4 ms·

Q: Would the steaming pile be stinkier with an easy way to deploy & use VMs to separate things, or without? A: Stinkier without, therefore Qubes.

jstewartmobile 9y ago
That's assuming the virtualization extensions are doing their job, and the other parts of the processor aren't leaking anything, and that Xen doesn't have any problems, and that the Qubes additions are solid, and that various interactions between these layers won't present any other problems, and probably a few other things... I'd consider betting on one of those things being solid on its own, but not all of them together.
- rdiddly 9y ago
  Well it obviously doesn't compete with whatever you're currently doing that solves all the same problems perfectly.
  - jstewartmobile 9y ago
    Why does it have to get personal rdiddly? If you've spent any time with Intel's phone-book-sized opcode manual, or following the history of the PC, you get real skeptical when the words "secure" and "PC" are mentioned together.
    - jstanley 9y ago
      He's not getting personal. You're being a bit unreasonable. Why are you pointing the finger at Qubes for not solving every problem there is? It's doing a much better job than ~every other Linux distro.
    - rdiddly 9y ago
      Apologies for the sarcasm, really I'm just wondering what you're using then. To me there's no "secure" and "insecure," there's only "more secure" and "less secure."
      - jstewartmobile 9y ago
        PC x86 architecture (including the Mac), for at least the past 20 years, has been cost-optimized as a games/performance machine, not a security one. Until that changes, the more/less secure axis is always going to be heavily biased towards "less" on the PC, regardless of what you run on top of it. In my own space, the approach has typically been to minimize attack surface by using the least amount of the simplest possible hardware we can get away with, then verifying the hell out of it. 8/16-bit micros, RS-232, no BIOS, aggressive shielding, and an extreme approach to the actor model. For things that need more horsepower, super-simple 32-bit micros, a real-time microkernel, and loads of QA. It's not perfect, and we leave a lot of performance on the table, but as far as security-per-man-hour-expended goes, I'd put it up against anything on the PC any day of the week. nickpsecurity made a very good comment on designs circulating in the assurance/defense sectors: https://news.ycombinator.com/item?id=15571546 https://news.ycombinator.com/item?id=15571546 The best part of his comment was the quote from Brian Snow: "The problem is innately difficult because from the beginning (ENIAC, 1944), due to the high cost of components, computers were built to share resources (memory, processors, buses, etc.). If you look for a one-word synopsis of computer design philosophy, it was and is sharing. In the security realm, the one word synopsis is separation: keeping the bad guys away from the good guys' stuff! So today, making a computer secure requires imposing a "separation paradigm" on top of an architecture built to share. That is tough! Even when partially successful, the residual problem is going to be covert channels (i.e. side channels). We really need to focus on making a secure computer, not on making a computer secure -- the point of view changes your beginning assumptions and requirements."
        pgaddict 9y ago
        That's great you have a design for something much more secure, but what are you actually using at the moment? I agree Qubes (or other similar systems) are imperfect - partly due to software bugs, partly due to hardware vulnerabilities. But the it clearly is an improvement, if only thanks to the compartmentalization. I'm sure there are potential adversaries that have access to BIOS backdoors, Xen 0-days etc. But well ...
        9y ago
- panarky 9y ago
  Old Thing has issues with X, Y and Z. New Thing solves X and Y but not Z. Therefore, criticize New Thing for not solving Z.
  - jstewartmobile 9y ago
    No. I'm mostly just chafed when anything for something as overcomplicated as a PC gets marketed as "secure" or "reasonably secure". Sure, most of the HN crowd knows the ins and outs, but a lot of end users don't. I run into so many people at local interest groups who do less than advisable things on the computer, yet don't even give a second thought to it because "I'm using Tails!" Or "I'm using Qubes!" At the same time, I have friends who do security for the military who show and tell so many different (and simple) ways to exfiltrate data that bypass most of the hypervisor/os/software stack. This is a better condom. That is an accomplishment, and I tip my hat to them. At the same time, if you really don't want the diseases, it's safest to just stay off tindr.

