zlacker

>>tete+(OP)
While I am all for virtualizing, it doesn't help security. It just moves the exploit from your OS into your hypervisor. Even worse, you add a whole new level of exploitable code.

>>mrotte+Bl
Of course it improves security. On Qubes, someone who can exploit your browser (pdf reader, word processor) doesn't automatically get free rein on your machine. They still need to escape Xen.

>>spindr+Ql
Nope. If somebody exploits your PDF reader, they still have to circumvent the OS. Sound familiar?

Now instead of one layer with hardware contact, you have two (assuming you want performance too). Twice the attack surface.

>>mrotte+lo
This would be sound logic if existing desktop operating systems had actual good security models.

In the real world, if someone exploits your PDF reader, they don't have to circumvent your OS: your OS hands over everything you can access, by design. One could argue that a better security model baked into the OS would make more sense than a virtualization hack, but the latter has the advantage of actually existing.

>>amalco+wq
What would be the better security model?

>>Touche+Qu
Somebody exploiting your PDF reader can't upload all your email.

>>SamRei+Uw
That's not a model. What's the model that prevents this? User performs a 2-step auth every time code executes?

>>Touche+OB
Just pick one that gives the feature I described without being a pain to the user.

>>SamRei+lC
I know of no such models. Perhaps someone smarter than me has thought of them, that's why I asked the question initially.

>>Touche+eD
Sandboxing, where each process is only allowed to use a precise set of system resources.

Any attempt to use anything else leads to termination.

>>pjmlp+tQ
Which resources are they allowed to use? What defines which resources they are given?

>>Touche+oZ
> Which resources are they allowed to use?

The system administrator at installation time.

> What defines which resources they are given?

Applications just have a request list of what they require.

If the administrator doesn't allow them for the given application modules (executable, dynamic library, function call,...), bad luck.