4 ms·

I have tried the QubesOS and boy does it bring back memories of Windows being called Pentium to 286 converter. It is slow as molasses on hardware where even Win

by dmz73 4y ago

I have tried the QubesOS and boy does it bring back memories of Windows being called Pentium to 286 converter. It is slow as molasses on hardware where even Windows 10 and Gnome are both fast and to make it usable you have to keep relaxing the security to the point where it is probably less secure than regular OS. And don't even bother if you have to use scaling other than 100%, sure you can scale the DOM0 but the rest of the VMs are not scaled and there is no documentation on how to do it. What we need are simple sandboxes that isolate GUI applications into chroot environment and keep them away from other applications and documents.

Syonyk 4y ago
> It is slow as molasses on hardware where even Windows 10 and Gnome are both fast... I haven't had that problem. There's no GPU acceleration, so anything heavy on the GPU is a problem, but in terms of general use, I don't find it slower than Linux on the iron. > and to make it usable you have to keep relaxing the security to the point where it is probably less secure than regular OS. How so? What settings? I don't run with a USB Qube all the time for just my HID devices, but I light it up when I'm doing anything else on USB. I haven't had issues with having to turn down a bunch of security settings either. > And don't even bother if you have to use scaling other than 100%, sure you can scale the DOM0 but the rest of the VMs are not scaled and there is no documentation on how to do it. Yes there is. https://github.com/Qubes-Community/Contents/blob/master/docs/customization/dpi-scaling.md https://github.com/Qubes-Community/Contents/blob/master/docs... > What we need are simple sandboxes that isolate GUI applications into chroot environment and keep them away from other applications and documents. The history of local root exploits ("Cheap and easy!") would argue that doing such a thing and relying on the kernel is just security theater.
- coconut08 4y ago
  >The history of local root exploits ("Cheap and easy!") would argue that doing such a thing and relying on the kernel is just security theater. it may not be perfect but surely its better than nothing. it wouldn't protect you from a sophisticated nation state attacker, but most people don't have that in their threat model. surely it would be good enough to prevent google chrome from snooping through your home directory and other such things.
  - yjftsjthsd-h 4y ago
    > surely it would be good enough to prevent google chrome from snooping through your home directory and other such things. You want firejail, I think; this is one of its headline features. (Or possibly bubblewrap.)
    - eloy 4y ago
      Please do not use firejail. See this issue page: https://gitlab.alpinelinux.org/alpine/aports/-/issues/12635 https://gitlab.alpinelinux.org/alpine/aports/-/issues/12635 Bubblejail is an acceptable alternative https://github.com/igo95862/bubblejail https://github.com/igo95862/bubblejail
      - yjftsjthsd-h 4y ago
        That is a somewhat controversial claim. See also this issue page: https://github.com/netblue30/firejail/issues/3046 https://github.com/netblue30/firejail/issues/3046 Also, bubblejail ships all of 8 profiles; I'm skeptical of its claim to be a full replacement.

by dmz73 4y ago

Syonyk 4y ago

> It is slow as molasses on hardware where even Windows 10 and Gnome are both fast... I haven't had that problem. There's no GPU acceleration, so anything heavy on the GPU is a problem, but in terms of general use, I don't find it slower than Linux on the iron. > and to make it usable you have to keep relaxing the security to the point where it is probably less secure than regular OS. How so? What settings? I don't run with a USB Qube all the time for just my HID devices, but I light it up when I'm doing anything else on USB. I haven't had issues with having to turn down a bunch of security settings either. > And don't even bother if you have to use scaling other than 100%, sure you can scale the DOM0 but the rest of the VMs are not scaled and there is no documentation on how to do it. Yes there is. https://github.com/Qubes-Community/Contents/blob/master/docs/customization/dpi-scaling.md https://github.com/Qubes-Community/Contents/blob/master/docs... > What we need are simple sandboxes that isolate GUI applications into chroot environment and keep them away from other applications and documents. The history of local root exploits ("Cheap and easy!") would argue that doing such a thing and relying on the kernel is just security theater.

coconut08 4y ago
>The history of local root exploits ("Cheap and easy!") would argue that doing such a thing and relying on the kernel is just security theater. it may not be perfect but surely its better than nothing. it wouldn't protect you from a sophisticated nation state attacker, but most people don't have that in their threat model. surely it would be good enough to prevent google chrome from snooping through your home directory and other such things.
- yjftsjthsd-h 4y ago
  > surely it would be good enough to prevent google chrome from snooping through your home directory and other such things. You want firejail, I think; this is one of its headline features. (Or possibly bubblewrap.)
  - eloy 4y ago
    Please do not use firejail. See this issue page: https://gitlab.alpinelinux.org/alpine/aports/-/issues/12635 https://gitlab.alpinelinux.org/alpine/aports/-/issues/12635 Bubblejail is an acceptable alternative https://github.com/igo95862/bubblejail https://github.com/igo95862/bubblejail
    - yjftsjthsd-h 4y ago
      That is a somewhat controversial claim. See also this issue page: https://github.com/netblue30/firejail/issues/3046 https://github.com/netblue30/firejail/issues/3046 Also, bubblejail ships all of 8 profiles; I'm skeptical of its claim to be a full replacement.