zlacker

>You still have to get through Xen to get to anything I consider of value.

It's not unthinkable, as Xen is huge, at hundreds of kLoCs. But there's an effort[0] to make a Qubes that uses seL4 in place of Xen.

0. https://trustworthy.systems/projects/TS/makatea

>>snvzz+(OP)
Most of Xen's vulnerabilities do not affect Qubes OS: https://www.qubes-os.org/security/xsa/.

>>fsflov+ka1
Most vulnerabilities of anything do not affect all its users.

But it's bad enough if any do. (some do affect Qubes)

It is an architectural problem.

SeL4 is a good replacement, with excellent performance and strong formal proofs.

>>snvzz+Cm1
SeL4 is great an all, but no one of those Xen vulnerabilities has led to an escape since forever, have they?