Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Qvm-Create-Windows-Qube: The most secure and private way to run Windows

github.com

Post reply on HN
Print view View original

21–30 of 41 posts

Re: Show HN: Qvm-Create-Windows-Qube: The most secure and private way to run Windows

#21

Post by formerly_proven »

xrd wrote: post #7
allset_ wrote: post #5

Earlier quoted context omitted.

If only the hardware compatibility was better. It hasn't worked on my past three laptops.

Yes, I was wanting to try this on a spare laptop but having to trial on a bunch until one works is going to be challenging. Is there a place to find supported hardware? I actually care very little about anything other than the network stack. If audio doesn't work, it won't bother me.

FWIW I've run Qubes on a few random Intel laptops years ago and it just worked on all of them. (Including on an esoteric milspec laptop which oozed hacker-street-cred at the time).

Re: Show HN: Qvm-Create-Windows-Qube: The most secure and private way to run Windows

#22

Post by fsflover »

elliotkillick wrote: post #8
xrd wrote: post #7

Earlier quoted context omitted.

Yes, I was wanting to try this on a spare laptop but having to trial on a bunch until one works is going to be challenging. Is there a place to find supported hardware? I actually care very little about anything other than the network stack. If audio doesn't work, it won't bother me.

You're in luck, there exists exactly what you're looking for. It's called the Hardware Compatibility List (HCL), see here: https://www.qubes-os.org/hcl/

See also: https://forum.qubes-os.org/t/community-recommended-computers

Re: Show HN: Qvm-Create-Windows-Qube: The most secure and private way to run Windows

#23

Post by shadilay »

elliotkillick wrote: post #20
shadilay wrote: post #18

Earlier quoted context omitted.

You could say the Same about non IOMMU CPU virtualization. The problem here is AMD and Nvidias disgusting greed that has held back security by at least a decade. GPU virtualization (vGPU/MxGPU) is supported but only if you pay ridiculous enterprise licensing. This should be a first class feature like VT-d and would enable a usable Qubes desktop and Microsoft's VBS. https://en.wikipedia.org/wiki/GPU_virtualization#Med…

Wow, I was unaware such hardware virtualization extensions currently existed in such mature form for GPUs. Really unfortunate that they've been lost to the avarice of two tech giants which have a duopoly over the GPU market.

They're not that mature software wise due to the fact that hardly anyone uses them. Microsoft may save us here because Virtualization Based Security has to be enabled to sell an OEM PC with a Win11 sticker. Doing GPU virtualization in software has a big performance hit if not hardware assisted (like CPU virt). Hopefully this will twist enough arms at AMD/Nvidia that they will be forced to open up virt features on consumer cards. I asked an Intel graphics rep if virt would be supported on Intel's new discrete parts (Arc series) and they said wait until launch to see which is at least better than last year when they told me they had no plans.

https://www.pcgamer.com/windows-11-pcs-can-hobble-gaming-per...

Re: Show HN: Qvm-Create-Windows-Qube: The most secure and private way to run Windows

#24

Post by lokedhs »

elliotkillick wrote: post #2

Hi, HN! This is a small project I developed for Qubes OS that allows you to spin up new Windows qubes quickly, effortlessly and securely. Hope you don't mind the flamboyant title, but, I truly do believe that the small attack surface of the heavily minified Xen hypervisor, networking stack, GUI virtualization, and much more Qubes OS employs + the Whonix intergration implemented in this project (making it a Windows-Wh…

Does this use the default graphics drivers in Windows? I have an older installation of Win10 on my Qubes laptop, and I'm limited in the resolution I can set on the Windows desktop. I have 1440p display on the laptop, and the largest resolution is still a window that is much smaller than the screen. This is my biggest problem with the Windows VM, and I was hoping that your project might do something to address this.

Re: Show HN: Qvm-Create-Windows-Qube: The most secure and private way to run Windows

#25

Post by elliotkillick »

lokedhs wrote: post #24
elliotkillick wrote: post #2

Hi, HN! This is a small project I developed for Qubes OS that allows you to spin up new Windows qubes quickly, effortlessly and securely. Hope you don't mind the flamboyant title, but, I truly do believe that the small attack surface of the heavily minified Xen hypervisor, networking stack, GUI virtualization, and much more Qubes OS employs + the Whonix intergration implemented in this project (making it a Windows-Wh…

Does this use the default graphics drivers in Windows? I have an older installation of Win10 on my Qubes laptop, and I'm limited in the resolution I can set on the Windows desktop. I have 1440p display on the laptop, and the largest resolution is still a window that is much smaller than the screen. This is my biggest problem with the Windows VM, and I was hoping that your project might do something to address this.

