QubesOS – A reasonably secure operating system • Hacker News Board

Re: QubesOS – A reasonably secure operating system

#31

Post by Syonyk » Tue, Jul 11, 2023, 7:21 PM UTC

sigmonsays wrote: post #2

this is my next OS to experiment with. However i'm worried my toy laptop with 16gb of ram (thinkpad t480) wont cut it. Anyone want to chime in here?

It's fine for light to moderate use, just don't expect to run a ton of AppVMs at once.

I've got an X250 (2C/4T) 16GB gutless wonder as my Qubes laptop, and it's fine. Qubes has memory balancing/clawback from VMs, so you can in practice have more AppVMs open than you'd expect - they'll be using less RAM, but it works.

If you're on a short-RAM laptop, though, definitely reduce Dom0's memory allocation. It defaults to 4GB, and you're perfectly fine with 2GB or perhaps even 1GB - there's not much going on in it, and that RAM is better used for AppVMs.

If you're short on cores, you might also look at the "sched-gran=core" flag to Xen. This allows hyperthreading, but ensures that hyperthreads are only ever scheduled in the same VM (and as the threat model assumes "anything in a VM can read anything else in a VM," a hyperthread-based leak doesn't gain an attacker any access you wouldn't otherwise have). The performance gains on a laptop can be noticeable.

Don't expect great battery life, though. Xen's power management is "present and accounted for," at best. There's also an incantation to disable turbo that helps a lot when mobile.

Re: QubesOS – A reasonably secure operating system

#32

Post by thoughtbag » Tue, Jul 11, 2023, 7:23 PM UTC

legrande wrote: post #20

What kind of threat model requires someone to use Qubes? I know Snowden uses it and there's even a testimonial of him on the Qubes site recommending it. Is this for people on 'lists' or are high value targets because they visited the wrong site or said something the authorities didn't like and their machines are now being targeted?

I know what Theo says about (x86) virtualization[1], but I think it's still useful to virtually separate your random browsing the web from things like health and banking, or where you keep your ssh keys (if you don't use a Yubikey or similar to keep it off your laptop) -- or other secrets.

You can be a victim of a random drive-by, you don't have to be a person on a "list".

[1] https://marc.info/?l=openbsd-misc&m=119318909016582

Re: QubesOS – A reasonably secure operating system

#33

Post by vorpalhex » Tue, Jul 11, 2023, 7:24 PM UTC

DeathArrow wrote: post #30

>Qubes OS is a free and open-source, security-oriented operating system for single-user desktop computing. Qubes OS leverages Xen-based virtualization to allow for the creation and management of isolated compartments called qubes. What's wrong with containers? They are supposed to provide better performance than VMs. Are containers less secure?

Yes.

Containers generally assume a non-hostile workload and don't make assurances about certain kinds of tampering.

Re: QubesOS – A reasonably secure operating system

#34

Post by weinzierl » Tue, Jul 11, 2023, 7:24 PM UTC

legrande wrote: post #20

What kind of threat model requires someone to use Qubes? I know Snowden uses it and there's even a testimonial of him on the Qubes site recommending it. Is this for people on 'lists' or are high value targets because they visited the wrong site or said something the authorities didn't like and their machines are now being targeted?

I used it for sifting through job applications (see my other comment).

I think it was worth it because even though we were a small boring company we received a fair share of drag-net style malware via the application channels.

Some of the attempts were pretty good also. I used to joke that the bad guys tailor their cover letters better than most real applicants. Which of course is a bit of a hyperbole, but there is a kernel of truth. It's not too hard to write a believable application letter that fits the archetypal IT position. Similar to not all fishing mails being full of spelling errors malicious application letters aren't either.

I don't know if we ever received a targeted attack, but I wouldn't know. I think bigger companies certainly will and I can only consider every HR department a high risk area.

