zlacker

[parent] [thread] 3 comments
1. pgaddi+(OP)[view] [source] 2017-11-20 21:16:20
That's great you have a design for something much more secure, but what are you actually using at the moment?

I agree Qubes (or other similar systems) are imperfect - partly due to software bugs, partly due to hardware vulnerabilities. But the it clearly is an improvement, if only thanks to the compartmentalization. I'm sure there are potential adversaries that have access to BIOS backdoors, Xen 0-days etc. But well ...

replies(1): >>jstewa+zb
2. jstewa+zb[view] [source] 2017-11-20 22:51:30
>>pgaddi+(OP)
Already answered that above.

Never said "Qubes sucks because it's not perfect." I have argued that the PC is too damn crufty and complicated to ever be "reasonably secure".

If I ever felt as though I had to protect myself from FBI[0] or ex-Mossad[1], I'd feel safer with an iPad and Signal than a PC running anything, and I say that as someone who doesn't particularly trust or care for Apple. You could also go full-Stallman[2], but that would probably be fairly error-prone if you didn't know as much about computers as RMS.

[0] https://www.theguardian.com/us-news/2015/may/12/revealed-fbi...

[1] https://www.newyorker.com/news/news-desk/harvey-weinsteins-a...

[2] https://stallman.org/stallman-computing.html

replies(1): >>pgaddi+wf
◧◩
3. pgaddi+wf[view] [source] [discussion] 2017-11-20 23:29:39
>>jstewa+zb
Ummm, so first you state that "PC is too damn crufty and complicated" and then suggest that going full-Stallman would improve that, when RMS is using X60, which is essentially a regular x86 laptop? Granted, it doesn't have the IME crap and runs libreboot, but otherwise it's still regular x86 machine. Also, I doubt RMS is after freedom in the first place - it likely improves security (no binary blobs etc.), but it certainly doesn't fix the issue.

FWIW I don't think you've answered the "What to use instead, then?" question. I agree there are platforms that are much tighter on security compared to x86 (say, iphones seem to fare quite well), but I don't see how I could use that for my "regular" work. For that, I think Qubes is "reasonably secure" but hopefully it'll get better.

Of course, if your threat model includes guys from NSA/FBI/Mosad, then perhaps it's not enough. But then again, iphone may not be enough either.

replies(1): >>jstewa+2r
◧◩◪
4. jstewa+2r[view] [source] [discussion] 2017-11-21 02:19:38
>>pgaddi+wf
> FWIW I don't think you've answered the "What to use instead, then?" question.

If you need a workstation that is hardened against the big boys, I doubt such a thing exists, and it never will if people keep putting all of their hope in the next band-aid. It is also a damn shame, since it's not like this is a problem that needs two more generations of pure science to solve.

Hell, the B5000[0] was safer than the things we run today, and people didn't stop having better ideas about computing in 1961.

[0] https://en.wikipedia.org/wiki/Burroughs_large_systems

[go to top]