8 ms·

Qubes OS: A reasonably secure operating system

175 points by doener 2y ago

gjsman-1000 2y ago
I would say, a little more hesitantly, that it deeply depends on what you are doing. When interacting remotely with untrusted services, apps, or documents, Qubes cannot be beaten. However, if I was afraid of my laptop getting attacked with an evil maid attack, I’m sticking with my Mac, Secure Boot, and FileVault; so that my Lock Screen is less likely to be patched against me. If I’m afraid of persistent malware, I want a platform that isn’t necessarily game over if the malware gets sudo privileges once. If I’m afraid of PIN guessing attempts to break in by brute force, I want something like a modern iPhone where the guessing limit is hardware enforced, not a Linux phone where it’s software enforced. Same for if I were in a country with a hostile government. Nothing screams “I’m hiding something and I’m malicious” like using GrapheneOS or Qubes in Russia or China. They might not see your work, but the uncommon choices by itself makes you suspect. An iPhone and Mac over there suggests wealth, and would possibly socially increase your benefit of the doubt due to white collar associations; GrapheneOS and Qubes would shred all benefit of doubt you may have enjoyed. I sometimes think of the Tor incident at a US College. I’m not encouraging this behavior, but a college student sent bomb threats to his university. He was identified, arrested, and convicted because he was the only one using Tor on the university network. A perfect example of how the “more secure” thing used without strategy can shoot yourself in the foot. The point is: If you are reporting on military activity in the Donetsk region, don’t be the only person in the area using Qubes and Tor. Don’t be the only person in the area with a phone pinging GrapheneOS update servers, or a laptop pinging Qubes package repositories. Heck, don’t be the only guy with a phone on the cell network identifying as Android that inexplicably never talks to Google.
- accassar 2y ago
  https://www.qubes-os.org/doc/anti-evil-maid/ https://www.qubes-os.org/doc/anti-evil-maid/
  - sudohackthenews 2y ago
    AEM is a little sketchy though, you need to trust a flash drive to hold it, and make sure that drive doesn’t get overridden by a malicious attacker. Your link goes more into depth about the disadvantages
    - transpute 2y ago
      In some threat models, it's more feasible to protect a portable flash/SSD drive than an entire laptop. In other threat models, laptops/tablets/phones could be physically secured in a safe, or kept under direct physical supervision.
      - sudohackthenews 2y ago
        Yeah, that’s what I was alluding to. I think the OPs point still holds here- both of those are quite a bit harder than the built in Mac solution
  - mrtesthah 2y ago
    How about Heads? https://osresearch.net/ https://osresearch.net/ https://forum.qubes-os.org/t/what-makes-heads-so-great-when-combined-with-qubesos/26779 https://forum.qubes-os.org/t/what-makes-heads-so-great-when-...
- Fnoord 2y ago
  > When interacting remotely with untrusted services, apps, or documents, Qubes cannot be beaten. Sums up WWW. But I believe you could use a VM or container and use such. For example, with Whonix (which also works in Qubes!) What I'd like is use such in macOS but alas Jobs & Cook ask premium price for RAM on Macs. With regards to Donetsk example (I like the example). There is a good reason being hidden in plain sight is blending in with masses. It is difficult to get such OPSEC right, and you need to consider different techniques for if one gets burned.
- andy_ppp 2y ago
  How stupid, if you’re going to send bomb threats do it from someone else’s computer…
- mjg59 2y ago
  It's probably worth mentioning that secure boot is trivially circumventable given physical access on any Intel Mac (including T2 Macs), so you want at least an M1 to feel safer here
- Dalewyn 2y ago
  There's an age old saying in Japan that if you want to hide a tree you should do so in a forest.
- woctordho 2y ago
  In China we have ways to obfuscate those unusual traffic into usual ones like WeChat video calling
irundebian 2y ago
Have used it for several months as my daily OS and dropped it because of bad graphics performance (only software rendering supported, many frame drops when watching HD videos on YT) and bad battery management. Due to software rendering the overall systems perfmance also dropped. So I cannot recommend it for people with high requirements on graphics and battery duration. Besides that it was an interesting and good experience. I think it would be good to make it possible to deactivate certain security features such as strict graphics isolation so that users can adjust their settings to their risk acceptance level. It would also be interesting to be able to optionally replace Xen with lighter isolation mechanisms, even if the user would compromise on security here too.
- samoit 2y ago
  I think you do have GPU acceleration in the Dom0 but I do not remember if you can use/install programs on it, it was the "coordinator" dom.
- NegativeK 2y ago
  Given the tendency for people to lower their unknowingly compromise their security for the sake of convenience, I can understand why a project wouldn't do that. Knowingly is different and is what you're requesting -- it's when someone is following some Stack Overflow post or some such and doesn't have the training (similarly with the SO commenter, potentially) to know the implications. It kind of feels like a tradeoff between protecting users who are critically in need of something like Qubes or expanding its reach to people who are less at risk and won't use it if it's too inconvenient.
