Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Operating System That Can Protect You Even if You Get Hacked

micahflee.com

Post reply on HN
Print view View original

41–50 of 53 posts

Re: The Operating System That Can Protect You Even if You Get Hacked

#41

Post by jacquesm »

rdl wrote: post #12

I love Qubes; the people involved are awesome. What I'd really like to work on is Compartment Mode Workstation with physically distinct hardware. Essentially, a "windowing KVM" frontend to a bunch of physically separated processor/memory subsystems, connected via well-defined networking interfaces. Essentially X Windows, but actually secure. This is sort of how desktop virtualization (VDI) works today, but with a sep…

Weird thought: that raspi module sells for $30 in quantity, you could easily run one process on that, and use the gpio pins to communicate with a host. One user visible process, one subsystem.

It would be reasonably affordable.

Upper limits on the number of processes you could run would be dictated by how many modules you plug in, you could make a backplane like model where you daisychain multiple backplanes for more processes.

Re: The Operating System That Can Protect You Even if You Get Hacked

#42

Post by uuid_to_string »

kyboren wrote: post #39
uuid_to_string wrote: post #15

Love the comment by "z". :) The people working on this are sharp, for sure. But I will never think of VM's as a path to "security". Xen is useful for a variety of purposes (including resiliency, which can help if you are hacked), but I'll never rely on it for "security". Curious what bootloader they are using for the Xen kernels.

GRUB2, and optionally tboot for "anti evil-maid" ( http://theinvisiblethings.blogspot.com/2011/09/anti-evil-mai... ).

Can the user use their own choice of bootloader (besides those two)?

The bootloader I use can boot Xen kernels; no need for GRUB2. Is the Qube boot process described somewhere?

Re: The Operating System That Can Protect You Even if You Get Hacked

#43

Post by kyboren »

throwaway7767 wrote: post #40
kyboren wrote: post #38

Earlier quoted context omitted.

I've been using Qubes every day for well over a year now, and I know enough about the architecture to dispel a few of these assumptions. 1. By default, there is no need for an attacker to find a local exploit to get root--the user account has unrestricted password-less sudo authorization. This is one of the things I disagree with the developers about. 2. SELinux is disabled in AppVMs by default. 3. The GUI virtualiza…

> 1. By default, there is no need for an attacker to find a local exploit to get root--the user account has unrestricted password-less sudo authorization. This is one of the things I disagree with the developers about. I've been using qubes for a little while myself. I agree that it should be harder to go from domU user to domU root. However I think having to manage passwords for every AppVM also negates a lot of the…

That's a neat idea; I'd like to have that. Please really consider contributing some code, or at least an initial proposal on the qubes-devel list :).

Re: The Operating System That Can Protect You Even if You Get Hacked

#44

Post by kyboren »

uuid_to_string wrote: post #42
kyboren wrote: post #39

Earlier quoted context omitted.

GRUB2, and optionally tboot for "anti evil-maid" ( http://theinvisiblethings.blogspot.com/2011/09/anti-evil-mai... ).

Can the user use their own choice of bootloader (besides those two)? The bootloader I use can boot Xen kernels; no need for GRUB2. Is the Qube boot process described somewhere?

I don't see why not in theory, but in practice GRUB2 is the only available option out-of-the-box. I'm curious why you're so interested in this, though. Care to explain your ostensible desire for an alternative bootloader?

Re: The Operating System That Can Protect You Even if You Get Hacked

#45

Post by progman »

hershel wrote: post #26
muyuu wrote: post #23

"You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes." Theo de Raadt, 2007

The idea behind qubes is to use the security properties of virtualization layers to enable a secure , easy to use system. Given that virtualization layers are relatively small ,code wise ,that's a good place to start. Given that amazon uses xen in the EC2 platform(as many others), we're not only talking only about "worldwide collection of software engineers " but also of some serious commercial interests in it's secu…

> does intel cooperate with NSA?

Intel and NSA are not the problem. The real problem are hackers who want to steal our bank accounts, or the commercial providers who want to have all our private data to sell it secretely. For such daily problems I consider Qubes a very good protection. It's very nice to be able to do banking or web browsing in isolated VMs. It's also nice to have insecure OS like Windows run almost securely in a VM.

