Transcript

Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.

So, here we are back again to dive into Qubes OS. In my first video, I did say that I wouldn’t be using Qubes OS without recording it. So, a couple things to clarify on that.

I did record the installation. I installed the—I think it was—4.3 release candidate, thanks to someone’s suggestion in the comments last video. And speaking of that, if you have any suggestions on Qubes OS, I’m brand new to it, so feel free to drop those down below.

Josh, the video editor here. There’s a couple things I wanted to mention about this video. The times in it are not perfectly accurate. If you hear me making comparisons that something opened slower or faster than something else, don’t trust the time you see on the screen. This video already isn’t the most exciting thing to watch, let alone if I left a bunch of silence in there as an application is loading.

Second is that I added comments to my blog, or at least on this video and new ones going forward. I’m using a self-hosted instance of Isso—I think that’s how you say it. I realize that most people watching my videos are into privacy and security and likely do not want to log into YouTube using a Google account to leave a comment. I don’t blame you.

I also didn’t want to post my videos in a duplicate place on another platform and have comments there. So, this is what I came up with. If you go to the description box for this video, you’ll see a blog post on my website related to this. This is not that blog post. Ignore the title. But if you go there, scroll down to the bottom, you will then see a comment box where you can now leave comments. Name, email, and website—they’re optional, so you can leave anonymous comments if you’d like.

We’ll see how that goes. This is something I’m just testing. So, if you go to the blog post and you no longer see comments are available, then likely the experiment went poorly.

So, with that out of the way, I’m going to get back to editing this video, which is my least favorite part of this process. But, I did record the installation. I recorded it by pointing a camera at the laptop screen and walking through the setup process. As I was watching it back, it looked terrible. It was also pretty boring. If that video came across my feed, I would not watch it.

Therefore, I’m not going to subject you to that. So, the installation process—you won’t be seeing that.

That being said, the documentation is very, very good. The only reason you will mess up the installation is if you don’t read the instructions. At least that’s what happened in my case. Once I did read through all the details, made the necessary changes in the BIOS, the setup was simple. Took around 40 minutes on the—what is this—the T480 ThinkPad. So, pretty simple.

Regarding that initial installation, I did actually wipe it from this laptop. I had to put Windows back on here for a video I released earlier this week. So, I did just install Qubes OS again yesterday. I did install version 4.3.0 because it’s out of the release candidate phase.

Regarding the options that show up in the initial setup, I left them set to the default, but the only one I did change was this: enable system and template updates over the Tor anonymity network using Whonix. Besides that, left everything set to the default.

This is what shows up after the first boot after installation. This took around an hour to complete. And then after that, we are now at the screen you see now.

So, regarding screen recording, I actually found out you can purchase HDMI input dongles. So, I have that connected to my MacBook. The output HDMI on the ThinkPad is connected to that. So, you get a nice screen recording where you’ll see me using Qubes OS without having to point a camera at the screen, which looks terrible.

And the last thing I want to mention about using Qubes is I did have to use it because I made some poor networking changes at my house. Long story short, I use VLANs. I made some configuration changes that essentially locked me out of all my equipment over the Wi-Fi network I have. So, I needed a computer that had an Ethernet port.

Funny enough, the only computer that had an Ethernet port was my ThinkPad. So, I did have to log into Qubes, connect an Ethernet cable, and then open the browser, connect to some web interfaces to fix my changes. But besides that, haven’t used it anymore. But I did want to mention both of those scenarios.

So, with that out of the way, let’s continue.

I didn’t really know how to structure these videos. So what I came up with was putting together a few goals I want to accomplish in this video. Once we accomplish those, we’ll see what else we find. If that’s all we accomplish today, that’ll be the end of the video. And the next video, I’ll come up with some more goals.

Essentially, I’m trying to migrate all my use cases from macOS to Qubes OS. So that’s what these are based on.

So, one other thing I wanted to mention before we get into it is that I’ve seen people call Qubes OS a Linux distribution. It is not a Linux distribution. Qubes OS is built on the Xen hypervisor, which then runs Linux templates or virtual machines on top of that. So, you could call it a Xen distribution, but it is incorrect to call it a Linux distribution.

I understand I’m getting pedantic with that, but if you make comments online or things like that, people will dismiss what you say because you say one thing incorrectly. So, just thought it’s worth mentioning if you’re out there talking about Qubes. It is a Xen distribution, not a Linux distribution.

So, with that out of the way, let’s get into it and continue.

So, one cool thing I noticed on the login screen we have here: the top left default, or the first option, is hide password bullets. Second, which is the default, show password as bullets. And the third, show password as text.