I also faced this problem with the low selection of resolutions to choose for the Windows desktop with my ultrawide 3440x1440 screen. No worries, it was easily overcome with a simple modification to SeaBIOS, see here: https://groups.google.com/g/qubes-devel/c/aCCGpYysZTQ/m/4yMY...

I'm in the process of submitting a patch to SeaBIOS so it will no longer be necessary to patch this in yourself.

Re: Show HN: Qvm-Create-Windows-Qube: The most secure and private way to run Windows

#26

Post by lokedhs »

elliotkillick wrote: post #25
lokedhs wrote: post #24

Earlier quoted context omitted.

Does this use the default graphics drivers in Windows? I have an older installation of Win10 on my Qubes laptop, and I'm limited in the resolution I can set on the Windows desktop. I have 1440p display on the laptop, and the largest resolution is still a window that is much smaller than the screen. This is my biggest problem with the Windows VM, and I was hoping that your project might do something to address this.

I also faced this problem with the low selection of resolutions to choose for the Windows desktop with my ultrawide 3440x1440 screen. No worries, it was easily overcome with a simple modification to SeaBIOS, see here: https://groups.google.com/g/qubes-devel/c/aCCGpYysZTQ/m/4yMY... I'm in the process of submitting a patch to SeaBIOS so it will no longer be necessary to patch this in yourself.

Thank you very much. This explains precisely what is going on. I will try this as soon as I finish my upgrade to 4.1.

Re: Show HN: Qvm-Create-Windows-Qube: The most secure and private way to run Windows

#27

Post by TheFreim »

I hope to try qubes one day, it's a shame that my current hardware isn't supported. If I wanted to learn how to add support for my own hardware where would I start (would probably be quite an undertaking, but might be worth learning about regardless of how far I'd get).

Re: Show HN: Qvm-Create-Windows-Qube: The most secure and private way to run Windows

#28

Post by ncmncm »

allset_ wrote: post #5
elliotkillick wrote: post #4

Earlier quoted context omitted.

You're starting to get the idea: Qubes OS assumes that it's impossible to ensure every single application you will be running on your computer is secure. Therefore, the best way to secure your computer is to isolate all of the applications as much as possible so the exploitation of one doesn't lead to compromise of another or the entire system. Through (heavily minimized) Xen VMs is the most basic way Qubes seeks to…

If only the hardware compatibility was better. It hasn't worked on my past three laptops.

There is a hardware compatibility page with user reports.

The main thing is that, to be practical, it needs at least 16GB of RAM. With only 16GB, you will want to use the ZRAM swap driver on your linux VMs. Dunno if any equivalent exists for windos.

Re: Show HN: Qvm-Create-Windows-Qube: The most secure and private way to run Windows

#29

Post by ncmncm »

elliotkillick wrote: post #17
Bombthecat wrote: post #16

Earlier quoted context omitted.

Does 3d card passthrough work?

If you're referring to GPU passthrough, then yes, in practice much better with AMD cards then Nvidia cards.

I have been wondering... Instead of exposing the hardware GPU to the appVM, would a Vulkan virtualization work? I.e., VM sees a Vulkan API that forwards calls to a dedicated graphics VM that runs them.

(I understand that getting windos to use them could be hard.)

Re: Show HN: Qvm-Create-Windows-Qube: The most secure and private way to run Windows

#30

Post by shadilay »

ncmncm wrote: post #29
elliotkillick wrote: post #17

Earlier quoted context omitted.

If you're referring to GPU passthrough, then yes, in practice much better with AMD cards then Nvidia cards.

I have been wondering... Instead of exposing the hardware GPU to the appVM, would a Vulkan virtualization work? I.e., VM sees a Vulkan API that forwards calls to a dedicated graphics VM that runs them. (I understand that getting windos to use them could be hard.)

I don't have any direct knowledge but those kind of solutions create security problems.

https://en.wikipedia.org/wiki/RemoteFX#RemoteFX_vGPU_Depreca...

https://en.wikipedia.org/wiki/GPU_virtualization#API_remotin...

Post reply on HN