3 ms·

Whilst I agree that more security would be great, and a capability based sandbox for applications would be cool, this is not something that Gnome can do on it's

Whilst I agree that more security would be great, and a capability based sandbox for applications would be cool, this is not something that Gnome can do on it's own. There should be a inter-project initiative to get this to work, as ideally this should be done at the kernel and userspace level and be DE agnostic. Flatpak kind of could do that, but I'm skeptical for now. On the other hand, maybe Gnome should copy qubes or everyone should just make qubes ready for everyday use.

kaba0 5y ago
Of course it should not be desktop-dependent, but it should be very well integrated into the DE, because it is the trusted party that can manage most of these permissions. As for Qubes, it is cool, but I don’t think that such a massive performance degradation/requirement is feasible. Also, I’m not sure how great it is from an everyday usability point of view. If the user will rather run everything in a single vm, because it doesn’t work otherwise, we are back to where we are now.
- eptcyka 5y ago
  The performance isn't inherent in the design. It's perfectly feasible to have hardware accelerated graphics without passing through a whole GPU, since we have virtualization ready mesa vulkan drivers. And since you control the guest, you can dynamically scale memory use (if only one way), and everything else has negligible performance impact. As such, I think the only thing that's preventing running every application in a VM for me is the user experience, and this is by far the hardest thing to get right, but this will eventually be the gold standard.
  - kaba0 5y ago
    I agree with you, though if we raise the bar for our threat model, running a not-too secure vm image is still not the best option.
    - eptcyka 5y ago
      That's an issue with the hypervisor and not the image then, but I do agree that the GPU virtualization is a large and complex attack surface. Regardless, I see these as problems that can be solved with effort.

kaba0 5y ago

Of course it should not be desktop-dependent, but it should be very well integrated into the DE, because it is the trusted party that can manage most of these permissions. As for Qubes, it is cool, but I don’t think that such a massive performance degradation/requirement is feasible. Also, I’m not sure how great it is from an everyday usability point of view. If the user will rather run everything in a single vm, because it doesn’t work otherwise, we are back to where we are now.

eptcyka 5y ago
The performance isn't inherent in the design. It's perfectly feasible to have hardware accelerated graphics without passing through a whole GPU, since we have virtualization ready mesa vulkan drivers. And since you control the guest, you can dynamically scale memory use (if only one way), and everything else has negligible performance impact. As such, I think the only thing that's preventing running every application in a VM for me is the user experience, and this is by far the hardest thing to get right, but this will eventually be the gold standard.
- kaba0 5y ago
  I agree with you, though if we raise the bar for our threat model, running a not-too secure vm image is still not the best option.
  - eptcyka 5y ago
    That's an issue with the hypervisor and not the image then, but I do agree that the GPU virtualization is a large and complex attack surface. Regardless, I see these as problems that can be solved with effort.