I think Qubes' approach should be the default. There is no valid reason for so many permissions by default. The current default for example on Debian is crazy!

I think Qubes' approach should be the default. There is no valid reason for so many permissions by default. The current default for example on Debian is crazy! Any user can read the home directory of any other user by default! If somebody whould have told me that before knowing it, I would have considered it a bad joke. I can't fathom why it's not changed. However, Qubes can't protect against malicious hardware. I see no way around it, we must have hardware with completely open sources.