- Dalewyn 2y ago
  >bad graphics performance (only software rendering supported, many frame drops when watching HD videos on YT) It might help if you used a computer with CPU horsepower that actually exists. And in case this sounded facetious, any reasonable CPU from the past 15 years can handle software decoding of high resolution video just fine. This all said however, if you do actually need full use of all hardware resources then being constrained to software is certainly a factor worth considering.
zvmaz 2y ago
With zero-click exploits that we certainly do not know of, Qubes OS offers some peace of mind.
- armSixtyFour 2y ago
  Unless there's a zero day in Xen in which case the entire security model falls apart. With all these cloud providers using Xen, I have no doubt that there's already one out there.
  - zvmaz 2y ago
    This is true. But the code base of Xen is significantly smaller than that of a full operating system running bare metal, so the likeliness of a zero-day comprising Qubes is less likely (but possible).
  - abtinf 2y ago
    If there is a zero day in Xen, your attackers are probably also going to be having a very, very bad day.
  - fsflover 2y ago
    > Unless there's a zero day in Xen Most of the time, zero days in Xen do not affect Qubes: https://www.qubes-os.org/security/xsa/#statistics https://www.qubes-os.org/security/xsa/#statistics
behnamoh 2y ago
A simple screenshot of the OS environment would have been nice. But generally, I don't think people adopt operating systems just by seeing new recommendations on Hacker News or different forums. Most people have settled on macOS and then Linux and then Windows. and within the Linux ecosystem most people just use Ubuntu or Fedora and that's it. I don't see anyone using these other esoteric operating systems as a daily driver. For servers it's a different story. We have OpenBSD and FreeBSD. and of course Linux. But that's about it. Even supercomputers run Linux. creating an operating system in 2025, aside from intellectual curiosity, isn't really pragmatic.
- schoen 2y ago
  Qubes was created in 2012! It mostly runs Linux applications.
  - accassar 2y ago
    Runs Windows pretty well! I find that very convenient. https://www.qubes-os.org/doc/templates/windows/ https://www.qubes-os.org/doc/templates/windows/
- wongarsu 2y ago
  CubesOS is the choice if you need a very high level of security, are willing to accept some workflow changes to achieve that, but still want a modern graphical operating system that runs all your normal software in a unified workspace. Nothing else provides a similar mix of security and usability. The alternatives are either much less secure or have much worse usability. Of course only few people have these kinds of requirements. I'd recommend Qubes OS if you are an investigative journalist or working in offensive or defensive IT security. Everyone else can safely ignore it. Still, even if it's not made for most of us it makes interesting design decisions that are very much of interest to this forum. And a lot of the people it is made for are here too
- johannes1234321 2y ago
  > A simple screenshot of the OS environment would have been nice. https://www.qubes-os.org/screenshots/ https://www.qubes-os.org/screenshots/
DrWhax 2y ago
QubesOS was my main driver for a couple of years, but I have to say that the low battery life compared to only software rendering got pretty annoying after a while. Depending on the hardware, you'll need to possibly disable certain options in the BIOS/UEFI, like for an t490 that I documented: https://groups.google.com/g/qubes-users/c/Z0Kfm53zMxQ/m/IV-AeXE0FAAJ https://groups.google.com/g/qubes-users/c/Z0Kfm53zMxQ/m/IV-A...
- zvmaz 2y ago
  What to use instead if one cares about privacy and security (what I call personal sovereignty)? It's a non-rhetorical question.
  - llm_trw 2y ago
    You use qubes and eat the loss of battery life.
    - barbs 2y ago
      Or maybe Tails?
  - nullc 2y ago
    The only serious alternative to Qubes from a security perspective is to use multiple computers. That alternative presumably has better security, but also generally worse usability (particularly if you're going to be mobile! -- two laptops in your bag might be acceptable but comparable isolation would require more than two).
    - fsflover 2y ago
      > That alternative presumably has better security Not necessarily: https://www.qubes-os.org/faq/#how-does-qubes-os-compare-to-using-a-separate-physical-machine https://www.qubes-os.org/faq/#how-does-qubes-os-compare-to-u...
Crontab 2y ago
Even though I never used Qubes OS I used to really enjoy Joanna Rutkowska's passion for it. Other women who's computing enthusiasm I enjoyed was Jessie Frazelle's writing and speaking about running everything in Docker on her laptop and Sacha Chua's love for Emacs.
- oswalk 2y ago
  [flagged]
  - NathanielK 2y ago
    Why do you think you need to clarify that?
- Fnoord 2y ago
