zlacker

QubesOS – A reasonably secure operating system

submitted by TheFre+(OP) on 2023-07-11 18:11:07 | 176 points 135 comments
[view article] [source] [go to bottom]

NOTE: showing posts with links only show all posts
◧◩◪
3. mdp202+Ia[view] [source] [discussion] 2023-07-11 18:53:41
>>poloti+aa
The system requirements are specified as:

minimum 6GB RAM; 16GB recommended

https://www.qubes-os.org/doc/system-requirements/

4. weinzi+Ya[view] [source] 2023-07-11 18:54:38
>>TheFre+(OP)
I used it when I worked as a hiring manager. For this task it is ideal. All the behavioral security measures, like only to open attachments from people you trust, break down when your job description is basically to figure out who you can trust.

Qubes comes with a "Convert to trusted PDF" out of the box. Joanna Rutkowska explained how it works under the hood pretty nicely[1]. The tldr is that it is very thorough. With Qubes it is convenient too.

I used Qubes to open the application mails and their attachments and converted the interesting ones to trusted PDFs which I then forwarded to the relevant people. All further communication was only with the trusted versions.

[1] https://blog.invisiblethings.org/2013/02/21/converting-untru...

◧◩
16. Zambyt+Ze[view] [source] [discussion] 2023-07-11 19:11:11
>>barbar+be
> Or is this more of a server OS?

It's specifically designed for desktop use

https://www.qubes-os.org/intro/

◧◩
22. neodyp+3g[view] [source] [discussion] 2023-07-11 19:17:15
>>weinzi+Ya
You can use something similar on macOS, Windows or Linux, based on Docker containers, see Dangerzone: https://github.com/freedomofpress/dangerzone
◧◩
26. coppsi+Ag[view] [source] [discussion] 2023-07-11 19:20:12
>>KingMa+ng
There is actually a project which aims to do that: <https://spectrum-os.org>

Unrelated to QubesOS.

◧◩
27. fsflov+Dg[view] [source] [discussion] 2023-07-11 19:20:28
>>legran+Bf
I would say, almost anyone running anything untrusted from time to time can benefit from the strong hardware virtualization.

Qubes is my daily driver by the way. My attempt of explaining it to a layman: https://forum.qubes-os.org/t/how-to-pitch-qubes-os/4499/15

◧◩
31. though+eh[view] [source] [discussion] 2023-07-11 19:23:39
>>legran+Bf
I know what Theo says about (x86) virtualization[1], but I think it's still useful to virtually separate your random browsing the web from things like health and banking, or where you keep your ssh keys (if you don't use a Yubikey or similar to keep it off your laptop) -- or other secrets.

You can be a victim of a random drive-by, you don't have to be a person on a "list".

[1] https://marc.info/?l=openbsd-misc&m=119318909016582

40. ChrisA+6i[view] [source] 2023-07-11 19:26:43
>>TheFre+(OP)
Anything new from that release a month ago?

>>36178205

◧◩
46. fsflov+9j[view] [source] [discussion] 2023-07-11 19:31:44
>>Goofba+cd
This project was never stagnant, a lot of things are always happening here: https://github.com/QubesOS/qubes-issues/issues.

Concerning the certified hardware, few vendors try to make the certification, and also coreboot is required: https://www.qubes-os.org/doc/certified-hardware/#hardware-ce...

◧◩
55. fsflov+rk[view] [source] [discussion] 2023-07-11 19:37:13
>>beardo+Ge
> the official Qubes dom0 runs a very outdated fedora version

Why does it matter? You do not run anything in dom0: https://www.qubes-os.org/doc/supported-releases/#note-on-dom...

◧◩
56. Syonyk+Zk[view] [source] [discussion] 2023-07-11 19:40:32
>>flashb+jc
You can. It's just neither recommended nor enabled by default.

https://forum.qubes-os.org/t/nested-virtualization/14790

Poke around /etc/libvirt/libxl and your particular VM's config file. You'll find some lines like:

<feature name='vmx' policy='disable'/> <feature name='svm' policy='disable'/>

Enable it, and you should have working nested virtualization.

◧◩
70. fsflov+4q[view] [source] [discussion] 2023-07-11 20:07:43
>>aborsy+Dc
https://forum.qubes-os.org/t/deployments-of-qubes-by-entitie...
79. dang+Rx[view] [source] 2023-07-11 20:51:12
>>TheFre+(OP)
Related. Others?

