# When security matters: working with Qubes OS at the Guardian

DevFeed: [When security matters: working with Qubes OS at the Guardian](<https://devfeed.tech/articles/when-security-matters-working-with-qubes-os-at-the-guardian-19967.md>)

Original publisher: [Read original article](<https://www.theguardian.com/info/2024/apr/04/when-security-matters-working-with-qubes-os-at-the-guardian>)

Author: Philip McMahon

Published: 2024-04-04T09:32:30Z

Content type: article

Language: en

Sources: [Guardian](<https://devfeed.tech/sources/guardian.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [saltstack](<https://devfeed.tech/topics/saltstack.md>), [Debian](<https://devfeed.tech/topics/debian.md>), [Infrastructure as code](<https://devfeed.tech/topics/infrastructure-as-code.md>), [configuration](<https://devfeed.tech/topics/configuration.md>)

Tags: [amazon-s3](<https://devfeed.tech/tags/amazon-s3.md>), [configuration](<https://devfeed.tech/tags/configuration.md>), [debian](<https://devfeed.tech/tags/debian.md>), [infrastructure-as-code](<https://devfeed.tech/tags/infrastructure-as-code.md>), [os](<https://devfeed.tech/tags/os.md>), [packages](<https://devfeed.tech/tags/packages.md>), [salt](<https://devfeed.tech/tags/salt.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>), [workstation](<https://devfeed.tech/tags/workstation.md>)

## AI overview

The Guardian describes its experience configuring Qubes OS for SecureDrop Workstation. The team used SaltStack to set up multiple workstations for safely handling sensitive documents, including an offline Debian 11 virtual machine, managed packages, an amnesic VM, an Amazon S3-hosted private package, a Nautilus extension, and secret configuration values.

## Source excerpt

The latest version of the whistleblowing platform SecureDrop runs on the Qubes operating system. At the Guardian we used the Salt management engine to set up a Qubes environment where journalists could safely interrogate sensitive documents. This post was updated on 9th April 2024 following feedback from the Securedrop Workstation/Qubes community If you've ever scrolled through the Guardian homepage, you may have come across the 'Contact the Guardian securely' banner. This links to a page explaining how to share sensitive information with the Guardian in a number of different ways. Of these, the one that offers the best security is SecureDrop. An offline VM based on Debian 11; Some packages installed from the default repositories and a custom repository; The VM should be 'amnesic' - after a restart it should be reset to a consistent state (so any generated files/downloaded data should be deleted); A custom package installed from a private repository hosted in Amazon S3; A Nautilus extension; A configuration file containing secrets that can't be hard-coded. Continue reading...