Virt manager does but only during creation. You have to check the option for "customize VM before creation" or whatever that option is on the last screen. Then there's a firmware drop down where you can select OVMF

This is basically the same argument that caused the libreboot vs gnuboot thing and I just personally don't get it. It seems to me like the FSF is letting perfect be the enemy of the good. Having a FOSS driver isn't something to be celebrated it's something to be punished if the firmware isn't also FOSS. Yes, ofc, FOSS firmware is better than closed firmware, but when almost no modern hardware has that as an option, it's not even something you can really vote on with your wallet unless you just run ancient hardware all the time.

It matters because for me, a good chunk of the FOSS benefit is the auditability of code. Being able to make changes is nice and that's the freedom bit, but being able to audit it is also a huge benefit. If the code is not running on the main CPU then the driver on the main CPU can contain possible exploits of firmware using the IOMMU etc so it becomes more tolerable than a closed source driver. Basically a firmware vulnerability effectively becomes a hardware vulnerability as opposed to a driver running with full kernel privileges and no oversight or containment.

If I'm not mistaken doesn't the firmware in question get uploaded to the device in question and run on said device not the host CPU? Those devices are already closed and often already running proprietary firmware. I don't really understand the war against uploading blobs to them? I love FOSS and more power to anyone who wants to do this but it seems excessive.

That makes more sense and is...even worse tbh because that's actually enforceable and so obvious I don't know how I missed it. That would also probably impact Tor since those IPs are already heavily reputation damaged. The stuff governments have been pulling recently is just insane

So what do you propose? Just not using a VPN? If you're that worried you can run a second public VPN on top of your private one. The point of the private one is to avoid ISPs outright blocking known major providers.

As apex32 pointed out, it isn't about logging, it's about your ISP either ratting you out or outright blocking the domains and IP blocks of major providers and that's why I said you can setup your own. Ofc even hosting one yourself your ISP can probably still determine you're using a VPN through traffic analysis even if you're using TCP 443 to blend in but it makes it harder.

Graphene scoped contacts would probably fix this

Maybe it's just me but it feels like calling it anything other than Linux is just an UHM, ACKTUALLY. And that's saying something because I'm one of the most pedantic people I know.

My machine says that network is unreachable

Probably is for me too. This is something I've taken for granted as I work for a small company and I am the IT admin...and development team lead, I wear lots of hats. Not the owner though, basically like a CTO+.

...yeah and if they went to signal to ask about you they're going to provide signal your phone number as it's the only identifier they have in their system...so the nation state already had that to begin with, it isn't sensitive info despite what it can be used for.

Shared folders are easy with Linux guests, you just set it up in virt-manager and then mount it in Linux. With windows it's possible and I have done it but you need to install the virtiofs driver alongside winfsp and then make sure the virtiofs service is running. So the setup is definitely a bit obtuse. I haven't done clipboard sharing deliberately as I don't love the idea of that being synced but I should at least try it so I know what setup is like. The file sharing isn't hard once you learn how to set it up but figuring it out the first time is a challenge for windows guests.