Thank you for a comprehensive answer. I do not think that one vulnerability in 8+ years proofs insecurity of QubesOS (by the way, it was found by their develope

Thank you for a comprehensive answer. I do not think that one vulnerability in 8+ years proofs insecurity of QubesOS (by the way, it was found by their developers). OpenBSD is not free from kernel vulnerabilities on such a long time scale. Security through correctness never works, because people are not ideal. (Xen developers are also trying to decrease the code base and make sure the code is as correct as possible.) The only "silver bullet" is defense in depth [0], i.e., trying everything you can. I heard [1] that OpenBSD is concentrated on the security of the kernel too much, ignoring the isolation of applications. However, most frequently, attacks come through applications. And this is exactly the point of QubesOS: to isolate the applications as much as possible. You might also be interested in a comparison between different approaches to security [2]. [0] https://en.wikipedia.org/wiki/Defense_in_depth_(computing) https://en.wikipedia.org/wiki/Defense_in_depth_(computing) [1] https://allthatiswrong.wordpress.com/2010/01/20/the-insecurity-of-openbsd/ https://allthatiswrong.wordpress.com/2010/01/20/the-insecuri... [2] https://theinvisiblethings.blogspot.de/2008/09/three-approaches-to-computer-security.html https://theinvisiblethings.blogspot.de/2008/09/three-approac...