121–130 of 141 posts
Don’t forget that, the VMs in Qubes should still be secure. Running ChromeOS Flex (or Android?) or kicksecure is good. Whonix is good too, but it seems it’s for privacy.
Earlier quoted context omitted.
>You still have to get through Xen to get to anything I consider of value. It's not unthinkable, as Xen is huge, at hundreds of kLoCs. But there's an effort[0] to make a Qubes that uses seL4 in place of Xen. 0. https://trustworthy.systems/projects/TS/makatea
Most of Xen's vulnerabilities do not affect Qubes OS: https://www.qubes-os.org/security/xsa/ .
But it's bad enough if any do. (some do affect Qubes)
It is an architectural problem.
SeL4 is a good replacement, with excellent performance and strong formal proofs.
How is this different than an immutable distro like Fedora Silverblue?
Daily drove qubes for 5.5 years. I liked it a lot.
Related. Others? Qubes OS 4.2-rc1 is available for testing - https://news.ycombinator.com/item?id=36178205 - June 2023 (3 comments) New user guide: How to organize your qubes - https://news.ycombinator.com/item?id=33396604 - Oct 2022 (15 comments) What Is Qubes OS? - https://news.ycombinator.com/item?id=32036899 - July 2022 (82 comments) Qubes OS: A reasonably secure operating system - https://news.ycombinator.com/it…
Earlier quoted context omitted.
Most of Xen's vulnerabilities do not affect Qubes OS: https://www.qubes-os.org/security/xsa/ .
Most vulnerabilities of anything do not affect all its users. But it's bad enough if any do. (some do affect Qubes) It is an architectural problem. SeL4 is a good replacement, with excellent performance and strong formal proofs.
I use Qubes because of one exact feature: single Desktop Environment for windows from different Virtual Machines. And AFAIK there are no alternatives. Use it for work, development, personal tasks for about 2 years so far. But it has many restrictions, e.g. gaming is problematic because of this single "main" desktop and trucking cursors bug, recording screen when there are several monitors is bugging and problematic,…
Also remote desktop cannot be done at least by usual means. And this is big No if you need to work remotely sometimes.
QubesOS does a lot of good things, but Secure Boot is sort of a nonnegotiable for a lot of security profiles because its one of the few ways you protect boot.
I'd be interested to hear from someone more in the know why they haven't implemented it yet.
I love Qubes a lot, I daily drove it for a few years and still have it on a laptop. but i would not recommend it even to most technical people, mainly because you forfeit the ability to run things on bare metal. "dom0" is the same as on normal xen - it is a VM and has the associated overhead still. On top of that, the official Qubes dom0 runs a very outdated fedora version. I am instead writing my own code to automat…
What do you personally want to run on bare metal? I've been using Qubes for 7 years and the only thing I've missed is running MAME since Qubes doesn't do nested virtualization. But I do everything else I need on there - software dev, office productivity, web browsing, email, video transcoding, Spotify etc etc. It's rare I would ever need bare metal. (I'm not a PC gamer though...)
I love Qubes a lot, I daily drove it for a few years and still have it on a laptop. but i would not recommend it even to most technical people, mainly because you forfeit the ability to run things on bare metal. "dom0" is the same as on normal xen - it is a VM and has the associated overhead still. On top of that, the official Qubes dom0 runs a very outdated fedora version. I am instead writing my own code to automat…
> the official Qubes dom0 runs a very outdated fedora version Why does it matter? You do not run anything in dom0: https://www.qubes-os.org/doc/supported-releases/#note-on-dom...