Git-Mirrors/Qubes-Community-Content
1
0
Fork 0
mirror of https://github.com/Qubes-Community/Contents.git synced 2024-07-01 08:31:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #69 from Qubes-Community/awokd-patch-1

Browse Source 
misc updates, add Insurgo
This commit is contained in:
awokd 2019-08-11 19:48:38 +00:00 committed by GitHub
commit 2a4f4f4b07
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 11 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
docs/hardware/hardware-selection.md
View File

@ -37,6 +37,7 @@ Do you want:
If you don't mind older/used hardware, there are some options if you do not want [PSP initialization](https://libreboot.org/faq.html#amd-platform-security-processor-psp).
All new AMD hardware comes with PSP.
In theory there is an option to partially disable it, but no motherboard/BIOS manufacturers have made it available yet.
Please update this if you are aware of any manufacturers that have.
Form factor?
@ -51,7 +52,7 @@ DIY corebooted used [Lenovo G505s](https://www.coreboot.org/Board:lenovo/g505s)
DIY or commercially available corebooted (or librebooted?) [KCMA-D8](https://www.coreboot.org/Board:asus/kcma-d8)/[KGPE-D16](https://www.coreboot.org/Board:asus/kgpe-d16).
Vikings is one vendor that appears to sell these.
If used with Opteron Series 2 processors, no microcode blob is required.
If used with Opteron Series 2 processors, no microcode blob is required. However, it is still recommended to include current microcode due to vulnerabilities.
### Intel ###
@ -64,9 +65,9 @@ There are some ways to restrict Intel ME after the initial BUP.
### Intel Commercial ###
These vendors have systems available that partially disable Intel ME after the initial hardware initialization: System76, Purism, Dell.
These vendors have systems available that partially disable Intel ME after the initial hardware initialization: Insurgo ([Qubes Certified](https://www.qubes-os.org/news/2019/07/18/insurgo-privacybeast-qubes-certification/)), System76, Purism, Dell.
Implementations vary, so research the vendors.
Prefer ones that use Coreboot instead of closed-source, [proprietary](https://www.kb.cert.org/vuls/id/758382) [UEFI firmware](https://www.securityweek.com/researchers-find-several-uefi-vulnerabilities).
Prefer ones that use Heads or Coreboot instead of closed-source, [proprietary](https://www.kb.cert.org/vuls/id/758382) [UEFI firmware](https://www.securityweek.com/researchers-find-several-uefi-vulnerabilities).
Search the [HCL](https://www.qubes-os.org/hcl/) for a compatible system.
[Search the mailing list](https://www.mail-archive.com/qubes-users@googlegroups.com/) for additional reports.
@ -89,17 +90,21 @@ Flash your system with Coreboot, including [ME_Cleaner](https://github.com/corna
### MECleaner ###
You can partially disable Intel ME while still running vendor UEFI firmware.
Search the [HCL](https://www.qubes-os.org/hcl/) for a compatible system.
[Search the mailing list](https://www.mail-archive.com/qubes-users@googlegroups.com/) for additional reports.
Follow the instructions [here](https://github.com/corna/me_cleaner) to partially disable Intel ME.
Follow the instructions [here](https://github.com/corna/me_cleaner).
### Unconcerned ###
Search the [HCL](https://www.qubes-os.org/hcl/) for an R4.0 compatible system.
[Search the mailing list](https://www.mail-archive.com/qubes-users@googlegroups.com/) for additional reports.
If selecting a desktop, you may also want to include and use a third party NIC in an expansion slot or USB instead of the onboard Ethernet.
## Additional Notes ##
If selecting a desktop, you may also want to include and use a third party NIC in an expansion slot instead of the onboard Ethernet.
This is often not an option in laptops with manufacturer firmware due to the use of NIC whitelists, but you can use a USB based ethernet or wifi adapter instead with either desktop or laptop.
Optionally, disable DHCP on the subnet(s) your Qubes device connects to.
This will help avoid overt network communications from onboard management.
This is often not an option in laptops with manufacturer firmware due to the use of NIC whitelists, but you can use a USB based ethernet or wifi adapter instead.
<br>
<br>
<br>