Not for everything, but for some things, yes. It depends on the application, the attack surface, and the threat model.

If an app touches identity, finances, private comms, or needs special networking—Signal, banking, crypto wallets, torrenting—then it gets its own minimal template. Clean base, small attack surface, no bleedover.

It’s also utilitarian and performance-based. For example, I have a dedicated template and AppQube for gaming.

But for normal day-to-day stuff—if the apps share the same identity and the same risk profile, putting them in one template keeps things sane and still respects compartmentalization.

I isolate by threat model, not by religion.

First thing I do on a fresh QubesOS install is keep the foundation clean. Anything that touches the system—sys-net, sys-firewall, sys-usb, sys-whonix, all the service qubes—stays minimal. I don’t install a thing into the templates attached to those qubes. Same goes for the default DVM. Clean base, minimal attack surface.

When I need to install apps, I don’t contaminate the original templates. I clone the template, rename it, and point my daily App Qubes (personal, work, etc.) to the clone. So if Fedora ships as fedora-41-xfce, mine becomes fedora-41-xfce-custom, and that’s where the apps I need get installed.

If I’m building a sensitive qube—banking, crypto, whatever—I’ll clone the untouched template again and keep that one lean too. Only install what I need. Nothing more.

And this applies to everything in Qubes: Fedora, Debian, Whonix, Arch, Kali… whatever template you bring in. The rule is simple—keep the base template pristine, do your work in cloned templates, and let compartmentalization actually mean something.

Keeping things minimal, isolated, and compartmentalized is one of the cleanest OPSEC habits you can build in QubesOS.

#IKITAO #QubesOS #OPSEC #INFOSEC

Where are you located? I've never heard of a power company needing to approve a solar installation, unless you had plans to tie into the grid. Buying solar panels and connecting to a offgrid all-in-one inverter or portable power station shouldn't require anyone's approval

Do the exact opposite of whatever Harvard recommends you and I guarantee you will look and feel amazing

Invest sats into anon server

Run open source LLM on server

Provide open source LLM model on Routstr

Market Routstr provider as LLM for MKStack

Earn passive sats watching nostr blossom

💯 Pixel is best in class for security—and GrapheneOS has been clear about that for years. IMO it's going to be hard to compete with Google money, experience, and resources while keeping the cost down to anything that resembles affordable for the average consumer. I guess we'll see.

Hopefully that still holds true in the light of recent news. I expect that it will, but it will be good to get an official confirmation. Many people are uncertain as to whether they should buy a Pixel to run GOS now.

nostr:nprofile1qqs9g69ua6m5ec6ukstnmnyewj7a4j0gjjn5hu75f7w23d64gczunmgpzemhxue69uhhyetvv9ujuerfw36x7tnsw43z786xdyf Since it seems unsure if GOS will support Pixel 11... for those considering the purchase of a new Pixel 9 or 10 specifically to run #GrapheneOS, what's the guaranteed support timeline?

People need to know if they're buying a 7-year device or a 2-3 year device before they invest.

When I was younger, I thought debating politics was helpful

Now, I think discussion of which side to vote for, gives the Deep State's global heirarchy legitimacy. We should not be debating what color the puppet should wear.

And instead, put 100% of any effort in the resistance. The foundations of the resistance are privacy, censorship resistant speech & commerce, parallel legal systems, and community. And in a world of pseudo-anonimity, ideas and work must be judged on merrit. Not hype.

All that debate you were doing over which politican, should instead be funneled into which technologies you use. And on-boarding people to them.

I prefer something like iodéOS over pixels with graphene and a Librem5 to not rely on AOSP, that is becoming AP lately.

Trash both of them 😅

Flexibility 😁