Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Qubes OS: A reasonably secure operating system

qubes-os.org

Post reply on HN
Print view View original

71–80 of 118 posts

Re: Qubes OS: A reasonably secure operating system

#71

Post by orbital-decay »

jwrallie wrote: post #37
Etherdrake wrote: post #31

Earlier quoted context omitted.

QubesOS is best enjoyed with a hefty CPU, lots of SSD space and a multi-screen set-up (in my opinion). Have you tried using Freetube instead of Youtube? In my experience it works a little better.

The most annoying issue I had was that even using mpv would lead to audio samples being dropped. I think I fixed it eventually by increasing buffer sizes, but I would expect at least audio should work out of the box.

>at least audio

I imagine audio and other realtime loads having problems the most on a heavily virtualized system like this.

Re: Qubes OS: A reasonably secure operating system

#72

Post by psd1 »

Dalewyn wrote: post #54
crest wrote: post #38

Earlier quoted context omitted.

You have to do more than just decode the the video stream to display it as smoothly playing video without dropping frames or audio samples or loosing sync. It requires always scheduling the context switches correctly between different virtual machines when using Qubes OS, performing multiple copies across protection domains. Brute force helps a lot, but do you want a ≥5GHz multi-core CPU burning 150W just to watch a…

>do you want a ≥5GHz multi-core CPU burning 150W just to watch a single video stream with maximum paranoia settings? I mean, yes? We're not talking about bloat here, you're deliberately imposing significant overhead load for a specific purpose. You can't really subsequently complain about performance unless you bring sufficiently powerful hardware to compensate for that overhead.

Right, but in a discussion about Qubes, it's germane to explain why you stopped using it

Re: Qubes OS: A reasonably secure operating system

#73

Post by irundebian »

Dalewyn wrote: post #25
irundebian wrote: post #3

Have used it for several months as my daily OS and dropped it because of bad graphics performance (only software rendering supported, many frame drops when watching HD videos on YT) and bad battery management. Due to software rendering the overall systems perfmance also dropped. So I cannot recommend it for people with high requirements on graphics and battery duration. Besides that it was an interesting and good exp…

>bad graphics performance (only software rendering supported, many frame drops when watching HD videos on YT) It might help if you used a computer with CPU horsepower that actually exists. And in case this sounded facetious, any reasonable CPU from the past 15 years can handle software decoding of high resolution video just fine. This all said however, if you do actually need full use of all hardware resources then b…

I'm using an Intel i7-8850H with 6 cores so I think it's powerful enough. It's not that I couldn't watch HD videos but I was experiencing stutters and it left me with the feeling that the CPU is insufficiently utilised.

Re: Qubes OS: A reasonably secure operating system

#74

Post by irundebian »

Dalewyn wrote: post #67
kllrnohj wrote: post #58

Earlier quoted context omitted.

> any reasonable CPU from the past 15 years can handle software decoding of high resolution video just fine. 4k VP9 from youtube takes my 5950x around 20-25% CPU usage to handle with hardware acceleration disabled. The fastest consumer CPU available 15 years ago could not handle that. Hell, even CPUs from 10 years ago couldn't do that. Add power & thermal limitations of a laptop CPU? Not a chance. And that's just VP9…

>4k To be pedantic, OP specified "HD" which is 720p. I gave him benefit of the doubt by saying "high resolution" in my reply, but I think 4K is unreasonable given the provided context. I'd wager 1080p ("Full HD") at most. There's also the question of frame rate, though we can probably safely assume either 29.976 or 59.952 fps since it's Youtube. As an aside, software decoding performance can vary pretty significantly…

Correction: I think I experienced noticeable stutters with Full HD videos not with HD videos.

Re: Qubes OS: A reasonably secure operating system

#75

Post by pgaddict »

jwrallie wrote: post #53
dmm wrote: post #43

Earlier quoted context omitted.

Does sleep and wake work for you with a standard Linux distro? If so a newer kernel might help,like the kernel-latest-qubes-vm package, might help: https://www.qubes-os.org/doc/managing-vm-kernels/#installing...

