Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Qubes-Lite with KVM and Wayland

roscidus.com

Post reply on HN
Print view View original

11–20 of 52 posts

Re: Qubes-Lite with KVM and Wayland

#11

Post by fsflover »

1996 wrote: post #5
Nojlk wrote: post #3

Earlier quoted context omitted.

The Qubes people don't recommend doing GPU passthrough because of the security implications. As for the OP, I feel like if somebody cares about security, they shouldn't be doing any of this. Trying to come up with some self-designed hodgepodge of things isn't really enough security-wise, even if you do use VMs, and I'd find it hard to trust something like this as a platform to do anything important on.

> The Qubes people don't recommend doing GPU passthrough because of the security implications. Why? DMA?

"Clarifications on GPU security": https://groups.google.com/g/qubes-devel/c/MeLYpHyLRHQ

See also: https://www.qubes-os.org/faq/#can-i-run-applications-like-ga...

But the fact is, even if you are doing GPI passthrough in Qubes, it's much more secure than running any other system.

Re: Qubes-Lite with KVM and Wayland

#12

Post by indigodaddy »

m463 wrote: post #4

I used qubes for a while, but found it kind of cumbersome to do most things, and I never got over the hump. Since then I've been using proxmox, and I'm at the point where I don't use the gui anymore, I just do everything from the command line. You can do VM things (like run macos in a vm), but I do most things in lxc containers. It would be kind of nice if proxmox had something like a Dockerfile, but with local conta…

So like, you are using Proxmox as your main OS/desktop? And then doing application (eg firefox for browsing, etc) things in in proxmox LXC containers?

If so, that is pretty interesting...

Although, using LXD with Ubuntu is totally painless and easy as well..

Re: Qubes-Lite with KVM and Wayland

#13

Post by effie »

Nojlk wrote: post #3
minimalist wrote: post #2

This is an amazing effort, very cool! I'm not sure why the author is having so much pain with Qubes. Indeed the lack of GPU in guest VMs is annoying but it is possible now to assign a GPU to a HVM fairly reliably thanks to all of the VFIO/gaming-on-linux enthusiasm in the past years. Otherwise, I also find that running browsers in multiple VMs on laptop is a problem if you don't disable JS by default because modern w…

The Qubes people don't recommend doing GPU passthrough because of the security implications. As for the OP, I feel like if somebody cares about security, they shouldn't be doing any of this. Trying to come up with some self-designed hodgepodge of things isn't really enough security-wise, even if you do use VMs, and I'd find it hard to trust something like this as a platform to do anything important on.

"The Qubes people" have a product to develop and maintain. They aren't the single highest authority on secure desktop setups.

Security isn't a black or white issue. There are levels of security. Many tech people want something better than the (very insecure) standard setup on Linux/Windows, but they don't want the Qubes straight-jacket. This means they search or develop alternatives and that is overall a good thing.

Re: Qubes-Lite with KVM and Wayland

#14

Post by miduil »

Klwohu wrote: post #6

Is this really a good idea considering the security issues with Wayland?[1] [1] https://github.com/Aishou/wayland-keylogger

This is not a wayland security issue. This is the equivalent of calling a car key lock insecure just because someone can drive your car when you give them your key.

Re: Qubes-Lite with KVM and Wayland

#15

Post by effie »

xvector wrote: post #8
m463 wrote: post #4

I used qubes for a while, but found it kind of cumbersome to do most things, and I never got over the hump. Since then I've been using proxmox, and I'm at the point where I don't use the gui anymore, I just do everything from the command line. You can do VM things (like run macos in a vm), but I do most things in lxc containers. It would be kind of nice if proxmox had something like a Dockerfile, but with local conta…

I have been considering grabbing a Librem 14 and switching to Qubes as a daily. Could you elaborate on what you found cumbersome?

Qubes is very "opinionated" about how things work and provides a functional but very tightly-knit product that cannot be easily modified to suit your own needs. You have to accept their choices like a good nontechnical user does - you can't modify/replace components or use a modified security model easily.

For example, with version 3.2 which I used for a while, one has to use the default disk setup (no ZFS or other cool storage tech) with slow 2layer filesystems, no GPU acceleration for applications in VMs, mandatory encrypted backup scheme. Regarding security, Qubes makes some strange choices such giving the regular VM unix user root privileges accessible via simple passwordless sudo.

