3 ms·
This is, unfortunately, the sort of thing that motivates QubesOS. We are, as humans writing code, not good at complexity, and as Apple's lockdown mode admits,
by Syonyk 2y ago
This is, unfortunately, the sort of thing that motivates QubesOS. We are, as humans writing code, not good at complexity, and as Apple's lockdown mode admits, parsing complicated stuff, even when you design security boundaries around it, is hard to do properly. Lockdown just punts a ton of complexity entirely out of the system, and the tradeoff is rather substantially improved security against a wide class of attacks.
QubesOS design philosophy is essentially, "Everything in a booted OS image must be assumed to be able to, some way or another, access everything else in there." So you have various silos that have extremely limited communication between them (you can "push" from one VM to another, but you can never "pull" from another VM, the framebuffer is simple, etc). You're totally free to add sandboxing as useful, but it's not considered a full security boundary. Hardware virtualized VMs are, on a fairly stripped down Xen that removes a lot of attack surface in terms of legacy device emulation and other features they don't need.
Apple has done a lot of security focused improvements over the years, but modern computers and OSes are just so complicated that even they struggle to get it right regularly. And the attackers only need one mistake to achieve their goals. :(
//EDIT: As far as practicality goes, I do daily drive QubesOS as my main computer on a 2C/4T laptop with 16GB RAM - old X250. There are plenty of things it's not great at, but I'm not heavy on the "videos or video games" thing anyway. Dual booting for gaming is an option, as is a separate desktop that doesn't do anything important for gaming, but you don't need some monster machine to do practical things with Qubes. I can't have a thousand browser tabs open, but I don't do that anyway, I browse "JITless" (disable Javascript JIT as it's a ton of attack surface that's regularly exploited), and... it's a less-intense form of computer use than standard, but it also means I don't have a desire to spend all my time on a computer.
- normie3000 2y agoInteresting set up, thanks for sharing. Do you write code, or use docker at all?
- Syonyk 2y agoI write code, yes. I'll just spin up a development VM as needed, things work fine. I don't use Docker, but as long as you're not using the hardware virtualized modes, it should work just fine on namespaces. Every VM is running a full featured Linux kernel. There's just not nested virtualization support, which I'm totally fine with, because nested virtualization on x86 is a rather complex mess to get right. The main thing you lose is GPU acceleration. I don't particularly care.
- deleted 2y ago[deleted]
- rustcleaner 2y agoI argue never dual-boot Qubes [with it installed on an internal drive] because Windows can [theoretically] read those partitions. Better to just get a separate application-specific system for gaming. I daily drive Qubes on i7 Comet and Raptor Lakes, 64GB and 128GB RAM respectively. I run LLMs on their GTX and RTX cards (albeit slowly on the Comet Lake/GTX system). Digital crac... err gaming is the only thing I am pretty well locked out from.
- Syonyk 2y agoIt really depends on your threat modeling and what you're concerned about. I agree, dual booting isn't ideal, but also, "dual booting Qubes and Ubuntu for gaming" cannot be any worse than "simply running everything on Ubuntu," as long as you don't believe Qubes is impervious to anything nasty in that configuration. The main storage partitions are encrypted for Qubes (... or had better be, I guess you could avoid that, but why?), so the dual booting attack path would have to be through the boot partition, load something that can then compromise the install. It's a fairly specific sort of attack that, if someone's coming after you with that, it's probably a question of "How and when you're screwed, not if." But for general users, I think dual booting is an acceptable compromise. Just don't do much of anything in the other install! I dual boot my laptop. There are a handful of things that are far easier to do in Ubuntu than Qubes (movies on a long flight, run a Windows VM to run particular software to talk to cars, and Minecraft for LAN parties). I'm aware of the risks, and don't consider them to be enough to remove the ability to do a few other things on one machine. I try not to have too large of piles of single purpose computers these days...
- YetAnotherNick 2y agoFor me, everything important I have could be accessed from browser(as I do full system backup) and the cookie I have in browser could allow the app to access my data. How does QubesOS help in this scenario?