The Operating System That Can Protect You Even if You Get Hacked • Hacker News Board

Re: The Operating System That Can Protect You Even if You Get Hacked

#51

Post by zurn » Tue, Apr 15, 2014, 7:09 AM UTC

throwaway7767 wrote: post #33

zurn wrote: post #7

Earlier quoted context omitted.

How is the isolation in Xen better than Chrome sandboxes - do you mean the attack surface is smaller, the code quality better, or the task somehow inherently simpler/easier? From where I sit, vulnerabilities in virtualization have seen less public scrutiny than the Chrome sandbox. Eg none of the hypervisor vendors have a bug bounty program, which would be at least some kind of signal.

The attack surface of a paravirtualized Xen VM to its hypervisor is much smaller than a linux application talking to the linux kernel. Of course it's not perfect, but xen has a pretty good track record. And a significant chunk of the flaws that have been found xen were found by the qubes devs.

The Chrome sandbox setup doesn't correspond to a regular linux application talking to the kernel though. It has a 2-layer sandbox, with the seccomp-bpf and setuid sandboxes. They restrict the kernel interface to a whitelisted subset.

Re: The Operating System That Can Protect You Even if You Get Hacked

#52

Post by uuid_to_string » Tue, Apr 15, 2014, 2:10 PM UTC

sept wrote: post #50

uuid_to_string wrote: post #47

Earlier quoted context omitted.

I just like the one I have been using. I understand it reasonably well and am hesitant to switch. I have tried others and have not been impressed. I am a connoiseur of bootloaders I guess. It's an important program, maybe the most important one. Based on my limited knowledge of other computer users, I believe we all have what we consider a "trusted" program that does some task for us over and over again. We come to r…

Could you share the name of your trusted, Xen-aware bootloader? Is it something other than syslinux or uboot (ARM)?

For x86, it is something other than those two.

Re: The Operating System That Can Protect You Even if You Get Hacked

#53

Post by cyphunk » Wed, Apr 16, 2014, 12:22 AM UTC

72deluxe wrote: post #25

cyphunk wrote: post #24

If someone is wondering, Qubes (and all Linux based distros) are not Macbook friendly [1]. But honestly, if security or privacy are a priority for you then you are probably not using a Macbook anyway. [1]: https://groups.google.com/forum/#!topic/qubes-devel/uLDYGdKk...

Why would you not be using a Macbook if you want security or privacy? If you are referring to Mac OSX and its integrations with App Stores and social media systems, note that it is entirely optional (I don't use any of the social media guff bundled into the OS). Unless you are referring to something else and think that buying a piece of hardware somehow means you don't care about privacy, regardless of which software…

If security and privacy are of absolute priority to you (journalist, activist) then using a OS with closed source essentials is absolutely absurd.

If security and privacy are of some importance to you then using a OS with closed source essentials due to ease of use or development environment only increases the number of years until a strong privacy easy to use OSS system gets rolled out more widely. Your actions have broader impact than just your priorities.

Finally, there is more than just the software. Getting closer to the metal you have to contemplate bootloaders trust and verifiability.