  There's a lot of awesome females in the infosec community. Check out the podcast Darknet Diaries for a glimpse. Some of the coolest red teaming podcasts were (IMO) with women. In this context, I'd like to mention Dr. Melanie Rieback. She is 'the CEO/Co-founder of Radically Open Security, the world’s first non-profit computer security consultancy company.' Previously in the 00's known for her research in RFID security. Or have a look at hack conferences such as recently 38C3.
- nine_k 2y ago
  Let me also add the brilliant https://justine.lol https://justine.lol
dang 2y ago
Related. Others? Converting untrusted PDFs into trusted ones: The Qubes Way (2013) - https://news.ycombinator.com/item?id=42401904 https://news.ycombinator.com/item?id=42401904 - Dec 2024 (45 comments) Why one would use Qubes OS? (2023) - https://news.ycombinator.com/item?id=42200987 https://news.ycombinator.com/item?id=42200987 - Nov 2024 (16 comments) Counter argument against QubesOS more secure by being a type 1 hypervisor - https://news.ycombinator.com/item?id=41401318 https://news.ycombinator.com/item?id=41401318 - Aug 2024 (1 comment) Qubes OS 4.2.2 has been released - https://news.ycombinator.com/item?id=40959109 https://news.ycombinator.com/item?id=40959109 - July 2024 (5 comments) Working with Qubes OS at the Guardian - https://news.ycombinator.com/item?id=39949882 https://news.ycombinator.com/item?id=39949882 - April 2024 (74 comments) Qubes OS 4.2.1 has been released - https://news.ycombinator.com/item?id=39833245 https://news.ycombinator.com/item?id=39833245 - March 2024 (11 comments) A modest update to Qubes OS - https://news.ycombinator.com/item?id=39490264 https://news.ycombinator.com/item?id=39490264 - Feb 2024 (31 comments) Qubes OS 4.2.0 has been released - https://news.ycombinator.com/item?id=38690597 https://news.ycombinator.com/item?id=38690597 - Dec 2023 (21 comments) QubesOS – A reasonably secure operating system - https://news.ycombinator.com/item?id=36684946 https://news.ycombinator.com/item?id=36684946 - July 2023 (135 comments) Qubes OS 4.2-rc1 is available for testing - https://news.ycombinator.com/item?id=36178205 https://news.ycombinator.com/item?id=36178205 - June 2023 (3 comments) New user guide: How to organize your qubes - https://news.ycombinator.com/item?id=33396604 https://news.ycombinator.com/item?id=33396604 - Oct 2022 (15 comments) Opsec considerations when using WiFi - https://news.ycombinator.com/item?id=32148920 https://news.ycombinator.com/item?id=32148920 - July 2022 (2 comments) What Is Qubes OS? - https://news.ycombinator.com/item?id=32036899 https://news.ycombinator.com/item?id=32036899 - July 2022 (82 comments) Automated OS testing on physical laptops - https://news.ycombinator.com/item?id=31281107 https://news.ycombinator.com/item?id=31281107 - May 2022 (4 comments) Qubes OS: A reasonably secure operating system - https://news.ycombinator.com/item?id=30776103 https://news.ycombinator.com/item?id=30776103 - March 2022 (97 comments) Qubes OS 4.1.0 has been released - https://news.ycombinator.com/item?id=30215210 https://news.ycombinator.com/item?id=30215210 - Feb 2022 (1 comment) Ask HN: Qubes OS or just separate VMs for separating work and private files? - https://news.ycombinator.com/item?id=29537961 https://news.ycombinator.com/item?id=29537961 - Dec 2021 (6 comments) Qubes OS 4.1-rc1 has been released - https://news.ycombinator.com/item?id=28856957 https://news.ycombinator.com/item?id=28856957 - Oct 2021 (5 comments) Qubes OS 4.0 has been released - https://news.ycombinator.com/item?id=16699900 https://news.ycombinator.com/item?id=16699900 - March 2018 (39 comments) Qubes OS: A reasonably secure operating system - https://news.ycombinator.com/item?id=15734416 https://news.ycombinator.com/item?id=15734416 - Nov 2017 (144 comments) Reasonably Secure Computing in the Decentralized World - https://news.ycombinator.com/item?id=15566563 https://news.ycombinator.com/item?id=15566563 - Oct 2017 (44 comments) Toward a Reasonably Secure Laptop - https://news.ycombinator.com/item?id=14743238 https://news.ycombinator.com/item?id=14743238 - July 2017 (100 comments) “Paranoid Mode” Compromise Recovery on Qubes OS - https://news.ycombinator.com/item?id=14218504 https://news.ycombinator.com/item?id=14218504 - April 2017 (14 comments) Qubes OS Begins Commercialization and Community Funding Efforts - https://news.ycombinator.com/item?id=13069615 https://news.ycombinator.com/item?id=13069615 - Nov 2016 (24 comments) Qubes OS 3.2 has been released - https://news.ycombinator.com/item?id=12604417 https://news.ycombinator.com/item?id=12604417 - Sept 2016 (30 comments) Security challenges for the Qubes build process - https://news.ycombinator.com/item?id=11801093 https://news.ycombinator.com/item?id=11801093 - May 2016 (17 comments) Qubes OS 3.1 has been released - https://news.ycombinator.com/item?id=11260857 https://news.ycombinator.com/item?id=11260857 - March 2016 (44 comments) Converting untrusted PDFs into trusted ones: The Qubes Way (2013) - https://news.ycombinator.com/item?id=10538888 https://news.ycombinator.com/item?id=10538888 - Nov 2015 (5 comments) Intel x86 considered harmful – survey of attacks against x86 over last 10 years - https://news.ycombinator.com/item?id=10458318 https://news.ycombinator.com/item?id=10458318 - Oct 2015 (169 comments) Qubes – Secure Desktop OS Using Security by Compartmentalization - https://news.ycombinator.com/item?id=8428453 https://news.ycombinator.com/item?id=8428453 - Oct 2014 (49 comments) Introducing Qubes 1.0 ("a stable and reasonably secure desktop OS") - https://news.ycombinator.com/item?id=4472403 