91–100 of 118 posts
With zero-click exploits that we certainly do not know of, Qubes OS offers some peace of mind.
Unless there's a zero day in Xen in which case the entire security model falls apart. With all these cloud providers using Xen, I have no doubt that there's already one out there.
Most of the time, zero days in Xen do not affect Qubes: https://www.qubes-os.org/security/xsa/#statistics
I am a Qubes user for a couple years now, and I wish I'd switched to it years earlier. Basically every criticism you hear is about correct-- principally worse graphics performance and battery life. But the performance issues for me were less bad than I expected, and the seamlessness of its usability was much much higher than I expected. Like copy and paste, moving files between VMs, plugging usb devices into VMs, net…
Depending on your use case, Qubes can be even more secure:: https://www.qubes-os.org/faq/#how-does-qubes-os-compare-to-u...
A simple screenshot of the OS environment would have been nice. But generally, I don't think people adopt operating systems just by seeing new recommendations on Hacker News or different forums. Most people have settled on macOS and then Linux and then Windows. and within the Linux ecosystem most people just use Ubuntu or Fedora and that's it. I don't see anyone using these other esoteric operating systems as a daily…
Qubes is far from esoteric in spaces where security is paramount. Your lack of familiarity with it doesn’t mean it’s obscure. It’s more a tool for a specific subset of people and purposes, rather than an OS meant for wide adoption.
A simple screenshot of the OS environment would have been nice. But generally, I don't think people adopt operating systems just by seeing new recommendations on Hacker News or different forums. Most people have settled on macOS and then Linux and then Windows. and within the Linux ecosystem most people just use Ubuntu or Fedora and that's it. I don't see anyone using these other esoteric operating systems as a daily…
It looks basically identical to fedora with XFCE, plus the window borders being different colors to indicate different VMs and some toolbar icons for VM management.
You can install KDE, too: https://forum.qubes-os.org/t/kde-changing-the-way-you-use-qu...
Earlier quoted context omitted.
Isn't it reasonable for applications to assume that, now that virtually all hardware has it, even super-cheap computers like the Raspberry Pi?
The issue for Qubes is security. GPUs can be used to subvert basically all the otherwise hardware-enforced security protections.
Earlier quoted context omitted.
The hardware may be there, but not necessarily the drivers.
The drivers are fine for GPU accelerated rendering of the app surfaces, even on the Pi. Hell, the drivers are even there >98% of the time for accelerated decode of the video format itself to boot. Qube's unique choice in software only rendering for user applications is one born out of the isolation goals for security, not what the software/drivers/hardware could do.
Only proprietary ones, so not for everyone...
Earlier quoted context omitted.
QubesOS is best enjoyed with a hefty CPU, lots of SSD space and a multi-screen set-up (in my opinion). Have you tried using Freetube instead of Youtube? In my experience it works a little better.
The most annoying issue I had was that even using mpv would lead to audio samples being dropped. I think I fixed it eventually by increasing buffer sizes, but I would expect at least audio should work out of the box.
Earlier quoted context omitted.
what are you talking about? Of course we do? We totally forgotten about mandatory access control systems? AppArmor, SELinux? problem isn’t that they don’t exist; it’s that nobody knows how to use them properly. You can even minimise the kernel attack surface these days with utilities like gVisor. people just understand virtual machines easier. It’s easy to understand the isolation it gives and easier to reduce unnece…
Am I wrong in thinking that Ubuntu has apparmor configured by default?
The problem is that both systems are quite difficult to use properly. The out-of-the-box configuration is good for a base increase in overall system security against common threats.
However, if you want the real isolation benefits that these MAC systems are capable of providing, you'll need a full-time security team with years of training to manage your personal desktop.
I am a Qubes user for a couple years now, and I wish I'd switched to it years earlier. Basically every criticism you hear is about correct-- principally worse graphics performance and battery life. But the performance issues for me were less bad than I expected, and the seamlessness of its usability was much much higher than I expected. Like copy and paste, moving files between VMs, plugging usb devices into VMs, net…
> Obviously it doesn't replace real air gap security Depending on your use case, Qubes can be even more secure:: https://www.qubes-os.org/faq/#how-does-qubes-os-compare-to-u...
- Malware which can bridge air gaps has existed for several years now and is becoming increasingly common.
Floppy disks
Hard disks used like floppies (especially plugged into a RAID controller with "auto run"-like features disabled)
Audio modem
Manual transcription via keyboard
Earlier quoted context omitted.
> Obviously it doesn't replace real air gap security Depending on your use case, Qubes can be even more secure:: https://www.qubes-os.org/faq/#how-does-qubes-os-compare-to-u...
- There’s generally no secure way to transfer data between physically separate computers running conventional OSes. - Malware which can bridge air gaps has existed for several years now and is becoming increasingly common. Floppy disks Hard disks used like floppies (especially plugged into a RAID controller with "auto run"-like features disabled) Audio modem Manual transcription via keyboard
Particularly since the common tools like SCP give way too much access unless you go through special effort.
> Floppy disks, Hard disks
As you note there are 'auto run' like issues, also file systems are not historically very robust against against malicious data.
Hard disks themselves have host flash-able firmware and microcontrollers and get either DMA access (e.g. over SATA) to the system or get USB connected and the ability to pretend to be arbitrary usb devices like HID or exploit vulnerable usb drivers. So at least in theory a compromised system can turn your drive malicious such that it compromises other systems.
Though an attacker that sophisticated probably also has hypervisor escapes.
> Audio modem, Manual transcription
Personally I'm fond of just RS232 serial.