Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

QubesOS – A reasonably secure operating system

qubes-os.org

Post reply on HN
Print view View original

11–20 of 141 posts

Re: QubesOS – A reasonably secure operating system

#11

Post by weinzierl »

sigmonsays wrote: post #2

this is my next OS to experiment with. However i'm worried my toy laptop with 16gb of ram (thinkpad t480) wont cut it. Anyone want to chime in here?

I used it productively (see my other comment) a couple of years a ago on an average Dell Inspiron. It worked pretty well, no complaints.

Re: QubesOS – A reasonably secure operating system

#13

Post by beardog »

I love Qubes a lot, I daily drove it for a few years and still have it on a laptop. but i would not recommend it even to most technical people, mainly because you forfeit the ability to run things on bare metal. "dom0" is the same as on normal xen - it is a VM and has the associated overhead still. On top of that, the official Qubes dom0 runs a very outdated fedora version.

I am instead writing my own code to automate libvirt to replicate much of Qubes' functionality (ephemeral roots for vms, disposable vm support, GUI isolation) so i can still have Qubes security for most of my apps but fully exercise my hardware when I want.

There are also some minor criticisms i have of Qubes' default, mainly that appvms have passwordless sudo by default and less importantly, no MAC such as apparmor. Passwordless sudo arguably makes it somewhat easier to break out of the VM and no in-vm sandboxing means you have to run every in a separate VM unless you want to set that up yourself.

For example i don't really want my work thunderbird to have access to my work browser, so a single "work" domain isn't enough for me.

Re: QubesOS – A reasonably secure operating system

#14

Post by Izmaki »

aborsy wrote: post #8

Is QubesOS used in the security companies or community? I know it’s used in Mullvad, and recommended by Snowden (but he isn’t a security specialist). I have been playing with it, and it might work as a daily driver.

It's not often that the benefits QubesOS brings are what security companies (or the community) needs. If you do malware analysis, Windows VMs in isolation on a throw-away laptop is better. If you do penetration testing, Windows or regular Linux will be better, too. If you do extremely sensitive communication you're in a very niche group of people and chances are you're using a provided equipment by your superior (e.g., modified laptops).

Re: QubesOS – A reasonably secure operating system

#15

Post by frugalmail »

flashback2199 wrote: post #7

I really like QubesOS, but you cannot run VMs inside a qube, or other things that require VMs like Docker Desktop for Linux, because the xen hypervisor does not support nested virtualization.

Double whammy, because sadly you can't run it in a VM either. At least that's my experience.

Re: QubesOS – A reasonably secure operating system

#20

Post by legrande »

What kind of threat model requires someone to use Qubes? I know Snowden uses it and there's even a testimonial of him on the Qubes site recommending it. Is this for people on 'lists' or are high value targets because they visited the wrong site or said something the authorities didn't like and their machines are now being targeted?
Post reply on HN