5 ms·

Does Xfce work on Wayland? I would imagine qubes would either use wayland or not provide any windows management if they're focused on security. As I understand

by chaxor 3y ago

Does Xfce work on Wayland? I would imagine qubes would either use wayland or not provide any windows management if they're focused on security. As I understand it, X11 has a lot of big security vulnerabilities that Wayland fixes, but not having any of that code or functionality to review makes it a lot easier to secure. Like the Alpine mentality.

kop316 3y ago
Not yet, but they are working on switching over.
seanhunter 3y ago
It's worth trying to understand the qubes security model a bit because it's very different from a normal distro. Essentially dom0 runs the xen hypervisor and then all your "actual work" gets run in various sandboxed vms which are highly protected. Normal vms have the system directories wipe and reset on reboot and there are also transient "tempvms" that literally get completely burned down and have no sideeffects. You can lock down which hardware is accessible from which vms as well as very finegrained control of things like network traffic (including ingress and egress). Clipboard is not shared between vms (although there are ways to explicitly choose to do crossvm cut and paste) and other copying or sharing between vms is also very tightly controlled. In that context, security vulnerabilities in X11 don't have the same impact as they would in a normal distro. User processes running in a VM don't have the ability to exploit a problem in X11. Go here https://www.qubes-os.org/faq/ https://www.qubes-os.org/faq/ and scroll down to "How does Qubes OS provide security?" to understand better.
- fsflover 3y ago
  However switching to Wayland will improve performance: https://github.com/QubesOS/qubes-issues/issues/3366 https://github.com/QubesOS/qubes-issues/issues/3366
  - seanhunter 3y ago
    For sure. I would really like them to do it.

5 ms·

Does Xfce work on Wayland? I would imagine qubes would either use wayland or not provide any windows management if they're focused on security. As I understand

by chaxor 3y ago

kop316 3y ago
Not yet, but they are working on switching over.
seanhunter 3y ago
It's worth trying to understand the qubes security model a bit because it's very different from a normal distro. Essentially dom0 runs the xen hypervisor and then all your "actual work" gets run in various sandboxed vms which are highly protected. Normal vms have the system directories wipe and reset on reboot and there are also transient "tempvms" that literally get completely burned down and have no sideeffects. You can lock down which hardware is accessible from which vms as well as very finegrained control of things like network traffic (including ingress and egress). Clipboard is not shared between vms (although there are ways to explicitly choose to do crossvm cut and paste) and other copying or sharing between vms is also very tightly controlled. In that context, security vulnerabilities in X11 don't have the same impact as they would in a normal distro. User processes running in a VM don't have the ability to exploit a problem in X11. Go here https://www.qubes-os.org/faq/ https://www.qubes-os.org/faq/ and scroll down to "How does Qubes OS provide security?" to understand better.
- fsflover 3y ago
  However switching to Wayland will improve performance: https://github.com/QubesOS/qubes-issues/issues/3366 https://github.com/QubesOS/qubes-issues/issues/3366
  - seanhunter 3y ago
    For sure. I would really like them to do it.