Hands-on: The Purism Librem 15 builds serious security into a slender laptop

Image: Alex Campbell

The Librem 15 laptop, from the privacy and freedom-oriented Linux PC maker Purism, aims to be the answer for those who want ultimate data protection. After taking this laptop for a long spin, I can safely say it delivers thoroughly on security and privacy—though not surprisingly, at the expense of other features.

Stealth looks

purism librem 15v3 left side ports — The slim and sleek design comes without obvious logos.

One of the first things I noticed after opening up the box is that there are very few distinguishing features on the Librem 15’s exterior. There are no logos on the laptop’s lid, screen bezel, or keyboard, save for a Purism logo on the Super (Windows) key. Keep looking and you’ll finally find Purism’s logo printed on the bottom of the PC, out of sight and out of mind.

The smooth aluminum chassis and trackpad give the Librem 15 a premium feel akin to a Macbook Pro or Razer Blade Pro. While it’s nice to see and touch, the aluminum also loves to attract fingerprints. If you want to keep the laptop looking spotless, keep a microfiber cloth and a mild cleaner handy.

The 1080p screen of the Librem 15 has a matte finish and somewhat narrow viewing angles. While we tend to applaud laptops with wider viewing angles, the Librem 15’s limitation feels like a security feature instead of a bug, making it harder for prying eyes to glance at your desktop. Installing a privacy filter over the screen would work better, but this is a good start.

Hardware

purism librem 15v3 gutshot — The layout of the Librem 15 makes it easy to service or upgrade parts. The RAM (left), Wi-Fi card (center left), and SSD (right) are all easily accessible without further disassembly.

The hardware in our test unit is impressive, but there are a couple of notable details. First, the Core i7-6500U CPU is a little old, a Skylake chip, offering 200MHz less base frequency (2.5GHz versus 2.7GHz) and 400MHz less turbo frequency (3.1GHz versus 3.5GHz) than the Kaby Lake iteration of the chip, the Core i7-7500U. Both chips operate with a TDP of 15W, have the same instruction set, and offer four threads. The Librem 15 will perform well with most tasks you throw at it, just a tad slower than the newer Kaby Lake version of the chip.

The other big difference is Purism ‘s decision to go with a Qualcomm Wi-Fi and Bluetooth radio instead of an Intel chip. The Atheros AR9462 is an 802.11n (Wireless-N) chip, and does not support 802.11ac wireless speeds. Note that you wouldn’t see 802.11ac speeds for internet browsing or downloading unless you paid for 50Mbps (or higher) service from your ISP anyway. But if you are using an 802.11ac router, this laptop can’t take advantage of the extra speed.

purism librem 15v3 lsspci — Nearly all of the major hardware on the Librem 15 is current-gen Intel. However, Purism opted for an Atheros WiFi card for security reasons.

While going with the older 802.11n standard seems damning on its face, there are some interesting reasons to do so. The chip Purism chose uses the Ath9k driver, which is quite mature on Linux, meaning Wi-Fi connections remain stable. On top of that stability, the Ath9k card has an open firmware, while the newer Atheros (Ath10k) and Intel (iwlwifi) cards do not. For those looking for extra privacy, having an open firmware helps reassure you that your network traffic isn’t being sniffed by a third party.

Connectivity includes a pair of USB 3.0 Type A ports on the right side, joined by an HDMI port and a USB 3.0 Type C port. The left side of the laptop features two USB 2.0 Type A ports, a headphone jack, and an SD card reader. The laptop lacks a Kensington lock, but the only times I’ve ever seen one in use were in a public library, a school, or on display units in an electronics store.

Our review unit came with a 250GB Samsung 850 EVO M.2 SSD, which is an old favorite of mine in PC builds. The system also came with 8GB of RAM, which is plenty for most needs. If you want more RAM later on, the laptop is easy to upgrade.

About those upgrades

If some of the hardware specs have you a little put-off, don’t worry; you have options. The innards of the PC are designed to be upgradeable. I tested Purism’s claim by opening up the PC.

purism librem 15v3 chassis screw — One hint that the LIbrem 15 is upgrade-friendly is the use of Philips screws instead of star, hex, or Torx screws.

Flip over the Librem 15, and you’ll notice that all 14 of the screws are blessedly Phillips-head, unlike the star, hex, or Torx heads you’ll find on most other laptops. It was a cinch to unscrew these fasteners and lift off the base plate. I didn’t even have to run a fingernail—or heaven forbid, a flat-head driver—along the seam of the PC to release any plastic tabs, a process that usually involves a lot of unnerving cracking and popping sounds.

With the plate removed, all three of the major upgradeable parts—the SSD, RAM, and Wi-Fi module—were unobstructed and easily serviceable with the same Phillips-head screwdriver. For people used to building desktops or modifying laptops, this is a godsend and a rarity in laptop design.

Security and privacy features

purism librem 15v3 camera mic killswitch — Our test unit arrived with the mic and webcam kill switch enabled. The switch ensures that nobody can look or listen in when you’re not expecting them to.

Pursim’s main pitch to consumers is security and privacy. In this respect, the Librem 15 does quite well.

Even in a basic configuration, Linux distributions are, for the most part, more secure than Windows. During initial setup, it’s easy to install an encrypted system to a laptop. However, it’s nice to see that Purism ships the Librem 15 pre-encrypted using LVM on LUKS, a sane default for most encrypted Linux systems.