Re: QubesOS – A reasonably secure operating system

#35

Post by [deleted] » Tue, Jul 11, 2023, 7:24 PM UTC

DeathArrow wrote: post #30

>Qubes OS is a free and open-source, security-oriented operating system for single-user desktop computing. Qubes OS leverages Xen-based virtualization to allow for the creation and management of isolated compartments called qubes. What's wrong with containers? They are supposed to provide better performance than VMs. Are containers less secure?

[deleted]

Re: QubesOS – A reasonably secure operating system

#36

Post by hiatus » Tue, Jul 11, 2023, 7:24 PM UTC

DeathArrow wrote: post #30

>Qubes OS is a free and open-source, security-oriented operating system for single-user desktop computing. Qubes OS leverages Xen-based virtualization to allow for the creation and management of isolated compartments called qubes. What's wrong with containers? They are supposed to provide better performance than VMs. Are containers less secure?

Containers rely on the security of the operating system. If you can compromise the system you can potentially compromise your neighbors. VMs rely on the security of the hypervisor.

Re: QubesOS – A reasonably secure operating system

#37

Post by ghgr » Tue, Jul 11, 2023, 7:24 PM UTC

I highly recommend it. Since I tried it a couple of years ago I can't imagine working without it. Examples of things that I can't imagine doing in any other system:

  - curl|bash or similar 
  - pip install, npm install etc
  - run any random github project
  - sudo install the drivers of my Brother printer
  - install zoom
  - plug random cheap USB devices to eg update their firmware

In addition to that you can easily restart frozen VMs without restarting the whole system, keep backups of your VMs (very handy when restoring or changing PCs), reinstall some VMs if you mess up, etc.

Not suitable is for GPU intensive work, though (although if you have a dedicated GPU in theory you can assign it to a VM).

Re: QubesOS – A reasonably secure operating system

#38

Post by ahmedalsudani » Tue, Jul 11, 2023, 7:25 PM UTC

DeathArrow wrote: post #30

>Qubes OS is a free and open-source, security-oriented operating system for single-user desktop computing. Qubes OS leverages Xen-based virtualization to allow for the creation and management of isolated compartments called qubes. What's wrong with containers? They are supposed to provide better performance than VMs. Are containers less secure?

Yes, they are less secure. VMs can rely on HW features to ensure memory isolation.

Re: QubesOS – A reasonably secure operating system

#39

Post by tssge » Tue, Jul 11, 2023, 7:25 PM UTC

DeathArrow wrote: post #30

>Qubes OS is a free and open-source, security-oriented operating system for single-user desktop computing. Qubes OS leverages Xen-based virtualization to allow for the creation and management of isolated compartments called qubes. What's wrong with containers? They are supposed to provide better performance than VMs. Are containers less secure?

Containers share the host kernel, thus the attack surface is as large as the kernel functionality that is exported to the container by the host (usually almost all syscalls).

In VMs as far as I know the attack surface is much smaller as the interaction between the guest and host kernel is limited.

Re: QubesOS – A reasonably secure operating system

#40

Post by Syonyk » Tue, Jul 11, 2023, 7:25 PM UTC

DeathArrow wrote: post #30

>Qubes OS is a free and open-source, security-oriented operating system for single-user desktop computing. Qubes OS leverages Xen-based virtualization to allow for the creation and management of isolated compartments called qubes. What's wrong with containers? They are supposed to provide better performance than VMs. Are containers less secure?

Containers rely on the kernel to enforce separation. They're great for keeping trusted workloads from interfering with each other, but I don't trust them for potentially hostile workload separation.

If you can compromise the kernel (and kernel exploits aren't particularly expensive nor uncommon), then a container is like a door locked by a sign that says "Please do not open without permission." If you don't care to go through it, you won't. And if you want to get through it, it doesn't stop you. Once you're in the kernel, containers don't offer any meaningful separation.

Qubes uses hardware virtualization with a fairly stripped down Xen to provide the isolation, and that's a somewhat harder lock to crack open if you want to transit between silos.