jstewartmobile 9y ago

That's assuming the virtualization extensions are doing their job, and the other parts of the processor aren't leaking anything, and that Xen doesn't have any problems, and that the Qubes additions are solid, and that various interactions between these layers won't present any other problems, and probably a few other things... I'd consider betting on one of those things being solid on its own, but not all of them together.

rdiddly 9y ago
Well it obviously doesn't compete with whatever you're currently doing that solves all the same problems perfectly.
- jstewartmobile 9y ago
  Why does it have to get personal rdiddly? If you've spent any time with Intel's phone-book-sized opcode manual, or following the history of the PC, you get real skeptical when the words "secure" and "PC" are mentioned together.
  - jstanley 9y ago
    He's not getting personal. You're being a bit unreasonable. Why are you pointing the finger at Qubes for not solving every problem there is? It's doing a much better job than ~every other Linux distro.
  - rdiddly 9y ago
    Apologies for the sarcasm, really I'm just wondering what you're using then. To me there's no "secure" and "insecure," there's only "more secure" and "less secure."
    - jstewartmobile 9y ago
      PC x86 architecture (including the Mac), for at least the past 20 years, has been cost-optimized as a games/performance machine, not a security one. Until that changes, the more/less secure axis is always going to be heavily biased towards "less" on the PC, regardless of what you run on top of it. In my own space, the approach has typically been to minimize attack surface by using the least amount of the simplest possible hardware we can get away with, then verifying the hell out of it. 8/16-bit micros, RS-232, no BIOS, aggressive shielding, and an extreme approach to the actor model. For things that need more horsepower, super-simple 32-bit micros, a real-time microkernel, and loads of QA. It's not perfect, and we leave a lot of performance on the table, but as far as security-per-man-hour-expended goes, I'd put it up against anything on the PC any day of the week. nickpsecurity made a very good comment on designs circulating in the assurance/defense sectors: https://news.ycombinator.com/item?id=15571546 https://news.ycombinator.com/item?id=15571546 The best part of his comment was the quote from Brian Snow: "The problem is innately difficult because from the beginning (ENIAC, 1944), due to the high cost of components, computers were built to share resources (memory, processors, buses, etc.). If you look for a one-word synopsis of computer design philosophy, it was and is sharing. In the security realm, the one word synopsis is separation: keeping the bad guys away from the good guys' stuff! So today, making a computer secure requires imposing a "separation paradigm" on top of an architecture built to share. That is tough! Even when partially successful, the residual problem is going to be covert channels (i.e. side channels). We really need to focus on making a secure computer, not on making a computer secure -- the point of view changes your beginning assumptions and requirements."
      - pgaddict 9y ago
        That's great you have a design for something much more secure, but what are you actually using at the moment? I agree Qubes (or other similar systems) are imperfect - partly due to software bugs, partly due to hardware vulnerabilities. But the it clearly is an improvement, if only thanks to the compartmentalization. I'm sure there are potential adversaries that have access to BIOS backdoors, Xen 0-days etc. But well ...
        9y ago
panarky 9y ago
Old Thing has issues with X, Y and Z. New Thing solves X and Y but not Z. Therefore, criticize New Thing for not solving Z.
- jstewartmobile 9y ago
  No. I'm mostly just chafed when anything for something as overcomplicated as a PC gets marketed as "secure" or "reasonably secure". Sure, most of the HN crowd knows the ins and outs, but a lot of end users don't. I run into so many people at local interest groups who do less than advisable things on the computer, yet don't even give a second thought to it because "I'm using Tails!" Or "I'm using Qubes!" At the same time, I have friends who do security for the military who show and tell so many different (and simple) ways to exfiltrate data that bypass most of the hypervisor/os/software stack. This is a better condom. That is an accomplishment, and I tip my hat to them. At the same time, if you really don't want the diseases, it's safest to just stay off tindr.