As far as my threat level goes, I'm in the process of starting an operation that, while it technically does not break any laws, that's due to legal loopholes, and it's very possible for it to become illegal in the future and even before then may put a target on my back, so I've been trying to handle everything as if it already was illegal.
I'm a huge fan of the concept behind Qubes. Running everything inside of separate VMs is something I would do even if it didn't have any opsec benefits. However every time I've tried to use it there always seems to be one thing or another that makes it difficult to use as my primary OS. As far as I'm aware, most of these factors tend to be the result of maximizing protection against specific types if attacks which may not necessarily provide any benefits for staying anonymous (I realize there's an overlap between security and privacy, but I'd imagine if I find myself in the situation where I'd need protection against an attacker who's connecting to my home wi-fi network or has physical access to my computer, then it's safe to say I probably already fucked up to the point where anonymity goes out the window).
I've been using Arch as my primary distro but have been needing to either try something else or at the very least do a fresh install due to the recent AUR issues, and since I'm going to be reinstalling things anyways, since I can just install the exact same Xen hypervisor that's used by Qubes onto Arch or whatever I end up deciding on for my main OS, and from there just set up separate VMs for everything to compartmentalize everything similar to what Qubes does, perhaps with some kind of automation script which automates the process, then would there even be anything to be gained from keeping my Qubes install alongside of it, or should I just go ahead and give the main OS the full drive? I'm planning on getting an additional computer for legally-gray stuff and installing Qubes there because physical separation + digital separation > just digital separation or so I hear, but with right now being probably the most expensive time to buy a new computer in a while, I'm not sure whether or not that should be a top priority or if it's something I can put off until I manage to get a somewhat reasonable deal on it.
Hacking / Opsec
How much opsec benefit is there to be gained from using Qubes compared to using a different distro and manually compartmentalizing?
Started by DownloadedTooMuchRam · Jun 28, 2026
Depends on design, if physical compartments, it's a lot of work, however, done right and you actually have something more safe than Qubes. Doing virtual compartmentalization from scratch is a huge under taking, you have a lot out of the box with Qubes. Maybe a better way is to use Qubes and make customized disposable vm's or app vm's? That's easy, just clone or template and install the needed software and enable qubes services you might need. Personally I do heavy customization on Qubes and after mastering Qubes networking and other concepts I seldom run into dead-ends. My concerns are the hardware and security bugs in the hypervisor, that could potentially expose my whole infrastructure, so therefore I ring fenced the Qubes box and validate all network traffic. I use several network connections and dedicate each connection and also add noise to each connection. Moreover, the Qubes box needs lot of memory, 32GB minimum, 64-128GB is better if you run many parallel projects / activities.
I think 32 is way more than enough for most people.
Arch with the xen hypervisor is good as long as you harden your install good.
Depends on your level of patience for shit to load/crash lol
4GB per Whonix workstation, assume you do at least 2 things in parallel, makes it 8GB
2x Whonix gateway = 4GB
2x net qube = 2GB
2x Firewall cube = 2GB
1x stand alone / offline LLM = 8GB
1x stand alone / offline metadata cleaner, keypassXC, etc. = 2GB
dom0 = 4GB
Total 30GB and you better have a few unused GB left to not hit the roof. Then if you use VPN that should be in separate VMs as well, and then at least one communication qube (Gajim, email, etc.), Monero node and maybe more. So, 64GB is good so you don't need to squeeze in your qubes or do poor trade offs.
2x Whonix gateway = 4GB
2x net qube = 2GB
2x Firewall cube = 2GB
1x stand alone / offline LLM = 8GB
1x stand alone / offline metadata cleaner, keypassXC, etc. = 2GB
dom0 = 4GB
Total 30GB and you better have a few unused GB left to not hit the roof. Then if you use VPN that should be in separate VMs as well, and then at least one communication qube (Gajim, email, etc.), Monero node and maybe more. So, 64GB is good so you don't need to squeeze in your qubes or do poor trade offs.