https://news.ycombinator.com/item?id=4472403 - Sept 2012 (59 comments) Qubes: an open source OS with strong security for desktop computing - https://news.ycombinator.com/item?id=2645170 https://news.ycombinator.com/item?id=2645170 - June 2011 (16 comments) Review: Qubes OS Beta 1 — a new and refreshing approach to system security - https://news.ycombinator.com/item?id=2504274 https://news.ycombinator.com/item?id=2504274 - May 2011 (1 comment) The Linux Security Circus: On GUI isolation - https://news.ycombinator.com/item?id=2477667 https://news.ycombinator.com/item?id=2477667 - April 2011 (47 comments) Qubes Beta 1 has been released (strong desktop security OS) - https://news.ycombinator.com/item?id=2439096 https://news.ycombinator.com/item?id=2439096 - April 2011 (3 comments) Qubes Architecture - actual security-oriented OS - https://news.ycombinator.com/item?id=1796384 https://news.ycombinator.com/item?id=1796384 - Oct 2010 (1 comment) Open source Qubes OS is ultra secure - https://news.ycombinator.com/item?id=1249857 https://news.ycombinator.com/item?id=1249857 - April 2010 (7 comments) Introducing Qubes OS - https://news.ycombinator.com/item?id=1246990 https://news.ycombinator.com/item?id=1246990 - April 2010 (20 comments)
patrakov 2y ago
It does not matter in the real world whether the vendor declares it secure. Did it help anyone pass any kind of security audit? In other words, do auditors recognize it as a valid environment for working with potentially malicious documents, or only as a toy?
- adastra22 2y ago
  Three points: (1) Qubes is open-source. (2) Qubes is written and maintained by security professionals. (3) Most (all?) security audits are worse than useless.
tasn 2y ago
I've always wanted to switch to qubes, but it just feels so constraining. It's safer to never leave the house, but I don't want to live in a self imposed prison. On the other hand, the isolation provided by containers and flatpak is more accessible, but with a much larger attack vector. Maybe we need immutable OS + an audit layer on anything that could allow exploits to persist (bashrc and the likes).
- flubbergusto 2y ago
  [dead]
- irundebian 2y ago
  After Qubes OS I ended up using Fedora with Wayland, Flatpaks and running applications as different users but this introduced other problems. The security profiles of many "flatpacked" applications are quite permissive (see https://flatkill.org/ https://flatkill.org/) so that they could be circumvented. Besides that I'm experience some convenience issues when accessing files on my drive. It's especially annoying when using "flatpacked" office such as onlyoffice.
- bobertlo 2y ago
  I just really appreciate separating things like access credentials from things like web browsers without running multiple accounts. I do all my most and least secure activities on Qubes and use other computers for a lot of the other stuff in between.
pgaddict 2y ago
I'm using Qubes OS as my primary for years - I think I started with the 2.0 release in 2014 (I might have tried/used the 1.0 release, I don't recall.) and I was immediately hooked. I understand the usual story is that the goal is security benefits, and the compartmentalization (or rather the implied inconvenience) is the price for that. But for me the compartmentalization turned out to be a benefit on it's own, and actually convenient. I find it extremely convenient to have multiple isolated / virtual workspaces for different stuff, even if you assume attackers / malice do not exist. Having separate VMs is not the same as having separate folders. I also love the VM templates, which allow me to do all kinds of experiments (e.g. install packages in the app VM, which disappear after restart). Or run VMs with a mix of distros/versions/... Yes, I could do some of that with plain VMs, but Qubes integrates that in a way that I find very convenient. The commands for copying stuff between VMs are muscle memory at this point. Yes, there are limitations, like the lack of GPU acceleration. But movies in 1080p play just fine without it, and I'm not a gamer, so I don't mind much. I can't play with CUDA etc. on these QubesOS machines, and scrolling web pages with large images is laggy, but I find this to be an acceptable price. I went through multiple laptops / workstations over the years, and the situation improved a lot I think. Initially I had to solve quite a few issues with installer, some hardware not working (or requiring setting something special), or poor battery life on the laptops. But after a while that mostly either went away, especially once I switched to laptops with official Linux support (Dell Precision were good, I'm on Thinkpad P1 G7 now). The battery life is pretty decent too (especially once I disabled HT in BIOS). Is it perfect for everyone? No, certainly not. But it sure is great for me, and I hope they keep working on it.
- vigilans 2y ago
  I’m in the same boat. Love the compartmentalization and being able to route VMs to different network backends and the ability to create ephemeral domains for quick tasks. Thank you Joanna, Marek, Andrew, and all the wonderful contributors. I couldn’t live without Qubes.
- irundebian 2y ago
  > scrolling web pages with large images is laggy Now that I've read this, I can also remember that I was also annoyed by jerks when scrolling web pages. I also found the backup management too complicated. I didn't want to back up entire VMs, just the data within the VMs. In principle, I would have had to start up all VMs for backups and run a backup script for each individual VM.
