Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How to deal with security implications of running/installing projects?

news.ycombinator.com

Post reply on HN
Print view View original

11–18 of 18 posts

Re: Ask HN: How to deal with security implications of running/installing projects?

#11

Post by handedness »

johng wrote: post #4
fsflover wrote: post #2

Have you considered Qubes OS, https://qubes-os.org ? It is more secure than Xen, which it relies on, https://www.qubes-os.org/security/xsa/#statistics .

I've always been interested in Qubes OS but it definitely seems like a very high pain point. I can see installing these things on VM's and then maybe trying to inspect traffic outbound to see if there is something untoward, but even that can be hidden pretty well. Hell, I've installed some older "known good" packages and some of them have so many dependencies that are pulled in automatically, the app itself could be…

Give Qubes OS a shot. It's significantly less challenging to run than it used to be, and a (small, I admit) number of us daily drive it. Hardware support these days, while far from perfect, is much better. It's not the daunting slog to get it going that it used to be.

Provided you aren't looking to run accelerated graphics or care about integrated Bluetooth, you should be fine. I'd recommend any Intel laptop (and some AMDs) with built-in Ethernet, just in case it doesn't like the Wi-Fi card. Install with kernel-latest (it's a simple option when you boot into the installer ISO), and try it out. Grab a T480/T480s if you have one handy, and you may be surprised.

Re: Ask HN: How to deal with security implications of running/installing projects?

#12

Post by johng »

handedness wrote: post #11
johng wrote: post #4

Earlier quoted context omitted.

I've always been interested in Qubes OS but it definitely seems like a very high pain point. I can see installing these things on VM's and then maybe trying to inspect traffic outbound to see if there is something untoward, but even that can be hidden pretty well. Hell, I've installed some older "known good" packages and some of them have so many dependencies that are pulled in automatically, the app itself could be…

Give Qubes OS a shot. It's significantly less challenging to run than it used to be, and a (small, I admit) number of us daily drive it. Hardware support these days, while far from perfect, is much better. It's not the daunting slog to get it going that it used to be. Provided you aren't looking to run accelerated graphics or care about integrated Bluetooth, you should be fine. I'd recommend any Intel laptop (and som…

I have a bunch of desktops and mini desktops I have laying around I can try it on. I'm assuming it works on most Linux hardware, except maybe the wifi? For example I have a few Beelink GK Minis and Geekom computers.

Re: Ask HN: How to deal with security implications of running/installing projects?

#13

Post by handedness »

johng wrote: post #12
handedness wrote: post #11

Earlier quoted context omitted.

Give Qubes OS a shot. It's significantly less challenging to run than it used to be, and a (small, I admit) number of us daily drive it. Hardware support these days, while far from perfect, is much better. It's not the daunting slog to get it going that it used to be. Provided you aren't looking to run accelerated graphics or care about integrated Bluetooth, you should be fine. I'd recommend any Intel laptop (and som…

I have a bunch of desktops and mini desktops I have laying around I can try it on. I'm assuming it works on most Linux hardware, except maybe the wifi? For example I have a few Beelink GK Minis and Geekom computers.

Generally speaking, if your Wi-Fi works on Debian and/or Fedora, it should work on Qubes OS. There are exceptions to that, of course.

On a desktop PC you'll have to make some tradeoffs versus most laptops, namely integrating sys-net and sys-usb, but the installer will handle that for you. You'll want to auto-accept your keyboard and mouse, and try not to shut down sys-net. But you'll learn. Since your concern is isolating software you're running, and not necessarily isolating untrusted USB devices, that's not a big loss.

Give it a shot on a few machines and report back. Even better, try it and submit HCL reports to inform others: https://www.qubes-os.org/hcl/ Intel is generally easier than AMD, but I've run it on pretty modern AMD mobile chipsets with a lot of success.

Again, kernel-latest is your friend, and look online to see if anyone recommends any particular kernel flags.

Re: Ask HN: How to deal with security implications of running/installing projects?

#16

Post by simoneree »

johng wrote: post #4
fsflover wrote: post #2

Have you considered Qubes OS, https://qubes-os.org ? It is more secure than Xen, which it relies on, https://www.qubes-os.org/security/xsa/#statistics .

I've always been interested in Qubes OS but it definitely seems like a very high pain point. I can see installing these things on VM's and then maybe trying to inspect traffic outbound to see if there is something untoward, but even that can be hidden pretty well. Hell, I've installed some older "known good" packages and some of them have so many dependencies that are pulled in automatically, the app itself could be…

[flagged]
Post reply on HN