In case I lost you there, LVM is a bit like a virtual partition table that exists on a single partition, while LUKS is an encryption tool that secures partitions. By using LVM on LUKS, you can have multiple partitions secured with a single decryption passphrase. While LVM on LUKS isn’t good enough for the ultra-paranoid (it leaves your boot partition unencrypted), it’s good enough for most of us who don’t have evil maids.

purism librem 15v3 partition scheme — Our test unit came with encrypted virtual partitions thanks to LVM on LUKS, with the swap partition implemented as an LVM partition.

Just as System76 shipped the Galago Pro with Pop! OS, Purism ships its own Debian flavor, PureOS. (If you’ve ever used Ubuntu, you already know how to use Debian for the most part.)

It’s interesting to see PC makers venture into the field of building their own distributions. By doing so, Purism can control its own security and ensure drivers target a known subset of available hardware. Of course, this also requires the company to maintain its own repositories to distribute software updates and security patches.

The OS comes pre-configured with OpenVPN, so you can set up your VPN connections right away. For encryption, the GNOME-standard Seahorse application readily created SSH and GnuPG keys without issue.

PureOS doesn’t ship with Firefox or Chromium like other distributions might. Instead, it comes with a Firefox fork called PureBrowser. (Purism’s website says the OS ships with Tor, but I didn’t see it installed. The Tor browser is available in the PureOS official repositories.)

purism librem 15v3 purebrowser — PureOS’s PureBrowser is a fork of Mozilla’s Firefox that comes with HTTPS Everywhere and uBlock Origin preinstalled.

PureBrowser comes pre-configured with the HTTPS Anywhere and uBlock Origin plugins. Though it performs a similar function as uBlock, I would have liked to see Privacy Badger in that plugin lineup. (Again, it’s pretty easy to install Privacy Badger on your own.)

While the software privacy tools are nice, the two privacy features I like most are actually hardware features. The Librem 15 features two hardware kill switches: one for the mic and webcam, the other for the Wi-Fi and Bluetooth.

purism librem 15v3 radio killswitch — A hardware radio kill switch effectively air-gaps the laptop.

The keyboard hardware switches work as expected, so you can feel confident taking this laptop to DEFCON knowing that your hardware isn’t sending or receiving any network traffic. (This is called being “air-gapped.”) For the extra-paranoid, it’s easy to open up the laptop and remove the card with the Wi-Fi and Bluetooth radios completely.

The mic and webcam kill switch came engaged by default. This kill switch feature is nice because it means you don’t have to use a sticker or piece of tape to cover up the camera—and still have to worry about the mic. The kill switch covers both. That extra peace of mind is nice for people like me who have a nasty habit of leaving laptops open.

Benchmarks and performance

purism librem 15v3 flac — In a flip-flop from the Gzip test, the Librem 15v3 outpaced the Dell XPS 13 in the FLAC encoding test.

The Librem 15 has some impressive hardware, even if some of it is a little old. The Core i7-6500U should perform similarly to other Core i7s with normal use. Still, it has a 400MHz disadvantage compared to the newer Kaby Lake line.

The Samsung 850 EVO, while a great M.2 SSD, is a bit slower than its newer NVMe counterparts. As such, the Librem 15’s reads and writes are slower than you might see on high-end laptops like Dell’s Precision 5520, though the difference is hardly noticeable in most situations. For most people, the amount of RAM will yield better speed returns than a better SSD. Both the SSD and RAM are easily upgradeable, giving this PC plenty of room for improvement.

Our zero-point, the 2015 Dell XPS 13, has a Skylake Core i7 like the Librem 15. The Librem 15’s Core i7-6500U was triumphant in some tests, while the XPS 13’s Core i7-6560U outpaced it in others. That may be because of the performance overlap of the two CPUs. The Core i7-6560U’s base clock speed is 300MHz lower than the Core i7-6500U’s, but the Core i7-6560U’s turbo clock is 100MHz higher. Additionally, Phoronix Test Suite complained that the Librem 15 had a CPU governor enabled. While that’s not great for raw performance, it means improved battery life or better thermals.

purism librem 15v3 gzip — Gzip compression on the Librem 15v3 was a bit slower than on the 2015 Dell XPS 13 Developer’s Edition.

In CPU tests, the governor held back the Librem 15 in some places. In a Gzip compression benchmark, the Librem 15 was slightly (0.93 seconds) slower than the XPS 13 at compressing a 2GB file. On the other hand, converting a WAV file to FLAC was slightly (0.9 seconds) faster. The Librem 15 also pushed out frames little faster than the XPS 13, managing 6.84 fps compared to the XPS 13’s 6.48 fps.

purism librem 15v3 iozone write — Writes on the Librem 15’s SATA SSD were dismal compared to the XPS 13’s NVMe SSD.

The storage throughput was also much slower on the Librem 15. The IOZone read test of a 4GB file (with a 1MB record size) showed the Librem 15 to be 56.5 percent slower than the XPS 13. Writing a 4GB file was as dismal 78.6 percent slower.

There is one more thing to consider: full-disk encryption. When I test laptops, I normally ensure that the OS is installed on unencrypted partitions. The Librem 15 came with full disk encryption enabled, creating a slight performance hit as files head into and out of storage.

In my battery run test, I play an H.264 encoded movie on loop in VLC with the screen brightness set to about half. Running this test, the laptop lasted about 5 hours, 14 minutes on battery power. That’s adequate. By turning off your Wi-Fi and Bluetooth radios with the hardware switch, you could feasibly get even more life out of the battery.

Closing thoughts

The Librem 15 impressed me for what it does. While the performance and hardware are a step behind the times, this laptop’s first priorities lie elsewhere, in its privacy features, upgrade-friendly design, and sleek looks. That’s where your priorities should lie, too, if this laptop is meant for you.