nullc 2y ago
I am a Qubes user for a couple years now, and I wish I'd switched to it years earlier. Basically every criticism you hear is about correct-- principally worse graphics performance and battery life. But the performance issues for me were less bad than I expected, and the seamlessness of its usability was much much higher than I expected. Like copy and paste, moving files between VMs, plugging usb devices into VMs, networking, etc. all pretty much just work. It's pretty impressive if you have any idea of the machinery under the hood needed to make that work. And now I don't feel anywhere near as nervous that whatever vendor program I need to use to configure a device or browser zero day is going to compromise my system. I can read documents from adverse threat actor sources in a netless VM and feel reasonably confident that it can't phone home or steal my data, etc. Obviously it doesn't replace real air gap security, but it's the closest thing you can get to a network of airgapped or firewalled per-application computers which you can fit into a laptop bag. I also like that I can use software that really only works right on fedora/redhat along side software that really only works right on debian. (Or windows, for that matter, but it's not as seamless). I like that I can substantially upgrade my operating system while running--- like I went from fedora40 to 41 just by installing the template, and switching over appvms one at a time. If anything goes wrong it's trivial to roll back, and I can have some app vms that work fine on the new stuff while others are held back if there is a compatibility issue. I like that applications that go nuts and try to use all my memory only screw up the VM that they're in instead of my whole system. It's so nice that when I want to get something working I can spin up a vm and scribble all over it until I get it working. Binary patch my libc, whatever. Then once I've solved it, I can apply the final clean solution to a persistent template. Any random experimentation just goes away when I close the appvm. Need some program just for a single thing? install it in the appvm rather than the template and it naturally is gone later. I can be intentional about changes being either ephemeral or persistent, and never have to worry that the removal of something temporary was incomplete. Of course YMMV, -- if you're someone who is mostly doing text and low performance graphics and can run it on a fast computer then its costs will be small. If you'd find a ten year old computer perfectly usable chances are that qubes on a modern computer won't seem slow or poor battery lifed to you. Particularly if you have other computers for games, 3d gfx, full screen video, etc. If you are someone who has been subjected to targeted hacking attempts the increased peace of mind will be substantial.
udev4096 2y ago
We wouldn't have to rely on security by hypervisor if linux had proper security measures, sandboxing and access controls OOTB. Qubes is still far from good although it's slowly getting there
- dijit 2y ago
  what are you talking about? Of course we do? We totally forgotten about mandatory access control systems? AppArmor, SELinux? problem isn’t that they don’t exist; it’s that nobody knows how to use them properly. You can even minimise the kernel attack surface these days with utilities like gVisor. people just understand virtual machines easier. It’s easy to understand the isolation it gives and easier to reduce unnecessary potential attack vectors by having minimal images that don’t contain more than necessary.
  - udev4096 2y ago
    "OOTB" is the term you missed. Obviously, there are kernel features such as seccomp and other LSM but it's not easy to properly configure. Even if you do, it usually comes in your way of getting stuff done. Regarding gvisor, it's solid and I've been intending to use it on k3s
  - i_love_retros 2y ago
    Am I wrong in thinking that Ubuntu has apparmor configured by default?
    - mmh0000 2y ago
      Yes, Ubuntu has AppArmor and Fedora (RHEL, et. al.) have SELinux. The problem is that both systems are quite difficult to use properly. The out-of-the-box configuration is good for a base increase in overall system security against common threats. However, if you want the real isolation benefits that these MAC systems are capable of providing, you'll need a full-time security team with years of training to manage your personal desktop.
aborsy 2y ago
It’s great for compartmentalizing the work, even if security is not important. The UI was surprisingly good when I used it.
mikewarot 2y ago
Since it doesn't look like Genode is going to be ready to be a daily driver for a while, Qubes looks like something ALMOST capabilities based that I could live with. Some day I'll just be able to run stuff without worry.... but it's not going to be any time soon. Can I run old versions of stuff like MS-DOS or Windows 3.1 under it? Or my beloved Windows 2000? Windows 2000 with Office 2000 pro (with the patches to read the new office 2007 formats) would be awesome. I miss outliner mode in Word 2000.
- czk 2y ago
  you can with dosbox/pcem or something similar (dont think modern xen handles 16bit virtualization) -- but you can definitely run Windows 2000 in a VM on Qubes, but the windows tools are not supported on anything under 7

