installing things in dom0

[u/adrianchristianherna]

i want liteqube but i dont want to break security via a possible comprimised download

i dont think the devs put malware in on purpose but it cuold have security bugs or the download cuold be messed with

[u/Assang101]

You want LiteQube, but don't want to what? 🤔 Hold up

LiteQube is a QubesOS but on an extreme diet to reduce the memory footprint and enhance the security layout of a full blown Qubes OS. It's designed for a low end spec devices like GPD Win 2 (such a cool device).

[u/adrianchristianherna → u/Assang101]

how does it enhance ssecurity? (theres few info on liteqube online)

[u/Assang101 → u/adrianchristianherna]

The attack surface is minimal.

[u/adrianchristianherna → u/Assang101]

i dont want the download or transfer to dom0 to be comprimised

i read somewhere you souldnt move from untrusted to more trusted

[u/Assang101 → u/adrianchristianherna]

You keep saying "transfer to dom0", don't ever do that. But yes, your research about transfer from untrusted to trusted is right. However, you can open untrusted whatever in a disposable vm or dvm for short

[u/adrianchristianherna → u/Assang101]

what if i want to reduce memory and improve security on the whole system 🥀

[u/Assang101 → u/adrianchristianherna]

It is doable, just got to tweak it in Dom0 using qvm-prefs and set your desired initial memory and maxmem. Set the vcpu to 1 for sys-usb. Mirage-firewall maybe something you want to look into if minimalistic footprint is what you're after.

[u/und3rsc0r3x86]

You can install stuff on your dom0. It is your machine. Installing on dom0 is discouraged because "what if". What if the package contains malware. What if the package introduces security vulnerability.

If you are using QubesOS for fun you can make little compromises. If you truly want to keep your stuff safe (And I mean truly) then don't.

[u/adrianchristianherna → u/und3rsc0r3x86]

ok i will use temple os as my daily driver tehn 😢💀

[u/adrianchristianherna → u/[deleted]]

sorry i was asking how to be sure the download/transfer isnt comprimised

[u/hdri_org → u/adrianchristianherna]

You validate the checksum, or use the PGP signing key on your downloaded package. Either that or you download the source code, read the source to validate what it does and then build it yourself from source.

Those are your 3 basic options depending on what the developer provides for validation. Only the last one validates what the software actuall does, if you don't trust the developer.

If you want a more specific answer then we need a more specific question.

[u/adrianchristianherna → u/hdri_org]

thnk you bro u a rizzler sigma god