3 ms·
Where can I read how Qubes protects itself from any possible interference from Intel ME, which would be a low bar for a level of security users of Qubes aim for
by 112233 3y ago
Where can I read how Qubes protects itself from any possible interference from Intel ME, which would be a low bar for a level of security users of Qubes aim for?
- fsflover 3y agoIt can't protect from IME. But you can install Qubes on a machine with disabled and neutralized IME, e.g. Librem 15. Also I don't see how it's a low bar. AFAIK there were no known remote exploits of IME.
- 112233 3y agoWell, sorry, I mean, reading comments here and reading advice on QubesOS — they speak about airgapped systems, evil maid attacks, government vans that remotely snoop any computer etc. You don't need QubesOS to protect from known exploits, it was my understanding that people use QubesOS to protect from (real or imagined) state-level adversary.
- fsflover 3y agoYou can use Qubes OS for various kinds of threat model. Depending on the latter, your configuration will be wildly different. > You don't need QubesOS to protect from known exploits Qubes would protect you sensitive files from, e.g., XZ attack. Nothing else would AFAIK.
- etiam 3y agoYou can read about how it doesn't (can't)? https://blog.invisiblethings.org/2015/10/27/x86_harmful.html https://blog.invisiblethings.org/2015/10/27/x86_harmful.html But their recommended hardware makes it pretty clear Qubes should preferably be run on open firmware and with ME as broken as reasonably possible (as has already been pointed out in the discussion here).