Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

QubesOS – A reasonably secure operating system

qubes-os.org

Post reply on HN
Print view View original

21–30 of 141 posts

Re: QubesOS – A reasonably secure operating system

#21

Post by beardog »

beardog wrote: post #13

I love Qubes a lot, I daily drove it for a few years and still have it on a laptop. but i would not recommend it even to most technical people, mainly because you forfeit the ability to run things on bare metal. "dom0" is the same as on normal xen - it is a VM and has the associated overhead still. On top of that, the official Qubes dom0 runs a very outdated fedora version. I am instead writing my own code to automat…

To add, it works quite well if you can accept the caveats of no (easy/default) GPU access (so no gaming). It is not a lot slower if you have enough ram to keep your VMs booted, i mainly noticed a difference in i/o speed but that may have been my particular setup.

You aren't meant to mess with dom0 (so also your desktop) much, so ricers won't like it unless they are willing to break the security model somewhat.

It is also not meant to be a shared PC.

Windows (10) support is pretty mediocre but it does work. I was able to do a WFH job that required windows using it without pain - you don't get seamless windows though.

Re: QubesOS – A reasonably secure operating system

#22

Post by legrande »

flashback2199 wrote: post #7

I really like QubesOS, but you cannot run VMs inside a qube, or other things that require VMs like Docker Desktop for Linux, because the xen hypervisor does not support nested virtualization.

> nested virtualization

Such abstraction is very unstable. You can always VNC into a machine from a browser though, so 'vmception' can be achieved.

Re: QubesOS – A reasonably secure operating system

#23

Post by neodypsis »

weinzierl wrote: post #5

I used it when I worked as a hiring manager. For this task it is ideal. All the behavioral security measures, like only to open attachments from people you trust, break down when your job description is basically to figure out who you can trust. Qubes comes with a "Convert to trusted PDF" out of the box. Joanna Rutkowska explained how it works under the hood pretty nicely[1]. The tldr is that it is very thorough. Wit…

You can use something similar on macOS, Windows or Linux, based on Docker containers, see Dangerzone: https://github.com/freedomofpress/dangerzone

Re: QubesOS – A reasonably secure operating system

#24

Post by beardog »

legrande wrote: post #20

What kind of threat model requires someone to use Qubes? I know Snowden uses it and there's even a testimonial of him on the Qubes site recommending it. Is this for people on 'lists' or are high value targets because they visited the wrong site or said something the authorities didn't like and their machines are now being targeted?

Honestly you don't need to be super paranoid to benefit from Qubes. Windows and Linux default sandboxing is still pretty mediocre at best, people can't be perfect with security all the time and sometimes even legit programs get compromised, so the sandboxing security model helps contain the damage.

That said you can still setup sandboxing without Qubes.

Re: QubesOS – A reasonably secure operating system

#25

Post by KingMachiavelli »

QubesOS is very cool but I've always thought it'd cool/better if it was a patchset or repo on top of an existing distro like Archlinux or NixOS. I think that would be useful so you could adopt features from QubesOS individually and swap out different components. For example, it'd be nice to use KVM (QEMU or even crosvm) instead of Xen or build a Wayland based system instead of X11.

Re: QubesOS – A reasonably secure operating system

#26

Post by Syonyk »

barbariangrunge wrote: post #12

Anybody here actually use it day to day? Or is this more of a server OS?

Yeah. I started playing with it about 2 years ago, and I now caution people that "it's really a bit virus-like." It went from being on one "play" computer to being my daily driver OS on 4 machines in that time.

It's fine. You just have to be willing to operate on a "If I can't do it, then I must not need to do it" sort of basis with things like media. But that's no real problem for me, I hate video anyway.

Re: QubesOS – A reasonably secure operating system

#27

Post by coppsilgold »

KingMachiavelli wrote: post #25

QubesOS is very cool but I've always thought it'd cool/better if it was a patchset or repo on top of an existing distro like Archlinux or NixOS. I think that would be useful so you could adopt features from QubesOS individually and swap out different components. For example, it'd be nice to use KVM (QEMU or even crosvm) instead of Xen or build a Wayland based system instead of X11.

There is actually a project which aims to do that: https://spectrum-os.org>

Unrelated to QubesOS.

Re: QubesOS – A reasonably secure operating system

#28

Post by fsflover »

legrande wrote: post #20

What kind of threat model requires someone to use Qubes? I know Snowden uses it and there's even a testimonial of him on the Qubes site recommending it. Is this for people on 'lists' or are high value targets because they visited the wrong site or said something the authorities didn't like and their machines are now being targeted?

I would say, almost anyone running anything untrusted from time to time can benefit from the strong hardware virtualization.

Qubes is my daily driver by the way. My attempt of explaining it to a layman: https://forum.qubes-os.org/t/how-to-pitch-qubes-os/4499/15

Re: QubesOS – A reasonably secure operating system

#29

Post by Levitating »

KingMachiavelli wrote: post #25

QubesOS is very cool but I've always thought it'd cool/better if it was a patchset or repo on top of an existing distro like Archlinux or NixOS. I think that would be useful so you could adopt features from QubesOS individually and swap out different components. For example, it'd be nice to use KVM (QEMU or even crosvm) instead of Xen or build a Wayland based system instead of X11.

I guess adding more variation to QubesOS systems would make it less secure as there is more room for bugs.

Re: QubesOS – A reasonably secure operating system

#30

Post by DeathArrow »

>Qubes OS is a free and open-source, security-oriented operating system for single-user desktop computing. Qubes OS leverages Xen-based virtualization to allow for the creation and management of isolated compartments called qubes.

What's wrong with containers? They are supposed to provide better performance than VMs. Are containers less secure?

Post reply on HN