So let me just type something in the password box. If you’re out in public, you can hide the password field. It’s kind of cool. The second function, F2, again shows the password as bullets. Function F8 shows the text in the box. For someone recording a video, this is handy. I can hide that. Don’t need to edit that in post and hide it.

So, let me type in my password. Hopefully I typed it right.

So, here we are at the user login screen. That previous screen was the disk decryption password.

So, let’s see. On the top left, we have dom0. Oh, I remember reading about that when I was researching this. Let me just look up an explanation quick.

So, dom0, or domain zero, is the first domain started by the Xen hypervisor on boot. It has special privileges like being able to cause new domains to start and being able to access the hardware directly.

So, in the future, I’ll talk about that more. It might even warrant its own video, because from what I understand, it’s a pretty important concept to understand when it comes to Qubes OS. But for now, let’s log in.

Be nice if this screen had the same hide password characters. Don’t believe it does.

Top right we have—okay, I realized I’m trying to click with the screen recording mouse. Okay, so I’ll fix this after I log in because right now it’s extending the display, which is a little complicated, but okay.

We have the power options, language. It’s using XFCE accessibility options. dom0. Can’t click on that. But there’s my password. It’s the only user that I created during the initial setup. Log in.

So, like I said, this is extending the current display. So, let me fix it. So, it’s recording the desktop. Since you can’t see what’s going on right now, I’m just looking for the display settings. I will show you after what I did.

Change this to mirror. Apply.

Looks good.

So, I came in. There’s the Qubes menu in the top left.

I just searched for display. As you can see here, recent applications. Came in here, set this to mirror displays, and here we are.

So, here’s the desktop.

So, on our list, we had the first is to connect to Wi-Fi, because these days you can’t do anything without internet access.

Network connection, available networks. Let me find my network. And these will all be blurred out so you can’t see them.

So, I think this is part of the domains, or maybe what they’re called. Hopefully I’m not using too many words incorrectly in this first video. I’ll try to make sure of them in the next video.

But this is red. It’s sys-net. So I believe that’s a specific virtual machine just for networking. Again, don’t take my word on all these explanations.

But this window is red and belongs to sys-net. So it’s just something we’ll keep an eye on.

And get my Wi-Fi password. Let’s see if that’s right. Connect.

See it connecting in the top right. I’m guessing I typed it wrong because it’s taking so long. Disconnected.

Let’s try this again.

Actually, looks like it’s connected. So, I don’t know why it’s showing that spinning—whether or not that’s connected.

Let’s open a terminal and do some network tests quick.

Okay, sys-net disconnected. Well, it’s open terminal anyways, just to check terminal.

So, the search is definitely handy.

I guess over here, these are our different—so we have our work qube. This one’s untrusted, vault, personal. I’m assuming all these come by default. Not assuming—they come by default because I didn’t configure them.

So, where do we want to open one? Let’s just pick personal.

So, qube personal is starting.

I guess this little menu here is for qubes. So here we have some status on the qubes.

dom0 using 4 gigs of RAM. Personal that’s running is using 3 gigs. sys-firewall, 2.5 gigs. sys-whonix, 3 gigs by itself.

So, I guess that’s why they say Qubes OS requires quite a bit of RAM, since every qube is going to use more memory.

I think this laptop came with 16 gigs of RAM. It supports up to 64 unofficially. Unfortunately, with the prices of RAM right now, because of the massive corporations ruining it for the everyday person, I probably won’t be buying any RAM anytime soon for this. So, 16 gigs is what it is.

So now that terminal’s open in our personal qube, you can see here: personal, yellow. So that matches what was in the menu here. So anything yellow is going to be personal.

So let’s just see if we’re connected quick.

Unreachable.

Okay, so we are not connected, which I guess is kind of confirmed by the red network icon.

Let me try and type in my password again.

So, I’m pretty sure the password I typed is wrong, but I don’t see a way to edit it right now.

Let me see if there’s any network settings that we can go into. It might look like I’m pretty uncoordinated while doing this, but I’m looking at the screen recording while trying to move the mouse around. So it’s a little off as I’m trying to do this.

So, there was no network connections in the Qubes menu, but I right-clicked on the network icon. We can go edit connections. I’m assuming it’s going to be in here.

There it is.

Okay. If we go in here—Wi-Fi security. Here’s the password that I’ll be blurring out. So, I did type the password correctly. Don’t understand why it’s not working.

IPv4 DHCP. That should just work.

Oh, I know why. Because I picked the wrong Wi-Fi network.

