Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Subgraph OS: Adversary resistant computing platform

subgraph.com

Post reply on HN
Print view View original

51–60 of 88 posts

Re: Subgraph OS: Adversary resistant computing platform

#51

Post by nickpsecurity »

tptacek wrote: post #9
Animats wrote: post #6

Earlier quoted context omitted.

Maybe a real secure kernel, such as SeL4 or LynxOS.

The tipoff that it's not L4 is that it's a desktop OS that runs applications.

You can do a desktop on a microkernel that runs Linux in user-mode or with hypervisor support. Critical stuff stays outside directly on microkernel. It's what every vendor of separation kernels does. Two examples from commercial and FOSS that's similarly alpha:

Sirrix TrustedDesktop on Turaya:

https://www.sirrix.com/content/pages/trusteddesktop_en.htm

Turaya's architecture:

http://www.perseus-os.org/content/pages/Overview.htm

FOSS alternative that they already use to develop itself:

https://genode.org/

Re: Subgraph OS: Adversary resistant computing platform

#52

Post by nickpsecurity »

xdma wrote: post #41
dom0 wrote: post #21

Earlier quoted context omitted.

imho the qubes approach is more viable and exposes far less attack surface. Qubes is also, contrary to it's reputation, a very usable OS (with KDE in dom0, at least).

Subgraph does lots of things Qubes doesn't, and this will only increase over time. For example: an experimental Subgraph OS feature[1] is to, by mandatory sandbox policy, prevent a specific application from connecting to anything except TLS endpoints, or specific TLS endpoints while adding certificate pinning outside of an application and performing extra-app validation. Could be useful over Tor or public wi-fi, righ…

" Qubes is not going to build this, yet I am running a prototype of it on my SGOS dev laptop."

You can do that in Qubes or the architecturally-superior GenodeOS. Genode is FOSS so nothing stops you. Any programs computing with secrets can run in an isolated partition to prevent leaks. Similar with protecting integrity of backups like in some partitioned filesystems. And you get the benefits of subgraph on the inside.

Re: Subgraph OS: Adversary resistant computing platform

#53

Post by protomikron »

AgentME wrote: post #46
protomikron wrote: post #15

This is a step in the right direction (in the sense that we should sandbox applications harder), but in my opinion we have to change fundamental aspects of our stack (e.g. Proprietary Firmware Linux GNU-System-Libs X GTK Evince), to gain more security. In particular I think it is harmful that all applications share the same view on the FS and have in principal the possibility to use e.g. full unixoish capabilities. M…

You might be interested in object-capability model[0] systems. It comes from the idea that in most memory-safe languages, before you can call a function or a method on an object, you first need to get a reference to it passed to you first. You can easily determine what code operates on an object by looking to where the object is passed. Now imagine if all types of IO interactions followed a similar system. Right now,…

This is also interesting. I expect there is some connection between this and the mentioned effect systems, at least their goals seem to overlap.

Re: Subgraph OS: Adversary resistant computing platform

#54

Post by xdma »

nickpsecurity wrote: post #52
xdma wrote: post #41

Earlier quoted context omitted.

Subgraph does lots of things Qubes doesn't, and this will only increase over time. For example: an experimental Subgraph OS feature[1] is to, by mandatory sandbox policy, prevent a specific application from connecting to anything except TLS endpoints, or specific TLS endpoints while adding certificate pinning outside of an application and performing extra-app validation. Could be useful over Tor or public wi-fi, righ…

" Qubes is not going to build this, yet I am running a prototype of it on my SGOS dev laptop." You can do that in Qubes or the architecturally-superior GenodeOS. Genode is FOSS so nothing stops you. Any programs computing with secrets can run in an isolated partition to prevent leaks. Similar with protecting integrity of backups like in some partitioned filesystems. And you get the benefits of subgraph on the inside.

No, Qubes hasn't written the TLS client handshake proxy to enforce the policy. Out of scope. That's what I meant, and it's just one example of the things above the level of "Qubes" or "Oz" plumbing that makes Subgraph OS what it is.

Re: Subgraph OS: Adversary resistant computing platform

#55

Post by eddyl »

dlevi wrote: post #50

Does Subgraph isolate USB and network? The isolated serviceVMs for USB and network are in my opinion a very strong value proposition of Qubes. Furthermore, is Subgraph supposed to be an OS for everyday use, like Qubes, or just for anonymous usage like Tails or Whonix? If its the former I don't understand why all traffic should be routed via Tor by default - it wouldn't make sense to route non-anonymous traffic (banki…

> Does Subgraph isolate USB and network? The isolated serviceVMs for USB and network are in my opinion a very strong value proposition of Qubes.

According to Joanna Rutkowska, developer of Qubes: "Unlike Qubes OS, Subgraph doesn't (cannot) isolate networking and USB stacks, or other devices and drivers."[1]

[1] https://secure-os.org/pipermail/desktops/2015-October/000002...

Re: Subgraph OS: Adversary resistant computing platform

#56

Post by nickpsecurity »

xdma wrote: post #16
tptacek wrote: post #11

Earlier quoted context omitted.

It's named for their company, which does other things too.

Yup. Subgraph is a nearly 7 year old open source software company. We wrote a web scanner (Vega) that's sadly neglected, though still used regularly by thousands of users. We also do consulting, like pentesting, etc. The name was inspired by work I was following at the time (10 years ago?) by Halvar Flake etc, on applying graph theory methods to reverse engineering / runtime analysis.

It's catchy, sounds technical, and non-technical people can still spell it. Great name. :)

Re: Subgraph OS: Adversary resistant computing platform

#57

Post by dlevi »

eddyl wrote: post #55
dlevi wrote: post #50

Does Subgraph isolate USB and network? The isolated serviceVMs for USB and network are in my opinion a very strong value proposition of Qubes. Furthermore, is Subgraph supposed to be an OS for everyday use, like Qubes, or just for anonymous usage like Tails or Whonix? If its the former I don't understand why all traffic should be routed via Tor by default - it wouldn't make sense to route non-anonymous traffic (banki…

> Does Subgraph isolate USB and network? The isolated serviceVMs for USB and network are in my opinion a very strong value proposition of Qubes. According to Joanna Rutkowska, developer of Qubes: "Unlike Qubes OS, Subgraph doesn't (cannot) isolate networking and USB stacks, or other devices and drivers."[1] [1] https://secure-os.org/pipermail/desktops/2015-October/000002...

Thanks for that - it pretty much answers my question. In this case it seems that Qubes exposes less attack surface.

Re: Subgraph OS: Adversary resistant computing platform

#59

Post by xdma »

stcredzero wrote: post #58

I rather like the graphic with this post. Is that based on pixel art, programmatically combined to resemble orthographic projection, or is it generated by WebGL? (Using one of the available blocks libraries in Javascript.)

It was drawn by hand using a vector illustrations tool, based on a sketch that I had made. We think it is very cool and will produce more conceptual illustration in this style.

The artist goes by Sephy Ka: http://www.sephyka.com/box-stories/

Re: Subgraph OS: Adversary resistant computing platform

#60

Post by delinka »

Animats wrote: post #3

They try to avoid saying it, but it's mostly a patched Linux.

After reading the article, and reading replies to you, I still have to guess whether this is a Linux kernel or something else. And I still don't understand why they don't mention this on their site. The talk of "kernel with certain patches" has me guessing it is indeed Linux.
Post reply on HN