3 ms·

> All OSes in prod today need to be rebuilt from the ground up to be secure for the next century Qubes OS solves this with hardware virtualization, which is re

> All OSes in prod today need to be rebuilt from the ground up to be secure for the next century Qubes OS solves this with hardware virtualization, which is really fast and secure.

PhilipRoman 2y ago
Compartmentalization is only a part of the solution. Once you have that finished, you still need to deal with the actual vulnerabilities in guests, which will contain your secrets and be exposed to the internet, one way or another.
- fsflover 2y ago
  Guests don't have to be exposed to the Internet [0] or even run full OSes [1]. [0] https://www.qubes-os.org/doc/how-to-organize-your-qubes/ https://www.qubes-os.org/doc/how-to-organize-your-qubes/ [1] https://www.qubes-os.org/doc/templates/minimal/ https://www.qubes-os.org/doc/templates/minimal/
  - ylk 2y ago
    In what way are [1] not “full OSes”? They’re minimal templates, but afaik they still run systemd, the kernel, etc. needed to boot the standard Linux systems they are. When I clicked the link I was expecting something like a unikernel, eg https://roscidus.com/blog/blog/2016/01/01/a-unikernel-firewall-for-qubesos/ https://roscidus.com/blog/blog/2016/01/01/a-unikernel-firewa...
    - fsflover 2y ago
      You certainly can run distros without systemd [0] or something very different like *BSD or Mirage [2]. [0] https://forum.qubes-os.org/t/devuan-or-other-non-systemd-templates/14734 https://forum.qubes-os.org/t/devuan-or-other-non-systemd-tem... https://forum.qubes-os.org/t/alpine-linux-template-non-official-available-for-testing/20595 https://forum.qubes-os.org/t/alpine-linux-template-non-offic... [1] https://forum.qubes-os.org/t/openbsd-as-a-ubes-os-component/29978 https://forum.qubes-os.org/t/openbsd-as-a-ubes-os-component/... [2] https://forum.qubes-os.org/t/mirage-firewall-0-9-0-released/26030 https://forum.qubes-os.org/t/mirage-firewall-0-9-0-released/...
      - ylk 2y ago
        > You certainly can run distros without systemd Does it then become not a full OS anymore? Mirage is what I linked to above.
        fsflover 2y ago
        > Does it then become not a full OS anymore? Probably not. I mentioned it, because you mentioned systemd. And yes, I saw your Mirage link and showed how you can use it on Qubes.
paulryanrogers 2y ago
Qubes is nigh impossible for normal users, even if setup for them. They need extension training and discipline.
- fsflover 2y ago
  If you set it up, users can run anything themselves. Just use the start menu and the apps will automatically run in the corresponding VMs (shown as windows with colored borders).
  - yadaeno 2y ago
    Anything, except for practical applications that people actually use. * music production software * discord * games * copy and pasting
    - fsflover 2y ago
      Everything that works on Linux will generally work on Qubes, apart from the GPU-heavy applications [0], which will be addressed in the future [1]. Copying and pasting works fine [2]. OK, music production may not be possible at the moment [3]. [0] https://www.qubes-os.org/faq/#can-i-run-applications-like-games-which-require-hardware-acceleration https://www.qubes-os.org/faq/#can-i-run-applications-like-ga... [1] https://github.com/QubesOS/qubes-issues/issues/8552 https://github.com/QubesOS/qubes-issues/issues/8552 [2] https://www.qubes-os.org/doc/how-to-copy-and-paste-text/ https://www.qubes-os.org/doc/how-to-copy-and-paste-text/ [3] https://forum.qubes-os.org/t/question-quality-of-external-usb-audio-device-dac/15088 https://forum.qubes-os.org/t/question-quality-of-external-us...
      - rustcleaner 2y ago
        I run LM-Studio and [can run] Siemens PLM NX inside a Windows Server qube. GPU passthrough is no issue for me at least.
    - rustcleaner 2y ago
      Can't comment on music production since I don't produce music (could be the need for realtime). Discord runs fine both in-browser and in application. Raptor Lake seems to have zero issue with video voice chat, whereas Comet Lake can drag a bit in large rooms without a GPU. Qubes OS makes it dirt easy to multiprofile from all around the world. I don't really game like others do; eye candy doesn't draw me in, but solving interesting puzzles/challenges does. Copy & paste is superior in Qubes, skill issue sorry not-sorry. GIT GUD!

