3 ms·
How is Qubes immune to Xen security issues? Slimmed down, only using PVHVM? I'm sure there have still been some CVEs that apply...
by feld 11y ago
How is Qubes immune to Xen security issues? Slimmed down, only using PVHVM? I'm sure there have still been some CVEs that apply...
- j_s 11y agoThe reality appears to be as you have stated (some CVEs that apply). https://news.ycombinator.com/item?id=10471912 https://news.ycombinator.com/item?id=10471912 https://raw.githubusercontent.com/QubesOS/qubes-secpack/master/QSBs/qsb-022-2015.txt https://raw.githubusercontent.com/QubesOS/qubes-secpack/mast... Because there have been, of course, many more security bugs found in Xen over the last years (as the numbering of this XSA suggests). True, majority of these didn't affect Qubes OS, sometimes by pure luck, sometimes because of the extra prudence we applied, many other times because of the architectural decisions we made.
- nickpsecurity 11y agoI warned them Xen was a bad foundation versus extended more secure microkernel designs. Some already had Linux in user-mode. Joanna ranted a ton then to defend her decision. Funny to see her ranting at Xen now on their mailing list and writing crap like that about what bullets they dodged. Fortunately, GenodeOS is improving nicely and follows right principles much like what I suggested for Qubes.