3 ms·
What is the response of QubeOS to the famous Theo de Radt critique[1] that virtualisation is basically adding another layer (hypervisor) of possible exploits ju
by rnhmjoj 6y ago
What is the response of QubeOS to the famous Theo de Radt critique[1] that virtualisation is basically adding another layer (hypervisor) of possible exploits just below the existing one (kernel)?
[1]: https://news.ycombinator.com/item?id=8393940 https://news.ycombinator.com/item?id=8393940
- fsflover 6y agoJust compare the number of lines of code between the Linux kernel and Xen. You will see how much lower probability of a bug becomes if you use the latter.
- deleted 6y ago[deleted]
- tgragnato 6y agoRutkowska wrote various posts about it. She does not answer your question directly and precisely, but provides considerations that make clear why she considers Qubes' approach an improvement over the status quo. On Formally Verified Microkernels (and on attacking them) - https://blog.invisiblethings.org/2010/05/03/on-formally-verified-microkernels-and.html https://blog.invisiblethings.org/2010/05/03/on-formally-veri... The Linux Security Circus: On GUI isolation - https://blog.invisiblethings.org/2011/04/23/linux-security-circus-on-gui-isolation.html https://blog.invisiblethings.org/2011/04/23/linux-security-c... I think she had other posts on another blog as well, but unfortunately I don't remember the address. And I don't know if it still exists.
- Fnoord 6y agoWhat is Theo de Raadt's model with regards to X11 security on OpenBSD? Does it work out of the box?
- skrooge 6y agoOpenBSD doesn't do GUI isolation. xinput grabs all. But file system is limited (unveil) and what apps can do (pledge)