> All OSes in prod today need to be rebuilt from the ground up to be secure for the next century Qubes OS solves this with hardware virtualization, which is really fast and secure.

PhilipRoman 2y ago

Compartmentalization is only a part of the solution. Once you have that finished, you still need to deal with the actual vulnerabilities in guests, which will contain your secrets and be exposed to the internet, one way or another.

fsflover 2y ago
Guests don't have to be exposed to the Internet [0] or even run full OSes [1]. [0] https://www.qubes-os.org/doc/how-to-organize-your-qubes/ https://www.qubes-os.org/doc/how-to-organize-your-qubes/ [1] https://www.qubes-os.org/doc/templates/minimal/ https://www.qubes-os.org/doc/templates/minimal/
- ylk 2y ago
  In what way are [1] not “full OSes”? They’re minimal templates, but afaik they still run systemd, the kernel, etc. needed to boot the standard Linux systems they are. When I clicked the link I was expecting something like a unikernel, eg https://roscidus.com/blog/blog/2016/01/01/a-unikernel-firewall-for-qubesos/ https://roscidus.com/blog/blog/2016/01/01/a-unikernel-firewa...
  - fsflover 2y ago
    You certainly can run distros without systemd [0] or something very different like *BSD or Mirage [2]. [0] https://forum.qubes-os.org/t/devuan-or-other-non-systemd-templates/14734 https://forum.qubes-os.org/t/devuan-or-other-non-systemd-tem... https://forum.qubes-os.org/t/alpine-linux-template-non-official-available-for-testing/20595 https://forum.qubes-os.org/t/alpine-linux-template-non-offic... [1] https://forum.qubes-os.org/t/openbsd-as-a-ubes-os-component/29978 https://forum.qubes-os.org/t/openbsd-as-a-ubes-os-component/... [2] https://forum.qubes-os.org/t/mirage-firewall-0-9-0-released/26030 https://forum.qubes-os.org/t/mirage-firewall-0-9-0-released/...
    - ylk 2y ago
      > You certainly can run distros without systemd Does it then become not a full OS anymore? Mirage is what I linked to above.
      - fsflover 2y ago
        > Does it then become not a full OS anymore? Probably not. I mentioned it, because you mentioned systemd. And yes, I saw your Mirage link and showed how you can use it on Qubes.

paulryanrogers 2y ago

Qubes is nigh impossible for normal users, even if setup for them. They need extension training and discipline.

fsflover 2y ago
If you set it up, users can run anything themselves. Just use the start menu and the apps will automatically run in the corresponding VMs (shown as windows with colored borders).
- yadaeno 2y ago
  Anything, except for practical applications that people actually use. * music production software * discord * games * copy and pasting
  - fsflover 2y ago
    Everything that works on Linux will generally work on Qubes, apart from the GPU-heavy applications [0], which will be addressed in the future [1]. Copying and pasting works fine [2]. OK, music production may not be possible at the moment [3]. [0] https://www.qubes-os.org/faq/#can-i-run-applications-like-games-which-require-hardware-acceleration https://www.qubes-os.org/faq/#can-i-run-applications-like-ga... [1] https://github.com/QubesOS/qubes-issues/issues/8552 https://github.com/QubesOS/qubes-issues/issues/8552 [2] https://www.qubes-os.org/doc/how-to-copy-and-paste-text/ https://www.qubes-os.org/doc/how-to-copy-and-paste-text/ [3] https://forum.qubes-os.org/t/question-quality-of-external-usb-audio-device-dac/15088 https://forum.qubes-os.org/t/question-quality-of-external-us...
    - rustcleaner 2y ago
      I run LM-Studio and [can run] Siemens PLM NX inside a Windows Server qube. GPU passthrough is no issue for me at least.
  - rustcleaner 2y ago
    Can't comment on music production since I don't produce music (could be the need for realtime). Discord runs fine both in-browser and in application. Raptor Lake seems to have zero issue with video voice chat, whereas Comet Lake can drag a bit in large rooms without a GPU. Qubes OS makes it dirt easy to multiprofile from all around the world. I don't really game like others do; eye candy doesn't draw me in, but solving interesting puzzles/challenges does. Copy & paste is superior in Qubes, skill issue sorry not-sorry. GIT GUD!