Show HN: Qvm-Create-Windows-Qube: The most secure and private way to run Windows
1–10 of 41 posts
Re: Show HN: Qvm-Create-Windows-Qube: The most secure and private way to run Windows
#2Hi, HN! This is a small project I developed for Qubes OS that allows you to spin up new Windows qubes quickly, effortlessly and securely.
Hope you don't mind the flamboyant title, but, I truly do believe that the small attack surface of the heavily minified Xen hypervisor, networking stack, GUI virtualization, and much more Qubes OS employs + the Whonix intergration implemented in this project (making it a Windows-Whonix-Workstation; thus also giving it Tor-only Internet access with stream isolation between other VMs) makes it the most secure and private way to use Windows currently available today. Those are just the two main points, besides that, there is also the fact that because everyone using this project is both having their Windows VMs set up in the same way and running Qubes OS, that greatly helps to keep the OS and hypervisor fingerprint homogeneous across all users. This effect will only grow stronger as the Qubes OS userbase increases. Lastly, if the user wishes to reset their fingerprint, they can automatically do so by reinstalling Windows with this project.
Of course, I would be happy to go into detail and answer questions about any of this.
Note that this project is the product of an independent effort which is not officially endorsed by Qubes OS or Whonix.
Re: Show HN: Qvm-Create-Windows-Qube: The most secure and private way to run Windows
#3Hi, HN! This is a small project I developed for Qubes OS that allows you to spin up new Windows qubes quickly, effortlessly and securely. Hope you don't mind the flamboyant title, but, I truly do believe that the small attack surface of the heavily minified Xen hypervisor, networking stack, GUI virtualization, and much more Qubes OS employs + the Whonix intergration implemented in this project (making it a Windows-Wh…
I didn't know about qubes before this, but Edward Snowden's testimonial hooked me.
So, qubes is an OS where each "process" is more or less an isolated Xen VM, is that a good starting point?
I have so many more questions about qubes than your project, but I've been struggling to find a good way to run Windows VMs on Linux reliably and your project looks great for that. Once I get a qubes os box up, I'll give it a try.
Re: Show HN: Qvm-Create-Windows-Qube: The most secure and private way to run Windows
#4Hi, HN! This is a small project I developed for Qubes OS that allows you to spin up new Windows qubes quickly, effortlessly and securely. Hope you don't mind the flamboyant title, but, I truly do believe that the small attack surface of the heavily minified Xen hypervisor, networking stack, GUI virtualization, and much more Qubes OS employs + the Whonix intergration implemented in this project (making it a Windows-Wh…
I didn't know about qubes before this, but Edward Snowden's testimonial hooked me. So, qubes is an OS where each "process" is more or less an isolated Xen VM, is that a good starting point? I have so many more questions about qubes than your project, but I've been struggling to find a good way to run Windows VMs on Linux reliably and your project looks great for that. Once I get a qubes os box up, I'll give it a try.
You're starting to get the idea:
Qubes OS assumes that it's impossible to ensure every single application you will be running on your computer is secure. Therefore, the best way to secure your computer is to isolate all of the applications as much as possible so the exploitation of one doesn't lead to compromise of another or the entire system. Through (heavily minimized) Xen VMs is the most basic way Qubes seeks to provide this isolation. However, it goes much further than that into the networking stack, audio stack, GUI stack, and much more. This all lies on a security principle known as "security by isolation" or "security by compartmentalization".
You typically have different "qubes" (VMs) for all of your different day-to-day tasks/activities. Although, not necessarily each process.
By all means give it a try, you won't regret it!
Re: Show HN: Qvm-Create-Windows-Qube: The most secure and private way to run Windows
#5Earlier quoted context omitted.
I didn't know about qubes before this, but Edward Snowden's testimonial hooked me. So, qubes is an OS where each "process" is more or less an isolated Xen VM, is that a good starting point? I have so many more questions about qubes than your project, but I've been struggling to find a good way to run Windows VMs on Linux reliably and your project looks great for that. Once I get a qubes os box up, I'll give it a try.