What do you know? If you pick the wrong Wi-Fi network and you type in the wrong password, things will not work. Surprise, surprise.

Okay, with that out of the way, I guess we learned how to edit network connections. So, at least we learned something.

So, we are connected.

I will say that is kind of inconvenient that it doesn’t give you another chance to edit the password or show a box and say “could not authenticate.” I don’t know if that’s a feature or not, but it’s kind of inconvenient, and you have to go and actually edit the connection instead of just retyping the password.

So it does say we are connected.

Okay, ping works.

That works too. So network connection and DNS resolution is working.

I don’t know if you saw that, but there was a notification that said there was an update available for Fedora.

So, looking back to our notes of what we’re trying to accomplish, next step is to check for updates.

So, whatever update was checking, obviously something’s available.

I thought I hovered over this and saw what the battery stat was. So, fully charged.

Okay, let me see what else is up here quick while we’re here.

So, click on the username. We have user options. Right next to that, we have some disk stats. This one is updates—Qubes updates.

Updates are available.

So, updates are our next goal.

Updates for one qube. Launch updater.

So, I’ll just let you read that section. I started reading it to you, but you can read it if you want to.

Here it is.

So, it looks like Debian 13, maybe Fedora, I guess, since it’s running because that’s what this qube is.

It can tell there’s an update available since it did check today.

So, yes, it knows the Whonix gateway.

Maybe.

So, yeah, Qubes OS checks for updates for running and networked qubes and their templates. So since this is running, it confirmed yes, an update is available.

Let’s check what’s behind the settings.

Attempt update qubes after 7 days without checking for updates. Qubes that are based on—restart all service qubes after update by default. Restart other qubes.

Okay, I’m just going to leave it the default.

Let’s update the qubes.

So personal still running as we expect. Select a qube to see details.

Nothing really going on yet.

If you recall back to the first screen that I showed, I did check enable system and template updates over the Tor anonymity network using Whonix. So these updates might be pretty slow since they’re going to be going over Tor.

Looks like the first one being done is the Whonix gateway, where that Tor connection’s running. So that’ll probably take a few.

So, while that’s going, not going to make you watch this, but I’m going to check that as completed.

The check for updates—connect to Wi-Fi, done.

Next is open browser.

So, like I said, I’m trying to replace the functionality of macOS. I use the browser all the time. Therefore, I want to use the browser on Qubes OS and see how that is on here.

One thing to note: this laptop is really chugging away right now. The fan’s heating up. It’s getting pretty warm. So, it seems like this is pretty intensive for it.

So, let’s go into the applications.

And I guess while we’re here, we can look through what applications are available.

So, we have apps.

Okay. So, here’s all the qubes or templates, and here are the apps inside each one.

Anon-Whonix—makes sense. Tor Browser is there. Tor Browser Downloader, system check.

Default DVM—I don’t know what that is.

Personal—we have Firefox, settings, file manager, and terminal.

Untrusted—same.

Vault—same.

Workstation 18—I don’t know what that is.

Work—same.

So it seems the default are these four apps for most of these.

Let’s see what the settings is.

I’m just going to keep it in personal since that’s where we already are.

So the qube is currently—I’m assuming since it’s already running that if I launch Firefox, it should be quick because the qube’s already started. It doesn’t have to start it up.

I’m saying quick relative here. I’m not expecting lightning, just quicker than if it’s not running.

Initial Firefox setup. We’re going to skip all this for now. We’ll just start browsing.

Okay. So, browsing works. It’s a default Firefox installation.

So, as we can see here, we have a yellow box on this one. So, all personal qubes or all personal apps inside that qube will have the yellow outline.

And then therefore, every other qube or template—I’ll look up the terminology so I can say it correctly next video.

So, if we go to—let’s just say work—we’re going to open up a work terminal.

So now that qube is starting. It should take longer, because that qube needs to start.

Here’s our other terminal.

Like we saw, personal was yellow, work is blue.

I do like how clear it is which profile, which qube you’re in.

I think they’re called qubes, based on the notifications.

So, it is nice how the color coding is for different qubes. Work is blue, personal is yellow. Matches up with the windows we see.

So, that’s still updating. I’m going to minimize that because it’s kind of distracting.

So, we have—okay—personal Firefox.

If we search for Firefox here, so we get any qube that has Firefox in it, which is pretty much all of them at the top.

Any qube.

So, we can launch Firefox for any one of these qubes.

Like I said, the work one is started, so this should launch relatively quickly, and the internet should just work.

There’s no history in here.

