3 ms·
While Qubes is close to virtualization, etc. in terms of separating environments, it doesn't provide capability based security. Nor does it address the underlyi
by mikewarot 4y ago
While Qubes is close to virtualization, etc. in terms of separating environments, it doesn't provide capability based security. Nor does it address the underlying insecurity in hardware.
- fsflover 4y agoIt isolates USB, PCI devices, hence it does address the hardware insecurity. Could you give an example where the capability-based security would protect you from some threat, whereas Qubes OS wouldn't?
- mikewarot 4y agoThe classic example is "the confused deputy" in which any programs run on behalf of the user can damage unintended targets.
- fsflover 4y agoOn Qubes, you compartmentalize your workflows and data into security domains. All programs in one domain have only access to the same security level (in the edge case, it's one app per compartment). Unintended targets are simply not accessible from a wrong domain, i.e., by wrong programs.