Re: The Operating System That Can Protect You Even if You Get Hacked

#46

Post by [deleted] »

kyboren wrote: post #43
throwaway7767 wrote: post #40

Earlier quoted context omitted.

> 1. By default, there is no need for an attacker to find a local exploit to get root--the user account has unrestricted password-less sudo authorization. This is one of the things I disagree with the developers about. I've been using qubes for a little while myself. I agree that it should be harder to go from domU user to domU root. However I think having to manage passwords for every AppVM also negates a lot of the…

That's a neat idea; I'd like to have that. Please really consider contributing some code, or at least an initial proposal on the qubes-devel list :).

[deleted]

Re: The Operating System That Can Protect You Even if You Get Hacked

#47

Post by uuid_to_string »

kyboren wrote: post #44
uuid_to_string wrote: post #42

Earlier quoted context omitted.

Can the user use their own choice of bootloader (besides those two)? The bootloader I use can boot Xen kernels; no need for GRUB2. Is the Qube boot process described somewhere?

I don't see why not in theory, but in practice GRUB2 is the only available option out-of-the-box. I'm curious why you're so interested in this, though. Care to explain your ostensible desire for an alternative bootloader?

I just like the one I have been using.

I understand it reasonably well and am hesitant to switch.

I have tried others and have not been impressed.

I am a connoiseur of bootloaders I guess.

It's an important program, maybe the most important one.

Based on my limited knowledge of other computer users, I believe we all have what we consider a "trusted" program that does some task for us over and over again. We come to rely on it and appreciate it (for our own idiosyncratic reasons). We are hesitant to switch to something else.

For me, that program is my bootloader.

Re: The Operating System That Can Protect You Even if You Get Hacked

#48

Post by Rusky »

comex wrote: post #13

> If a Pidgin-zero-day-wielding attacker sends you a weird-looking message that takes over your computer, all it will actually take over is your Pidgin AppVM. The worst that the attacker can do is steal your OTR keys and spy on your chat conversations Yes, the only thing the attacker can do is compromise all of your chat conversations and impersonate you on an ongoing basis. Maybe you keep a separate browser VM for s…

Also good would be taking better advantage of hardware protection, kernel api design, and app permissions, so that even when something is compromised it can't just start poking around doing whatever it wants.

Re: The Operating System That Can Protect You Even if You Get Hacked

#49

Post by MichaelGG »

ComputerGuru wrote: post #28
MichaelGG wrote: post #18

I've recently switched to using VMWare for everything, and disabling networking on the host (use a pfSense VM for networking). It's quite handy, but still feels a bit heavyweight. Of course, I'm sort of forced to run Windows as the host to ensure best driver/battery support. I really hope these approaches like Qubes take off and that things get optimized for this type of workload. I'm not sure why Microsoft has ignor…

That sounds great, but how many other virtual machines are you using, what is your heuristic for deciding what task is run in which virtual machine, and how strict are you about which sensitive data is used on multiple VMs? (note: genuinely curious. I've gone down this route before myself before realizing there was simply too much overlap between my "sensitive" and "normal" work. I still employ similar configurations…

Right now, just games/junk browsing, home (personal email, browsing, projects), work (per customer). On Windows I use Sandboxie to further isolate things like browsers.

It's not perfect, but at least when a client wants me to run some damn .exe to join their oh-so-great screen-sharing platform, my home environment isn't messed up. And I can run random games or utilities and quickly revert to a snapshot.

The most sensitive keys stay in the host partition.

Re: The Operating System That Can Protect You Even if You Get Hacked

#50

Post by sept »

uuid_to_string wrote: post #47
kyboren wrote: post #44

Earlier quoted context omitted.

I don't see why not in theory, but in practice GRUB2 is the only available option out-of-the-box. I'm curious why you're so interested in this, though. Care to explain your ostensible desire for an alternative bootloader?

I just like the one I have been using. I understand it reasonably well and am hesitant to switch. I have tried others and have not been impressed. I am a connoiseur of bootloaders I guess. It's an important program, maybe the most important one. Based on my limited knowledge of other computer users, I believe we all have what we consider a "trusted" program that does some task for us over and over again. We come to r…

Could you share the name of your trusted, Xen-aware bootloader? Is it something other than syslinux or uboot (ARM)?
Post reply on HN