3 ms·
You should take a look at QubesOS : https://www.qubes-os.org https://www.qubes-os.org. Each application starts in a VM in order to isolate them from each other.
by luch 9y ago
You should take a look at QubesOS : https://www.qubes-os.org https://www.qubes-os.org. Each application starts in a VM in order to isolate them from each other.
The only issue is that QubesOS rely on paravirtualization (it's a Xen hypervisor underneath) for process isolation.
(By the way Windows is taking the same path with ApplicationGuard)
- crtasm 9y agoIt also runs your network connection and firewall in their own VMs, plus makes it easy to stack more. e.g. you want to connect to a VPN and then to Tor? No problem. At the same time you can run your password manager in a VM with no network access.
- madez 9y agoI think Qubes' approach should be the default. There is no valid reason for so many permissions by default. The current default for example on Debian is crazy! Any user can read the home directory of any other user by default! If somebody whould have told me that before knowing it, I would have considered it a bad joke. I can't fathom why it's not changed. However, Qubes can't protect against malicious hardware. I see no way around it, we must have hardware with completely open sources.