Yes, it works perfectly. It’s a Thinkpad X260, not exactly new hardware, and even Debian works just fine.

Weird. Multiple people submitted HCL for X260, and not a single one mentions issues with sleep.

https://www.qubes-os.org/hcl/

When I had similar issues in the past, I posted a question either to the mailing list or forum, and people were helpful.

Re: Qubes OS: A reasonably secure operating system

#76

Post by mikewarot »

Since it doesn't look like Genode is going to be ready to be a daily driver for a while, Qubes looks like something ALMOST capabilities based that I could live with. Some day I'll just be able to run stuff without worry.... but it's not going to be any time soon.

Can I run old versions of stuff like MS-DOS or Windows 3.1 under it? Or my beloved Windows 2000? Windows 2000 with Office 2000 pro (with the patches to read the new office 2007 formats) would be awesome. I miss outliner mode in Word 2000.

Re: Qubes OS: A reasonably secure operating system

#77

Post by irundebian »

pgaddict wrote: post #52

I'm using Qubes OS as my primary for years - I think I started with the 2.0 release in 2014 (I might have tried/used the 1.0 release, I don't recall.) and I was immediately hooked. I understand the usual story is that the goal is security benefits, and the compartmentalization (or rather the implied inconvenience) is the price for that. But for me the compartmentalization turned out to be a benefit on it's own, and a…

> scrolling web pages with large images is laggy

Now that I've read this, I can also remember that I was also annoyed by jerks when scrolling web pages.

I also found the backup management too complicated. I didn't want to back up entire VMs, just the data within the VMs. In principle, I would have had to start up all VMs for backups and run a backup script for each individual VM.

Re: Qubes OS: A reasonably secure operating system

#78

Post by pgaddict »

orbital-decay wrote: post #71
jwrallie wrote: post #37

Earlier quoted context omitted.

The most annoying issue I had was that even using mpv would lead to audio samples being dropped. I think I fixed it eventually by increasing buffer sizes, but I would expect at least audio should work out of the box.

>at least audio I imagine audio and other realtime loads having problems the most on a heavily virtualized system like this.

Not sure what "mpv" means in this context, but this reminds me the one actual pet peeve I have with Qubes - video/audio calls just don't work for me. It either doesn't work or the audio quality is really poor. I've tried all kinds of stuff, without much success. I'm using phone/tablet as a fallback, but it's not very convenient.

Re: Qubes OS: A reasonably secure operating system

#79

Post by irundebian »

tasn wrote: post #50

I've always wanted to switch to qubes, but it just feels so constraining. It's safer to never leave the house, but I don't want to live in a self imposed prison. On the other hand, the isolation provided by containers and flatpak is more accessible, but with a much larger attack vector. Maybe we need immutable OS + an audit layer on anything that could allow exploits to persist (bashrc and the likes).

After Qubes OS I ended up using Fedora with Wayland, Flatpaks and running applications as different users but this introduced other problems.

The security profiles of many "flatpacked" applications are quite permissive (see https://flatkill.org/) so that they could be circumvented. Besides that I'm experience some convenience issues when accessing files on my drive. It's especially annoying when using "flatpacked" office such as onlyoffice.

Re: Qubes OS: A reasonably secure operating system

#80

Post by i_love_retros »

dijit wrote: post #68
udev4096 wrote: post #60

We wouldn't have to rely on security by hypervisor if linux had proper security measures, sandboxing and access controls OOTB. Qubes is still far from good although it's slowly getting there

what are you talking about? Of course we do? We totally forgotten about mandatory access control systems? AppArmor, SELinux? problem isn’t that they don’t exist; it’s that nobody knows how to use them properly. You can even minimise the kernel attack surface these days with utilities like gVisor. people just understand virtual machines easier. It’s easy to understand the isolation it gives and easier to reduce unnece…

Am I wrong in thinking that Ubuntu has apparmor configured by default?
Post reply on HN