4 ms·

I know exactly what it is, and you should read my comment.

Dalewyn 3y ago
If you are seriously suggesting a virtual machine is the same thing as an air gap, then no: You do not know what air gapping is. Not the least because there is literally no god damn gap with a virtual machine on a host computer. There is no way to guarantee there will be no unauthorized access or movement of data without a hard, physical gap requiring manual, scrutinized traversal. No amount of software or hardware mitigations can suffice. If Qubes is satisfactory for The Guardian, then they never needed air gapping in the first place. I find that hard to believe given what their job description is, but that is ultimately none of my business (though I won't give them any sensitive information, for the safety of both myself and others). Meanwhile, if you need air gapping then Qubes by itself absolutely cannot satisfy your security needs. Because a virtual machine is not an air gap.
- jmprspret 3y ago
  > If you are seriously suggesting a virtual machine is the same thing as an air gap You absolutely still have not read their comment.
- greggsy 3y ago
  I’m not suggesting it’s the same as an air gap. I’m suggesting that the solution sufficiently meets their requirements to do away with the need for a bona fide air gap. In fact, that’s what is implied by the quoted statement in the article. You can rant on about how they should treat their data as as if they’re nuclear launch codes, but they’ve made a deliberate decision to implement a solution that is secure enough for their needs. If you still disagree, that’s fine, but the fact that you don’t understand the immense burden that a truly air gapped network would have on users and administrators speaks volumes of your own understanding of these types of systems and solutions.
  - Dalewyn 3y ago
    >I’m not suggesting it’s the same as an air gap. I’m suggesting that the solution sufficiently meets their requirements to do away with the need for a bona fide air gap. In fact, that’s what is implied by the quoted statement in the article. >You can rant on about how they should treat their data as as if they’re nuclear launch codes, but they’ve made a deliberate decision to implement a solution that is secure enough for their needs. Indeed, I disagree with The Guardian's assessment that virtualization is sufficient to protect their information. It's ultimately none of my business (literally so), though that won't stop me from being appalled at their callousness and I for one certainly won't provide them any information if I'm ever in such a position. More generally in regards to this thread, I am horrified that so many people genuinely think virtualization can be a replacement for air gapping. Especially in the wake of vulnerabilities like Specter/Meltdown and Rowhammer, among many others. >the fact that you don’t understand the immense burden I absolutely understand how much work is required to create and maintain an air gapped environment, and the sheer inconvenience and borderline impracticality using them imposes. I'm saying that handling sensitive information of this kind warrants all that and cannot be replaced by something easier, though I can sympathize with desires to do so because noone likes hard work.

If you are seriously suggesting a virtual machine is the same thing as an air gap, then no: You do not know what air gapping is. Not the least because there is literally no god damn gap with a virtual machine on a host computer. There is no way to guarantee there will be no unauthorized access or movement of data without a hard, physical gap requiring manual, scrutinized traversal. No amount of software or hardware mitigations can suffice. If Qubes is satisfactory for The Guardian, then they never needed air gapping in the first place. I find that hard to believe given what their job description is, but that is ultimately none of my business (though I won't give them any sensitive information, for the safety of both myself and others). Meanwhile, if you need air gapping then Qubes by itself absolutely cannot satisfy your security needs. Because a virtual machine is not an air gap.

jmprspret 3y ago
> If you are seriously suggesting a virtual machine is the same thing as an air gap You absolutely still have not read their comment.
greggsy 3y ago
I’m not suggesting it’s the same as an air gap. I’m suggesting that the solution sufficiently meets their requirements to do away with the need for a bona fide air gap. In fact, that’s what is implied by the quoted statement in the article. You can rant on about how they should treat their data as as if they’re nuclear launch codes, but they’ve made a deliberate decision to implement a solution that is secure enough for their needs. If you still disagree, that’s fine, but the fact that you don’t understand the immense burden that a truly air gapped network would have on users and administrators speaks volumes of your own understanding of these types of systems and solutions.
- Dalewyn 3y ago
  >I’m not suggesting it’s the same as an air gap. I’m suggesting that the solution sufficiently meets their requirements to do away with the need for a bona fide air gap. In fact, that’s what is implied by the quoted statement in the article. >You can rant on about how they should treat their data as as if they’re nuclear launch codes, but they’ve made a deliberate decision to implement a solution that is secure enough for their needs. Indeed, I disagree with The Guardian's assessment that virtualization is sufficient to protect their information. It's ultimately none of my business (literally so), though that won't stop me from being appalled at their callousness and I for one certainly won't provide them any information if I'm ever in such a position. More generally in regards to this thread, I am horrified that so many people genuinely think virtualization can be a replacement for air gapping. Especially in the wake of vulnerabilities like Specter/Meltdown and Rowhammer, among many others. >the fact that you don’t understand the immense burden I absolutely understand how much work is required to create and maintain an air gapped environment, and the sheer inconvenience and borderline impracticality using them imposes. I'm saying that handling sensitive information of this kind warrants all that and cannot be replaced by something easier, though I can sympathize with desires to do so because noone likes hard work.