5 ms·
Prior to my knowledge of Firefox profiles and multiaccount containers, I used tiny core to isolate my banking, shopping, general browsing, etc; from both each o
by ghjfrdghibt 2y ago
Prior to my knowledge of Firefox profiles and multiaccount containers, I used tiny core to isolate my banking, shopping, general browsing, etc; from both each other and my base OS, in virtualbox. I preferred it to other small distros like slitaz and puppy because it was really bare bones and easy to add to.
Now you'd likely just use docker, or like me profile and containers for compartmentalisation; aka super paranoia.
- yjftsjthsd-h 2y agoTo be fair, VMs are a better isolation mechanism; sort of like qubes but less extreme.
- nonrandomstring 2y agoIt's a bit of a mindset change, but yeah, you can start to think of operating systems not as big frameworks to run lots of applications, but as thin wrappers around single applications in an ecosystem like qemu+virsh. Clone a fresh template, install something in it, talk to it with sockets/tcp whatever.
- eduction 2y agoI think one qubes feature that could be profitably extracted are the disposable VMs, particularly for web browsing but also as a sort of default jail for potentially dodgy software. Like a right click “run this in a disposable vm” option in mainstream OSes. And run the built in web browser like that by default. Apple could probably come up with some spiffy branding. “Run this on an islandTM” or something like that. Call the feature “Archipelago.”
- fishgoesblub 2y agoIntroducing: Apple Iceberg™ Isolate your apps for enhanced security through Secure Containers™ on all MacOS™ systems
- wishfish 2y agoWouldn't Windows Sandbox come close? Easy to fire up and it all vanishes on exit.
- LeFantome 2y agoYou mean, like a Docker container?
- ElectricalUnion 2y agoNamespaces and jails share the host OS kernel. Assuming malicious applications, you don't want to expose your kernel, so those aren't safe enough.
- transpute 2y ago> one qubes feature that could be profitably extracted are the disposable VMs, particularly for web browsing but also as a sort of default jail for potentially dodgy software A similar feature ships on HP business PCs as HP SureClick based on uXen, derived from Bromium micro VMs, derived from Xen, which is used by Qubes. Also cloned by Microsoft in Windows as Application Defender Guard. Bromium isolated each tab of a web browser in a separate Windows VM with copy-on-write memory, and even individual network connections could be isolated in a micro-VM. A similar architecture has evolved on mobile phones as Android Virtualization Framework (AVF) with pKVM nested virt. Apple has taken baby steps in this direction, adding hardware nested virt on M2+ silicon, M3+ macOS and M4+ iPad Pro "Secure eXclave" micro-VM for camera LED indicator. While the underlying infrastructure is slowly being built to enable disposable VMs and other security improvements based on micro-VMs, one challenge is high-performance graphics composition of display output from the VM with the main desktop. Google has blazed an OSS trail with virtio and CrosVM on ChromeOS, which will hopefully be ported to Android with external display output. Since Apple controls both hardware and OS, they could add GPU hardware support for virtualization, removing any perceptible UX slowdown from micro VMs. Intel already added SR-IOV virtualization to Xe iGPUs.
- eduction 2y agoThanks, this is great overview of the space, I had no idea about all this. Maybe I should play with other OSes more beyond Mac and Qubes and Linux but configuring Qubes tends to take up all my extra OS time :-)
- mikedelfino 2y ago> I used tiny core to isolate my banking (...) in virtualbox. A few years ago, I tried something similar—not out of fear that malware might steal money from my bank account, but because my bank required me to install some kind of security software to access their internet banking on a PC. It turned out they don't like customers running their software in VMs. My account was completely blocked, including my debit card and ATM access. I had to visit a physical branch to resolve the issue. So I gave up on using internet banking on a PC and switched to their mobile app instead.
- matsz 2y agoRandom question but why would you not switch banks? I wouldn't want to be a customer of a business that clearly doesn't respect me.
- LargoLasskhyfv 2y agoOpportunity costs of changing stuff, lack of alternatives, and if there are, they are probably doing the same shit anyways...
- mikedelfino 2y agoThey're otherwise not terrible, and the limited banking I do works fine on the phone, so it didn’t bother me too much.
- penguin_booze 2y agoI would have taken the opportunity to "educate" them that that your use case is a legitimate one, and why they should teach their systems not to block users like that.
- fragmede 2y agoBecause mapping a very understandable security concern from the computer security department to the human concept of respect is nonsense.
- 2y ago