175 points by doener 2y ago

I would say, a little more hesitantly, that it deeply depends on what you are doing. When interacting remotely with untrusted services, apps, or documents, Qubes cannot be beaten. However, if I was afraid of my laptop getting attacked with an evil maid attack, I’m sticking with my Mac, Secure Boot, and FileVault; so that my Lock Screen is less likely to be patched against me. If I’m afraid of persistent malware, I want a platform that isn’t necessarily game over if the malware gets sudo privileges once. If I’m afraid of PIN guessing attempts to break in by brute force, I want something like a modern iPhone where the guessing limit is hardware enforced, not a Linux phone where it’s software enforced. Same for if I were in a country with a hostile government. Nothing screams “I’m hiding something and I’m malicious” like using GrapheneOS or Qubes in Russia or China. They might not see your work, but the uncommon choices by itself makes you suspect. An iPhone and Mac over there suggests wealth, and would possibly socially increase your benefit of the doubt due to white collar associations; GrapheneOS and Qubes would shred all benefit of doubt you may have enjoyed. I sometimes think of the Tor incident at a US College. I’m not encouraging this behavior, but a college student sent bomb threats to his university. He was identified, arrested, and convicted because he was the only one using Tor on the university network. A perfect example of how the “more secure” thing used without strategy can shoot yourself in the foot. The point is: If you are reporting on military activity in the Donetsk region, don’t be the only person in the area using Qubes and Tor. Don’t be the only person in the area with a phone pinging GrapheneOS update servers, or a laptop pinging Qubes package repositories. Heck, don’t be the only guy with a phone on the cell network identifying as Android that inexplicably never talks to Google.