You're starting to get the idea: Qubes OS assumes that it's impossible to ensure every single application you will be running on your computer is secure. Therefore, the best way to secure your computer is to isolate all of the applications as much as possible so the exploitation of one doesn't lead to compromise of another or the entire system. Through (heavily minimized) Xen VMs is the most basic way Qubes seeks to…
If only the hardware compatibility was better. It hasn't worked on my past three laptops.
Re: Show HN: Qvm-Create-Windows-Qube: The most secure and private way to run Windows
#6Earlier quoted context omitted.
You're starting to get the idea: Qubes OS assumes that it's impossible to ensure every single application you will be running on your computer is secure. Therefore, the best way to secure your computer is to isolate all of the applications as much as possible so the exploitation of one doesn't lead to compromise of another or the entire system. Through (heavily minimized) Xen VMs is the most basic way Qubes seeks to…
If only the hardware compatibility was better. It hasn't worked on my past three laptops.
I'm aware hardware support on Qubes has been problematic for some users. Luckily, it's looking to get a lot better with the up-and-coming Qubes R4.1 (currently on it's first release candidate). It will be shipping with a fully updated base hypervisor and kernel feature set to allow support for newer hardware.
I'm not quite sure the specifics of your hardware problem, but, feel free to file a bug on the Qubes issue tracker.
Re: Show HN: Qvm-Create-Windows-Qube: The most secure and private way to run Windows
#7Earlier quoted context omitted.
You're starting to get the idea: Qubes OS assumes that it's impossible to ensure every single application you will be running on your computer is secure. Therefore, the best way to secure your computer is to isolate all of the applications as much as possible so the exploitation of one doesn't lead to compromise of another or the entire system. Through (heavily minimized) Xen VMs is the most basic way Qubes seeks to…
If only the hardware compatibility was better. It hasn't worked on my past three laptops.
Yes, I was wanting to try this on a spare laptop but having to trial on a bunch until one works is going to be challenging. Is there a place to find supported hardware?
I actually care very little about anything other than the network stack. If audio doesn't work, it won't bother me.
Re: Show HN: Qvm-Create-Windows-Qube: The most secure and private way to run Windows
#8Earlier quoted context omitted.
If only the hardware compatibility was better. It hasn't worked on my past three laptops.
Yes, I was wanting to try this on a spare laptop but having to trial on a bunch until one works is going to be challenging. Is there a place to find supported hardware? I actually care very little about anything other than the network stack. If audio doesn't work, it won't bother me.
You're in luck, there exists exactly what you're looking for. It's called the Hardware Compatibility List (HCL), see here: https://www.qubes-os.org/hcl/
Re: Show HN: Qvm-Create-Windows-Qube: The most secure and private way to run Windows
#9Earlier quoted context omitted.
Yes, I was wanting to try this on a spare laptop but having to trial on a bunch until one works is going to be challenging. Is there a place to find supported hardware? I actually care very little about anything other than the network stack. If audio doesn't work, it won't bother me.
You're in luck, there exists exactly what you're looking for. It's called the Hardware Compatibility List (HCL), see here: https://www.qubes-os.org/hcl/
Wow, this is so incredible. Thank you!
Re: Show HN: Qvm-Create-Windows-Qube: The most secure and private way to run Windows
#10Hi, HN! This is a small project I developed for Qubes OS that allows you to spin up new Windows qubes quickly, effortlessly and securely. Hope you don't mind the flamboyant title, but, I truly do believe that the small attack surface of the heavily minified Xen hypervisor, networking stack, GUI virtualization, and much more Qubes OS employs + the Whonix intergration implemented in this project (making it a Windows-Wh…
This is really cool, starred right try out at a later date.
Question: what does GUI virtualization actually mean? Does that mean the OS runs windowed in your existing DE? I’m guessing that means no HW acceleration. Is it possible to selectively pass through the GPU for a KVM-esque experience?