Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Qubes OS: A reasonably secure operating system

qubes-os.org

Post reply on HN
Print view View original

101–110 of 118 posts

Re: Qubes OS: A reasonably secure operating system

#101

Post by rkagerer »

nullc wrote: post #100
rkagerer wrote: post #99

Earlier quoted context omitted.

- There’s generally no secure way to transfer data between physically separate computers running conventional OSes. - Malware which can bridge air gaps has existed for several years now and is becoming increasingly common. Floppy disks Hard disks used like floppies (especially plugged into a RAID controller with "auto run"-like features disabled) Audio modem Manual transcription via keyboard

I would personally have chalked that up as usability-- because there are facilities for secure file transfer between computers, but I get the argument. Particularly since the common tools like SCP give way too much access unless you go through special effort. > Floppy disks, Hard disks As you note there are 'auto run' like issues, also file systems are not historically very robust against against malicious data. Hard…

Was there ever a case in the wild of malware being installed into a host by inserting a floppy disk, without entailing the user boot off it, run a program from it, open a datafile crafted to exploit existing software, etc?

I always thought if you insert a floppy (with any OS autorun crap turned off of course), open a textfile to read, then take it out, you'd be pretty safe. (It's unfortunate the same can't be said of a USB drive).

Thanks, I missed RS-232.

Re: Qubes OS: A reasonably secure operating system

#102

Post by sureglymop »

fsflover wrote: post #89
irundebian wrote: post #3

Have used it for several months as my daily OS and dropped it because of bad graphics performance (only software rendering supported, many frame drops when watching HD videos on YT) and bad battery management. Due to software rendering the overall systems perfmance also dropped. So I cannot recommend it for people with high requirements on graphics and battery duration. Besides that it was an interesting and good exp…

> dropped it because of bad graphics performance (only software rendering supported This is by design, to provide high security, which is the point of Qubes. It's planned to allow GPU for chosen, trusted VMs: https://github.com/QubesOS/qubes-issues/issues/8552 Alternatively, you could perform a GPU passthrough, https://www.qubes-os.org/faq/#can-i-run-applications-like-ga...

Your link concerning GPU pass through only links to a google groups discussion with last activity in 2020 and 2015. So.. I guess this is not possible nor recommended?

I've been using vms with passed through gpu for a while and it's great but I would love to switch to qubes. I wish this was prioritized.

Re: Qubes OS: A reasonably secure operating system

#103

Post by sudohackthenews »

transpute wrote: post #9
sudohackthenews wrote: post #5

Earlier quoted context omitted.

AEM is a little sketchy though, you need to trust a flash drive to hold it, and make sure that drive doesn’t get overridden by a malicious attacker. Your link goes more into depth about the disadvantages

In some threat models, it's more feasible to protect a portable flash/SSD drive than an entire laptop. In other threat models, laptops/tablets/phones could be physically secured in a safe, or kept under direct physical supervision.

Yeah, that’s what I was alluding to. I think the OPs point still holds here- both of those are quite a bit harder than the built in Mac solution

Re: Qubes OS: A reasonably secure operating system

#104

Post by dmm »

josephcsible wrote: post #45
dmm wrote: post #42

Earlier quoted context omitted.

> dropped it because of bad graphics performance (only software rendering supported, many frame drops when watching HD videos on YT) Around Firefox 92 or 93 the new GPU-based renderer ported from Servo was made default and performance under Qubes became much worse. Unfortunately, it seems applications increasingly assume the presence of video acceleration and don't prioritize software rendering.

Isn't it reasonable for applications to assume that, now that virtually all hardware has it, even super-cheap computers like the Raspberry Pi?

It's totally reasonable, just unfortunate for this use-case.

Re: Qubes OS: A reasonably secure operating system

#105

Post by zamadatix »

fsflover wrote: post #96
zamadatix wrote: post #49

Earlier quoted context omitted.

The drivers are fine for GPU accelerated rendering of the app surfaces, even on the Pi. Hell, the drivers are even there >98% of the time for accelerated decode of the video format itself to boot. Qube's unique choice in software only rendering for user applications is one born out of the isolation goals for security, not what the software/drivers/hardware could do.

