, this is the first time I’m looking at Framework and they look amazing :star_struck: :star_struck: Is this site you both are referring to? [https://frame.work/au/en](https://frame.work/au/en) **But how are they more secure/more trustworthy and care more about personal user data than the Dell Precision Laptop I recommended or other companies like Acer, Asus etc?** --- ## Post 76 by @pinkandwhite — 2024-09-16T11:20:20Z their firmware updates (now) don’t suck, they don’t have OEM crapware pre-installed like acer/asus/etc, and they focus on openness. which are all relevant to “caring about user privacy” pretty directly lol --- ## Post 77 by @Average_Joe — 2024-09-16T13:03:31Z > [@jonah](#): > > For this kind of money I feel like a Framework 16 has more appealing specs. > [@pinkandwhite](#): > > their firmware updates (now) don’t suck, they don’t have OEM crapware pre-installed like acer/asus/etc, and they focus on openness. which are all relevant to “caring about user privacy” pretty directly lol I appreciate your reply! I’m just amazed that this is the first time I’m coming across this! **Is there an equivalent company that sells desktop towers? Or is the safest way to go to just buy each individual component separately and build it myself?** I looked on Framework and they don’t mention any desktops. --- ## Post 78 by @overdrawn98901 — 2024-09-16T13:43:16Z Safe is a spectrum :smile: unless you are worried about supply chain attacks or people putting nefarious hardware in your system, prebuilt is OK. My only security recommendation would be to reinstall your OS in the slim chance vendor put malware (not as likely) or just poor telemetry defaults and dumb default programs (more likely) into the base install. You could also flash the latest BIOS / UEFI firmware while you are at it if you can - my motherboard supports USB bios updates as I suspect most mobos do. Firmware level attacks are probably more sophisticated and less of an issue, but updating them on a fresh install is about the best time to do so imo, as it’s a PITA sometimes to do it afterwords (your mileage may vary). Windows can update the BIOS for you as well if you install Windows. --- ## Post 79 by @overdrawn98901 — 2024-09-16T14:43:43Z > [@Average_Joe](#): > > Is there an equivalent company that sells desktop towers? For additional context, the reason Framework is a great laptop is that is has a focus on repairable hardware. As per the [Wikipedia](https://en.wikipedia.org/wiki/Framework_Computer): > The company positions itself as a proponent of the right to repair movement, and their laptops are designed to be easy to disassemble, with replaceable parts Desktop towers are typically something you can already do this with. Prebuilts and DIY are already repairable by yourself for the most part. The exception might be some more niche areas (iMac probably isn’t easily repairable).