Rutkowska wrote various posts about it. She does not answer your question directly and precisely, but provides considerations that make clear why she considers

Rutkowska wrote various posts about it. She does not answer your question directly and precisely, but provides considerations that make clear why she considers Qubes' approach an improvement over the status quo. On Formally Verified Microkernels (and on attacking them) - https://blog.invisiblethings.org/2010/05/03/on-formally-verified-microkernels-and.html https://blog.invisiblethings.org/2010/05/03/on-formally-veri... The Linux Security Circus: On GUI isolation - https://blog.invisiblethings.org/2011/04/23/linux-security-circus-on-gui-isolation.html https://blog.invisiblethings.org/2011/04/23/linux-security-c... I think she had other posts on another blog as well, but unfortunately I don't remember the address. And I don't know if it still exists.