So, these are separate qubes. So, even though I typed cyberios.com, which is now in the history here, it does not exist in the work one because that is a separate qube, separate browser instance.

So, we don’t need this one for now. So, we’ll close it.

But I think this little icon is this eject or shut down the qube. Doesn’t seem like the helper text is popping up, or the tool tip. So, I’ll click it.

Okay, that just pushes the window up. This is just XFCE.

That’s about it.

This one—what does it do? Just all the options. Move to another workspace.

Okay.

So, if I close this, I don’t know if it’ll shut down the work qube.

So, if we go here to our running qubes, work is still running.

So, we no longer need work.

So, I guess we can shut it down from here.

Let’s see.

Open qube manager.

Let’s take a look at this.

So, this is interesting. It looks like a process manager except for qubes.

So, we don’t need work anymore. Here it is at the bottom. Emergency pause, shutdown, restart, settings, edit firewall.

Let’s just shut it down for now.

Work has shut down. So, no longer running, no longer using resources.

Now, we can finish with Firefox here.

Well, actually, let’s try this quick.

So, I have Mullvad running on my router at my home. So, this should be routed over Mullvad.

Yes, as you can see, using Mullvad VPN.

Just to understand how the Whonix qube works, let’s open up Tor Browser. I believe that qube is already running since the updates are using it. So, it should start up relatively quickly.

Or maybe not.

Here is Tor Browser Whonix welcome page. We’ll give that a minute.

So, let’s go to Mullvad in this browser.

I believe this should be over Tor. So we should not be using Mullvad.

Not using Mullvad. Location: the Netherlands.

If you didn’t guess, I’m not from the Netherlands. So this is correct. It’s using Tor.

So, update available for Firefox.

I guess one thing I don’t know yet, which I guess we’ll see—I don’t know if these are similar to Docker containers or if they’re ephemeral, essentially.

So, if I update Firefox here, will it actually update in the Whonix qube and be persistent, or will it just get overwritten?

Don’t really know, but I guess let’s try it quick.

So, updating Firefox there.

If you haven’t guessed yet from me walking through this like a bumbling fool, I’m not exactly sure how storage works yet on Qubes OS. So, I’m not totally confident where data is stored or how that works.

So that’s why I’m currently experimenting, if anyone’s still watching the video at this time.

Whonix Workstation is attempting to shut down.

Is that part of the update?

Oh, so that’s part of the update. Whonix Workstation. Okay.

Not related to our Firefox update.

Let me get rid of these or move this over.

So Firefox has been updated.

Let’s shut down this qube and see if that update sticks.

sys-whonix—that’s using that to update these qubes.

Yeah, whatever.

Okay, we’ll shut it down anyways and restart it.

I’m assuming these updates will either fail or pause.

Just says Whonix has shut down. It’s now starting.

You know, so far, based off my expectations for this—I forget now—8- or 10-year-old laptop, this is actually running pretty well.

I know I’m not doing much, right? I’m just kind of browsing the web and updating some qubes. But so far, so good. So that’s good news.

So I think that qube—we restarted it.

Let’s go back in there.

Anon-Whonix Tor Browser.

You know, looking back, I don’t know if that was the right qube that we restarted, but whatever.

At this point, looks like it was shut down when we closed it. So now it is restarting.

Okay, so that has started up.

I don’t see any updates for Firefox. Let’s go check quick.

Was it Help → About?

I think—for Tor Browser, not Firefox.

It’s up to date.

So, I guess that update did stick even after restarting that qube.

So, that was Anon-Whonix.

Oh, here it is.

So, yeah, we restarted the wrong one last time. So, let’s restart this one.

It is kind of nice that out of the box you get a qube that you can use to browse in. No additional software was needed. Just kind of came that way.

And it’s also nice that system updates can use it. So that’s really convenient.

Okay.

So let’s open browser and check if it has stayed updated.

Help → About Tor Browser.

It is up to date.

So that storage was persistent.

As to where that’s stored and how, don’t really know, but I guess that’ll be something to learn in the future.

Wonder if there’s a way to reset this qube or the settings.

Let’s see.

Settings.

What do we have here?

Advanced, PCI devices, applications.

So, it looks like in the settings for the qube, there are more applications you can add. I don’t know where these come from.

I really need to look up how qubes actually work.

So is each of these a separate repository that someone built into these qubes?

Notes, services, devices, net qube.

Oh, so since this one is Tor Browser, it’s using sys-whonix, which makes sense why we’re also going over the Tor network. It’s also Tor Browser.

So, let’s see.

If I take personal, I’m assuming that’s not using Whonix.

Let’s check this out.