Qubes OS 4.2-rc1 is available for testing - >>36178205 - June 2023 (3 comments)

New user guide: How to organize your qubes - >>33396604 - Oct 2022 (15 comments)

What Is Qubes OS? - >>32036899 - July 2022 (82 comments)

Qubes OS: A reasonably secure operating system - >>30776103 - March 2022 (97 comments)

Qubes OS 4.1.0 has been released - >>30215210 - Feb 2022 (1 comment)

Ask HN: Qubes OS or just separate VMs for separating work and private files? - >>29537961 - Dec 2021 (6 comments)

Qubes OS 4.1-rc1 has been released - >>28856957 - Oct 2021 (5 comments)

Qubes OS 4.0 has been released - >>16699900 - March 2018 (39 comments)

Qubes OS: A reasonably secure operating system - >>15734416 - Nov 2017 (144 comments)

Reasonably Secure Computing in the Decentralized World - >>15566563 - Oct 2017 (44 comments)

Toward a Reasonably Secure Laptop - >>14743238 - July 2017 (100 comments)

“Paranoid Mode” Compromise Recovery on Qubes OS - >>14218504 - April 2017 (14 comments)

Qubes OS Begins Commercialization and Community Funding Efforts - >>13069615 - Nov 2016 (24 comments)

Qubes OS 3.2 has been released - >>12604417 - Sept 2016 (30 comments)

Security challenges for the Qubes build process - >>11801093 - May 2016 (17 comments)

Qubes OS 3.1 has been released - >>11260857 - March 2016 (44 comments)

Converting untrusted PDFs into trusted ones: The Qubes Way (2013) - >>10538888 - Nov 2015 (5 comments)

Intel x86 considered harmful – survey of attacks against x86 over last 10 years - >>10458318 - Oct 2015 (169 comments)

Qubes – Secure Desktop OS Using Security by Compartmentalization - >>8428453 - Oct 2014 (49 comments)

Introducing Qubes 1.0 ("a stable and reasonably secure desktop OS") - >>4472403 - Sept 2012 (59 comments)

Qubes: an open source OS with strong security for desktop computing - >>2645170 - June 2011 (16 comments)

Review: Qubes OS Beta 1 — a new and refreshing approach to system security - >>2504274 - May 2011 (1 comment)

The Linux Security Circus: On GUI isolation - >>2477667 - April 2011 (47 comments)

Qubes Beta 1 has been released (strong desktop security OS) - >>2439096 - April 2011 (3 comments)

Qubes Architecture - actual security-oriented OS - >>1796384 - Oct 2010 (1 comment)

Open source Qubes OS is ultra secure - >>1249857 - April 2010 (7 comments)

Introducing Qubes OS - >>1246990 - April 2010 (20 comments)

◧◩
81. yankpu+Uy[view] [source] [discussion] 2023-07-11 20:56:19
>>flashb+jc
Huh… why does Docker require VMs on Linux? Isn’t the selling point of Docker that it uses the same kernel on Linux?

And it should be quite lightweight as it’s just a container…

It’s not that I don’t believe you but I don’t understand it… why would you need VM on Linux for Docker?

edit: huh

https://docs.docker.com/desktop/faqs/linuxfaqs/#:~:text=Dock....

that’s… a bit stupid in my opinion. But you can always just use the default daemon so, eh. whatever. maybe I’m wrong. there are reasons I guess

◧◩◪◨
85. hiatus+pC[view] [source] [discussion] 2023-07-11 21:17:02
>>Dah00n+Lu
Proxmox containers are just regular containers.

https://pve.proxmox.com/wiki/Linux_Container

88. snvzz+RI[view] [source] 2023-07-11 21:50:44
>>TheFre+(OP)
QubesOS is amazing, with a lot of interesting concepts.

While its dependency on Xen, a fairly bloated and thus unsafe hypervisor, is unfortunate, there's an effort[0] to remake Qubes around seL4.

0. https://trustworthy.systems/projects/TS/makatea

◧◩◪◨
89. snvzz+9J[view] [source] [discussion] 2023-07-11 21:52:41
>>Syonyk+vm
There's also Makatea[0], an effort to build a Qubes-like around seL4.

0. https://trustworthy.systems/projects/TS/makatea

◧◩◪
90. snvzz+nJ[view] [source] [discussion] 2023-07-11 21:53:55
>>Syonyk+3j
>You still have to get through Xen to get to anything I consider of value.

It's not unthinkable, as Xen is huge, at hundreds of kLoCs. But there's an effort[0] to make a Qubes that uses seL4 in place of Xen.

0. https://trustworthy.systems/projects/TS/makatea

◧◩
91. snvzz+CJ[view] [source] [discussion] 2023-07-11 21:55:23
>>KingMa+ng
>For example, it'd be nice to use KVM (QEMU or even crosvm) instead of Xen

Or even better, seL4, for which an effort exists[0].