accassar 2y ago
https://www.qubes-os.org/doc/anti-evil-maid/ https://www.qubes-os.org/doc/anti-evil-maid/
- sudohackthenews 2y ago
  AEM is a little sketchy though, you need to trust a flash drive to hold it, and make sure that drive doesn’t get overridden by a malicious attacker. Your link goes more into depth about the disadvantages
  - transpute 2y ago
    In some threat models, it's more feasible to protect a portable flash/SSD drive than an entire laptop. In other threat models, laptops/tablets/phones could be physically secured in a safe, or kept under direct physical supervision.
    - sudohackthenews 2y ago
      Yeah, that’s what I was alluding to. I think the OPs point still holds here- both of those are quite a bit harder than the built in Mac solution
- mrtesthah 2y ago
  How about Heads? https://osresearch.net/ https://osresearch.net/ https://forum.qubes-os.org/t/what-makes-heads-so-great-when-combined-with-qubesos/26779 https://forum.qubes-os.org/t/what-makes-heads-so-great-when-...
Fnoord 2y ago
> When interacting remotely with untrusted services, apps, or documents, Qubes cannot be beaten. Sums up WWW. But I believe you could use a VM or container and use such. For example, with Whonix (which also works in Qubes!) What I'd like is use such in macOS but alas Jobs & Cook ask premium price for RAM on Macs. With regards to Donetsk example (I like the example). There is a good reason being hidden in plain sight is blending in with masses. It is difficult to get such OPSEC right, and you need to consider different techniques for if one gets burned.
andy_ppp 2y ago
How stupid, if you’re going to send bomb threats do it from someone else’s computer…
mjg59 2y ago
It's probably worth mentioning that secure boot is trivially circumventable given physical access on any Intel Mac (including T2 Macs), so you want at least an M1 to feel safer here
Dalewyn 2y ago
There's an age old saying in Japan that if you want to hide a tree you should do so in a forest.
woctordho 2y ago
In China we have ways to obfuscate those unusual traffic into usual ones like WeChat video calling

irundebian 2y ago

Have used it for several months as my daily OS and dropped it because of bad graphics performance (only software rendering supported, many frame drops when watching HD videos on YT) and bad battery management. Due to software rendering the overall systems perfmance also dropped. So I cannot recommend it for people with high requirements on graphics and battery duration. Besides that it was an interesting and good experience. I think it would be good to make it possible to deactivate certain security features such as strict graphics isolation so that users can adjust their settings to their risk acceptance level. It would also be interesting to be able to optionally replace Xen with lighter isolation mechanisms, even if the user would compromise on security here too.

samoit 2y ago
I think you do have GPU acceleration in the Dom0 but I do not remember if you can use/install programs on it, it was the "coordinator" dom.
NegativeK 2y ago
Given the tendency for people to lower their unknowingly compromise their security for the sake of convenience, I can understand why a project wouldn't do that. Knowingly is different and is what you're requesting -- it's when someone is following some Stack Overflow post or some such and doesn't have the training (similarly with the SO commenter, potentially) to know the implications. It kind of feels like a tradeoff between protecting users who are critically in need of something like Qubes or expanding its reach to people who are less at risk and won't use it if it's too inconvenient.
Dalewyn 2y ago
>bad graphics performance (only software rendering supported, many frame drops when watching HD videos on YT) It might help if you used a computer with CPU horsepower that actually exists. And in case this sounded facetious, any reasonable CPU from the past 15 years can handle software decoding of high resolution video just fine. This all said however, if you do actually need full use of all hardware resources then being constrained to software is certainly a factor worth considering.

zvmaz 2y ago

With zero-click exploits that we certainly do not know of, Qubes OS offers some peace of mind.

armSixtyFour 2y ago
Unless there's a zero day in Xen in which case the entire security model falls apart. With all these cloud providers using Xen, I have no doubt that there's already one out there.
- zvmaz 2y ago
  This is true. But the code base of Xen is significantly smaller than that of a full operating system running bare metal, so the likeliness of a zero-day comprising Qubes is less likely (but possible).
- abtinf 2y ago
  If there is a zero day in Xen, your attackers are probably also going to be having a very, very bad day.
- fsflover 2y ago
  > Unless there's a zero day in Xen Most of the time, zero days in Xen do not affect Qubes: https://www.qubes-os.org/security/xsa/#statistics https://www.qubes-os.org/security/xsa/#statistics

behnamoh 2y ago

A simple screenshot of the OS environment would have been nice. But generally, I don't think people adopt operating systems just by seeing new recommendations on Hacker News or different forums. Most people have settled on macOS and then Linux and then Windows. and within the Linux ecosystem most people just use Ubuntu or Fedora and that's it. I don't see anyone using these other esoteric operating systems as a daily driver. For servers it's a different story. We have OpenBSD and FreeBSD. and of course Linux. But that's about it. Even supercomputers run Linux. creating an operating system in 2025, aside from intellectual curiosity, isn't really pragmatic.

