i'm not sure i'd feel comfortable with the webcam streaming as people visit :P
The Operating System That Can Protect You Even if You Get Hacked
21–30 of 53 posts
Re: The Operating System That Can Protect You Even if You Get Hacked
#22If this was to catch on, would the NSA (assuming they don't already) throw more resources at building viruses that attack the CPU directly - intercepting any of the instructions sent by the VMs?
Those that gave this negative points, care to share why?
Re: The Operating System That Can Protect You Even if You Get Hacked
#23"You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes."
Theo de Raadt, 2007
Re: The Operating System That Can Protect You Even if You Get Hacked
#24If someone is wondering, Qubes (and all Linux based distros) are not Macbook friendly [1]. But honestly, if security or privacy are a priority for you then you are probably not using a Macbook anyway.
[1]: https://groups.google.com/forum/#!topic/qubes-devel/uLDYGdKk...
Re: The Operating System That Can Protect You Even if You Get Hacked
#25If someone is wondering, Qubes (and all Linux based distros) are not Macbook friendly [1]. But honestly, if security or privacy are a priority for you then you are probably not using a Macbook anyway. [1]: https://groups.google.com/forum/#!topic/qubes-devel/uLDYGdKk...
Why would you not be using a Macbook if you want security or privacy?
If you are referring to Mac OSX and its integrations with App Stores and social media systems, note that it is entirely optional (I don't use any of the social media guff bundled into the OS).
Unless you are referring to something else and think that buying a piece of hardware somehow means you don't care about privacy, regardless of which software you are running on that piece of hardware?
I don't think the piece of hardware is relevant?
Re: The Operating System That Can Protect You Even if You Get Hacked
#26"You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes." Theo de Raadt, 2007
The idea behind qubes is to use the security properties of virtualization layers to enable a secure , easy to use system. Given that virtualization layers are relatively small ,code wise ,that's a good place to start.
Given that amazon uses xen in the EC2 platform(as many others), we're not only talking only about "worldwide collection of software engineers " but also of some serious commercial interests in it's security.
And XEN might not be the end point of that approach. There has been some research on formally verified hypervisors.While it's not 100% foolproof since you still have to depend on hardware security, which is a unknown(does intel cooperate with NSA?), that could give great assurances for system security.
Re: The Operating System That Can Protect You Even if You Get Hacked
#27"You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes." Theo de Raadt, 2007
The idea behind qubes is to use the security properties of virtualization layers to enable a secure , easy to use system. Given that virtualization layers are relatively small ,code wise ,that's a good place to start. Given that amazon uses xen in the EC2 platform(as many others), we're not only talking only about "worldwide collection of software engineers " but also of some serious commercial interests in it's secu…
xen is over 100k lines of code, not counting the kind of interfaces software exposes using its APIs, and stuff like drivers.
its not small
Re: The Operating System That Can Protect You Even if You Get Hacked
#28I've recently switched to using VMWare for everything, and disabling networking on the host (use a pfSense VM for networking). It's quite handy, but still feels a bit heavyweight. Of course, I'm sort of forced to run Windows as the host to ensure best driver/battery support. I really hope these approaches like Qubes take off and that things get optimized for this type of workload. I'm not sure why Microsoft has ignor…
That sounds great, but how many other virtual machines are you using, what is your heuristic for deciding what task is run in which virtual machine, and how strict are you about which sensitive data is used on multiple VMs?
(note: genuinely curious. I've gone down this route before myself before realizing there was simply too much overlap between my "sensitive" and "normal" work. I still employ similar configurations but for protection against data corruption, ease of system administration, and R&D purposes only.)
Re: The Operating System That Can Protect You Even if You Get Hacked
#29Earlier quoted context omitted.
The idea behind qubes is to use the security properties of virtualization layers to enable a secure , easy to use system. Given that virtualization layers are relatively small ,code wise ,that's a good place to start. Given that amazon uses xen in the EC2 platform(as many others), we're not only talking only about "worldwide collection of software engineers " but also of some serious commercial interests in it's secu…
xen is over 100k lines of code, not counting the kind of interfaces software exposes using its APIs, and stuff like drivers. its not small
You don't need to review all that code. From the qubes architecture document:
"it is possible to move all the drivers and driver backends out of Dom0. The same is true for moving the IO Device Emulator (ioemu) out of Dom0."
Re: The Operating System That Can Protect You Even if You Get Hacked
#30"You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes." Theo de Raadt, 2007
I agree. Formal methods is the best technology I know of that has a hope of eliminating a large class of security vunerabilities. Projects like seL4 have a lot of promise: small, formally verified kernels or virtualization layers that provide separation and provable security guarantees.