0. https://trustworthy.systems/projects/TS/makatea

92. nasc_+HK[view] [source] 2023-07-11 22:00:35
>>TheFre+(OP)
I've been using Qubes for the past 2 years while going to school, and I found it really fun and helpful. A lot of professors had me download random closed source software from random websites during the pandemic, and it was easier to download it to a VM than to convince them about Free Software. More than that though it's been really helpful just for my own workflow. I can hit a keybind and start working from essentially a fresh linux install. It's easier to stay on task when each VM is designed to only do one kind of task. It's also nice having debian, fedora, windows, kali, and whonix all easily accessible on the same machine.

The main sticking point for me is that Qubes is reasonably secure from _myself_. I make mistakes. I first started using linux with an Ubuntu install that I broke a year later because I accidentally added in a space when typing `rm -rf ~/Arduino` which made it `rm -rf ~ /Arduino`. On Qubes I can `sudo rm -rf /` on the VM I'm using right now and not break a sweat. I have a keybind to spawn a disposable "airgapped" VM to deal with sensitive or untrusted data, and it helps knowing that even if I mess up with whatever I'm doing, the VM will keep everything reasonably contained.

Some cool things that Qubes has outside of just VMs are its features enabled by the communication between VMs. Notable ones are Split GPG (https://www.qubes-os.org/doc/split-gpg/) which let you use a VM as if it were a smartcard for GPG and Split SSH (https://github.com/Qubes-Community/Contents/blob/master/docs...) which let you isolate your private SSH keys from your VM running your SSH client.

There are some sticking points around Qubes. For instance, I use Tailscale to connect my computers to each other from anywhere. Tailscale's install scripts add their keys to my VM's package manager for updates and installs. The proper way to do this in Qubes is to clone a TemplateVM, run Tailscale's install script, update, install, and then base an AppVM off of it. But that creates an entire new OS taking up storage and requiring updates. You can hack a way around this in an AppVM which saves a considerable amount of space, but it takes a lot of upfront time to do and requires you to manually update it.

Another sticking point is hardware acceleration. The desktop environment has access to hardware acceleration, so it runs fine, but opening videos in AppVMs is all software decoded. I'm on a Thinkpad T580 and it can run 1080p videos, but the fans turn on and can't do 4K. When I want to game or do something GPU heavy I either stream from my tower or completely switch over.

Overall, I'm really happy with Qubes and I'm planning to stick with it on my laptops.

◧◩◪
99. mike_d+rX[view] [source] [discussion] 2023-07-11 23:39:12
>>neodyp+3g
Dangerzone is an implementation of a concept known as CDR (Content Disarm & Reconstruction), where you convert anything to an image inside a sandbox, and then convert the raw pixel data back into an image inside a different sandbox.

It is a common workflow inside the government or other places where you need to move data across airgaps, or view content that is highly untrusted.

Shameless plug, I wrote my own that supports over 200 file formats: https://preview.ninja/

◧◩
104. etiam+s91[view] [source] [discussion] 2023-07-12 01:24:10
>>dang+Rx
Possibly to some extent

Intel x86 considered harmful – survey of attacks against x86 over last 10 years - >>10458318

◧◩◪◨
112. fsflov+HT1[view] [source] [discussion] 2023-07-12 09:40:15
>>snvzz+nJ
Most of Xen's vulnerabilities do not affect Qubes OS: https://www.qubes-os.org/security/xsa/.
◧◩
119. fsflov+a72[view] [source] [discussion] 2023-07-12 11:40:24
>>dang+Rx
Also this: >>36178205
◧◩
128. dmm+153[view] [source] [discussion] 2023-07-12 16:11:12
>>plague+Kh2
I think the optional anti-evil maid support includes secure boot: https://www.qubes-os.org/doc/anti-evil-maid/

> Anti Evil Maid is an implementation of a TPM-based dynamic (Intel TXT) trusted boot for dracut/initramfs-based OSes (Fedora, Qubes, etc.) with a primary goal to prevent Evil Maid attacks.

◧◩◪◨
133. dmm+JA8[view] [source] [discussion] 2023-07-14 00:33:16
>>plague+D25
In my view the secure boot support provided by mainstream Linux distributions is more about providing installability on systems with secure boot enabled, rather than providing real security benefits.

My reasoning is that while the bootloader and the kernel are signed, the initrd image loaded very early on in boot is not, because it is generated on device. So it provides a convenient way to compromise any system you have physical access to.

The anti evil maid implementation I linked to attempts to mitigate this hole using a TPM. I'm not sure why it isn't on by default but perhaps it's because the implementation has different options that require deciding on a threat model, e.g. setting a TPM password or using an external usb device to store a LUKS key. Here's a good blog post about the anti evil maid implementation that qubes uses(it also works with other distros like Fedora): https://blog.invisiblethings.org/2011/09/07/anti-evil-maid.h...

This blog post contains a good overview of the secure boot status quo along with another potential future fix: https://0pointer.net/blog/brave-new-trusted-boot-world.html

[go to top]