> even on the Pi Only proprietary ones, so not for everyone...

Pi 1-3 https://docs.mesa3d.org/drivers/vc4.html

Pi 4-5 https://docs.mesa3d.org/drivers/v3d.html

Re: Qubes OS: A reasonably secure operating system

#106

Post by adastra22 »

creole_wither wrote: post #95
adastra22 wrote: post #65

Earlier quoted context omitted.

The issue for Qubes is security. GPUs can be used to subvert basically all the otherwise hardware-enforced security protections.

In a desktop, couldn't you assign a GPU to one video machine and in that scenario would there still be a security problem when there is only one VM using it?

It’s not about virtual machines. GPUs typically have direct memory access to pretty much all system RAM. There exist PCIe mitigations, but the review does not meet up to Qubes security standards.

Re: Qubes OS: A reasonably secure operating system

#107

Post by fsflover »

sureglymop wrote: post #102
fsflover wrote: post #89

Earlier quoted context omitted.

> dropped it because of bad graphics performance (only software rendering supported This is by design, to provide high security, which is the point of Qubes. It's planned to allow GPU for chosen, trusted VMs: https://github.com/QubesOS/qubes-issues/issues/8552 Alternatively, you could perform a GPU passthrough, https://www.qubes-os.org/faq/#can-i-run-applications-like-ga...

Your link concerning GPU pass through only links to a google groups discussion with last activity in 2020 and 2015. So.. I guess this is not possible nor recommended? I've been using vms with passed through gpu for a while and it's great but I would love to switch to qubes. I wish this was prioritized.

It's possible and supported. Here are better links: https://forum.qubes-os.org/t/nvidia-gpu-passthrough-into-lin..., https://forum.qubes-os.org/t/create-a-gaming-hvm/19000

Re: Qubes OS: A reasonably secure operating system

#108

Post by sureglymop »

fsflover wrote: post #107
sureglymop wrote: post #102

Earlier quoted context omitted.

Your link concerning GPU pass through only links to a google groups discussion with last activity in 2020 and 2015. So.. I guess this is not possible nor recommended? I've been using vms with passed through gpu for a while and it's great but I would love to switch to qubes. I wish this was prioritized.

It's possible and supported. Here are better links: https://forum.qubes-os.org/t/nvidia-gpu-passthrough-into-lin... , https://forum.qubes-os.org/t/create-a-gaming-hvm/19000

Thank you! That looks more promising.

Re: Qubes OS: A reasonably secure operating system

#109

Post by fsflover »

zamadatix wrote: post #105
fsflover wrote: post #96

Earlier quoted context omitted.

> even on the Pi Only proprietary ones, so not for everyone...

Pi 1-3 https://docs.mesa3d.org/drivers/vc4.html Pi 4-5 https://docs.mesa3d.org/drivers/v3d.html

> Broadcom never released a public specification for the V3D 3.x or 4.x series.

So the support must be worse if you prefer free drivers?

Re: Qubes OS: A reasonably secure operating system

#110

Post by fsflover »

jwrallie wrote: post #35
irundebian wrote: post #3

Have used it for several months as my daily OS and dropped it because of bad graphics performance (only software rendering supported, many frame drops when watching HD videos on YT) and bad battery management. Due to software rendering the overall systems perfmance also dropped. So I cannot recommend it for people with high requirements on graphics and battery duration. Besides that it was an interesting and good exp…

I could tolerate no graphic acceleration and battery issues as part of the virtualization overhead, but I had issues with sleep (it would sleep and wake up perfectly only with when plugged in) and other related problems such as Windows VMs crashing when waking up from sleep. I was using it well at home but could not stand it when I travelled around with my laptop. I think Xen is mostly at fault for the issues, but I’…

> but I had issues with sleep

If you choose Community-recommended hardware (https://forum.qubes-os.org/t/community-recommended-computers...), sleep will work fine for you.

Post reply on HN