Settings.

sys-firewall default current.

Let’s change this to sys-whonix.

Now, I’m assuming—what’s this little thing for? Just because defaults were changed.

The default disposable template.

So, I guess there’s something similar to how qubes work in Docker containers. I’m not too sure.

These should be a lot of good settings to go through.

But if we now go back here and refresh this, this should say not using Mullvad.

Not using Mullvad. The Netherlands.

So, now it’s using the sys-whonix qube for networking.

So, that’s pretty cool.

I’m assuming then how we set up—or I’m assuming that at least—you can create a sys-Mullvad qube and then route any qubes that I want through that net qube, and they’ll then use Mullvad.

So there’s no really installing Mullvad as an app, I’m assuming—again, something I’ll look into.

Let me put this back to the default.

So that’s kind of cool.

This definitely reminds me of Docker in a way, how this works—where you alter the Docker Compose file and the changes are reflected then in the container.

I think I just need to get used to the different terminology here with this.

So, back to using Mullvad on my router or my VPN on my router.

The browser changes seem to be persistent. So there’s some sort of storage I’ll need to look into another time.

As far as our list goes, I did want to try and play a video.

So, let’s go to youtube.com.

This computer—I don’t think it has a GPU inside of it, so I don’t know how these videos are going to play.

Let’s pick a 4K video.

Now that I think about it, I believe this laptop also has a 1080p screen, so I guess 4K is not that relevant either.

There are some—of course there’s an ad.

There are some mods I believe you can do to this where you can replace the 1080p screen with a 4K screen. If this ends up working out, that is absolutely something I’ll be doing.

The older I get, the more I learn that resolution matters a lot.

So, skip.

Let’s see how the 4K looks or how it plays.

I’m assuming on this screen recording it’s going to be a bit laggy going over this adapter, but I’ll let you know how it is on the actual screen.

Let’s go full screen.

Okay, not going full screen. It’s also not playing.

No, it is playing.

Okay, maybe 4K was a bit ambitious.

I don’t really know if it’s my internet right now or this computer that’s really struggling.

Looks like this qube is using—what—52%.

Okay, so it is feeling the video playback.

Maybe I shouldn’t be doing this while updating the qubes.

Let me go cancel these for now. Let’s run them after this video is done.

Or let’s just change it down. Scale it down a bit.

HD.

What if we throw it on 240?

Okay. It’s like watching a potato.

Still slamming the CPU, but not lagging as much.

Wonder if audio works well.

Audio works.

Okay, so that was the test.

Real time, that took about an hour. I don’t know what it’s going to come down to in the edit—how long this is going to be or what parts I’m going to fast forward through, because I don’t want to subject you to them.

So, first thoughts after using it: pretty decent experience, I would say.

The video experience—not great. I didn’t really have extremely high expectations for that. There’s no GPU from what I can recall inside this laptop, so it’s going to struggle with video playback doing everything on the CPU.

As far as updates go, that was easy. I was notified that there were updates available. They ran, went through Tor by default, which was pretty awesome.

I do like the coloring a lot. This was very easy to keep track of which windows were in which qube.

So, like I said, don’t trust the terminology that I used in this video. You’re going to want to double-check it.

This is more of just a “here’s my experience for the first time using Qubes OS accomplishing a couple tasks.”

Haven’t done much research into it, which was on purpose. I didn’t want to skew my perspective much as far as how it is for beginners.

I don’t know if I could give this to my mom and say, “Here you go, mom. Go browse the web. See how it goes.”

I think the menus and everything like that makes sense so far. This is straightforward.

The coloring—once you go into settings—I’ll be honest, this got somewhat overwhelming pretty quick. There’s a lot of options in here and a lot of things you can change.

When I say overwhelming for me, not in a bad way. For beginners, it definitely could be. For me, it’s exciting. This is cool. I’m excited to see how this goes.

Also, so far, I haven’t really understood how to install more apps. I think that’s just something I need to research and do some reading on.

Reading on qubes, tools, backup—there’s just a lot to go through in here.

Let’s see. Is there a store by chance? I wouldn’t expect there to be.

Restore backup down there.

Now, so that’ll be interesting. Maybe you just add more qubes for the apps you want, or in the settings. We saw different apps in there.

Long story short, I don’t know if this video was useful, but this was my experience so far.

But so far, I really like the security and privacy benefits I’m getting just out of the box. It’s also nice having something that’s not automatically phoning home the second I boot it up.

So, let’s see how this goes.

And again, any comments or tips are welcome. And feel free to leave those down below.

And I’ll see you next time.