[plaguepilled]

Here's the bit that confuses me: no secure boot.

QubesOS does a lot of good things, but Secure Boot is sort of a nonnegotiable for a lot of security profiles because its one of the few ways you protect boot.

I'd be interested to hear from someone more in the know why they haven't implemented it yet.

[dmm]

I think the optional anti-evil maid support includes secure boot: https://www.qubes-os.org/doc/anti-evil-maid/

> Anti Evil Maid is an implementation of a TPM-based dynamic (Intel TXT) trusted boot for dracut/initramfs-based OSes (Fedora, Qubes, etc.) with a primary goal to prevent Evil Maid attacks.

[plaguepilled]

That makes much more sense, thanks.

Still a bit confusing that its not on by default, but also much more trustable.