Qubes runs only on a subset of available hardware (motherboard has to be good enough) so watch out for that. Also interaction with VM manager and graphically intensive applications in VMs was sluggish and internet/firewall/audio would randomly stop working when restarting VMs and require system reboot to fix. Some of these may be better now with newest version 4.x, but I am doubtful.

Re: Qubes-Lite with KVM and Wayland

#16

Post by walrus01 »

The part about the qubes dom0 being 'outdated' is worrying, because one of the important things to think about for good Xen linux-on-linux (PV) performance is to use a recent kernel on the dom0, and recent version of xen.

Even ultra conservative debian stable (buster, right now) uses something fairly up to date, and xen 4.11. I'd be concerned about using anything older than that.

Re: Qubes-Lite with KVM and Wayland

#17

Post by Shared404 »

effie wrote: post #15
xvector wrote: post #8

Earlier quoted context omitted.

I have been considering grabbing a Librem 14 and switching to Qubes as a daily. Could you elaborate on what you found cumbersome?

Qubes is very "opinionated" about how things work and provides a functional but very tightly-knit product that cannot be easily modified to suit your own needs. You have to accept their choices like a good nontechnical user does - you can't modify/replace components or use a modified security model easily. For example, with version 3.2 which I used for a while, one has to use the default disk setup (no ZFS or other c…

> Qubes is very "opinionated" about how things work and provides a functional but very tightly-knit product that cannot be easily modified to suit your own needs. You have to accept their choices like a good nontechnical user does - you can't modify/replace components or use a modified security model easily.

It's worth mentioning that Qubes has good reason for this.

A big part of the purpose for their existence is to help protect journalists and others who would greatly benefit from enhanced security, but don't know how to get there themselves.

Re: Qubes-Lite with KVM and Wayland

#18

Post by dmm »

effie wrote: post #15
xvector wrote: post #8

Earlier quoted context omitted.

I have been considering grabbing a Librem 14 and switching to Qubes as a daily. Could you elaborate on what you found cumbersome?

Qubes is very "opinionated" about how things work and provides a functional but very tightly-knit product that cannot be easily modified to suit your own needs. You have to accept their choices like a good nontechnical user does - you can't modify/replace components or use a modified security model easily. For example, with version 3.2 which I used for a while, one has to use the default disk setup (no ZFS or other c…

> graphically intensive applications in VMs was sluggish

Just as a datapoint youtube or vlc seem to work well enough. The sluggishness is definitely noticeable though. As a developer it encourages me to optimize the display performance of my web applications. If it performs ok on Qubes it's liquid smooth on my 3+ year old android phone. Take that as you will...

> internet/firewall/audio would randomly stop working when restarting VMs

I started with 4.X and I haven't noticed this. I never actually used 3.X so I can't say if it's something that was fixed or never present on my hw.

> provides a functional but very tightly-knit product that cannot be easily modified to suit your own needs.

This is a fair assessment. But I've come to realize I need the isolation Qubes provides more than I thought I would. No advanced threats or anything. Just the ability to put email, chat, password manager, and work in separate reproducible environments is really cool. Clicking a url on a chat won't open in the browser I'm signed into google or in my work browser. If you have the need for gpg or tor they offer solutions with a high degree of isolation, though I haven't looked into them much.

Re: Qubes-Lite with KVM and Wayland

#19

Post by indolering »

xvector wrote: post #8
m463 wrote: post #4

I used qubes for a while, but found it kind of cumbersome to do most things, and I never got over the hump. Since then I've been using proxmox, and I'm at the point where I don't use the gui anymore, I just do everything from the command line. You can do VM things (like run macos in a vm), but I do most things in lxc containers. It would be kind of nice if proxmox had something like a Dockerfile, but with local conta…

I have been considering grabbing a Librem 14 and switching to Qubes as a daily. Could you elaborate on what you found cumbersome?

> I have been considering grabbing a Librem 14 and switching to Qubes as a daily

FWIW, I did the same thing and was unhappy with the result. The Librem hardware wasn't great quality and Qubes really requires a massive desktop to run well. And if you are paranoid enough to need Qubes, then you want ECC memory to defend against side channel attacks.

Re: Qubes-Lite with KVM and Wayland

#20

Post by [deleted] »

walrus01 wrote: post #16

The part about the qubes dom0 being 'outdated' is worrying, because one of the important things to think about for good Xen linux-on-linux (PV) performance is to use a recent kernel on the dom0, and recent version of xen. Even ultra conservative debian stable (buster, right now) uses something fairly up to date, and xen 4.11. I'd be concerned about using anything older than that.

[deleted]
Post reply on HN