schoen 2y ago
Qubes was created in 2012! It mostly runs Linux applications.
- accassar 2y ago
  Runs Windows pretty well! I find that very convenient. https://www.qubes-os.org/doc/templates/windows/ https://www.qubes-os.org/doc/templates/windows/
wongarsu 2y ago
CubesOS is the choice if you need a very high level of security, are willing to accept some workflow changes to achieve that, but still want a modern graphical operating system that runs all your normal software in a unified workspace. Nothing else provides a similar mix of security and usability. The alternatives are either much less secure or have much worse usability. Of course only few people have these kinds of requirements. I'd recommend Qubes OS if you are an investigative journalist or working in offensive or defensive IT security. Everyone else can safely ignore it. Still, even if it's not made for most of us it makes interesting design decisions that are very much of interest to this forum. And a lot of the people it is made for are here too
johannes1234321 2y ago
> A simple screenshot of the OS environment would have been nice. https://www.qubes-os.org/screenshots/ https://www.qubes-os.org/screenshots/

DrWhax 2y ago

QubesOS was my main driver for a couple of years, but I have to say that the low battery life compared to only software rendering got pretty annoying after a while. Depending on the hardware, you'll need to possibly disable certain options in the BIOS/UEFI, like for an t490 that I documented: https://groups.google.com/g/qubes-users/c/Z0Kfm53zMxQ/m/IV-AeXE0FAAJ https://groups.google.com/g/qubes-users/c/Z0Kfm53zMxQ/m/IV-A...

zvmaz 2y ago
What to use instead if one cares about privacy and security (what I call personal sovereignty)? It's a non-rhetorical question.
- llm_trw 2y ago
  You use qubes and eat the loss of battery life.
  - barbs 2y ago
    Or maybe Tails?
- nullc 2y ago
  The only serious alternative to Qubes from a security perspective is to use multiple computers. That alternative presumably has better security, but also generally worse usability (particularly if you're going to be mobile! -- two laptops in your bag might be acceptable but comparable isolation would require more than two).
  - fsflover 2y ago
    > That alternative presumably has better security Not necessarily: https://www.qubes-os.org/faq/#how-does-qubes-os-compare-to-using-a-separate-physical-machine https://www.qubes-os.org/faq/#how-does-qubes-os-compare-to-u...

Crontab 2y ago

Even though I never used Qubes OS I used to really enjoy Joanna Rutkowska's passion for it. Other women who's computing enthusiasm I enjoyed was Jessie Frazelle's writing and speaking about running everything in Docker on her laptop and Sacha Chua's love for Emacs.

oswalk 2y ago
[flagged]
- NathanielK 2y ago
  Why do you think you need to clarify that?
Fnoord 2y ago
There's a lot of awesome females in the infosec community. Check out the podcast Darknet Diaries for a glimpse. Some of the coolest red teaming podcasts were (IMO) with women. In this context, I'd like to mention Dr. Melanie Rieback. She is 'the CEO/Co-founder of Radically Open Security, the world’s first non-profit computer security consultancy company.' Previously in the 00's known for her research in RFID security. Or have a look at hack conferences such as recently 38C3.
nine_k 2y ago
Let me also add the brilliant https://justine.lol https://justine.lol

dang 2y ago

Related. Others? Converting untrusted PDFs into trusted ones: The Qubes Way (2013) - https://news.ycombinator.com/item?id=42401904 https://news.ycombinator.com/item?id=42401904 - Dec 2024 (45 comments) Why one would use Qubes OS? (2023) - https://news.ycombinator.com/item?id=42200987 https://news.ycombinator.com/item?id=42200987 - Nov 2024 (16 comments) Counter argument against QubesOS more secure by being a type 1 hypervisor - https://news.ycombinator.com/item?id=41401318 https://news.ycombinator.com/item?id=41401318 - Aug 2024 (1 comment) Qubes OS 4.2.2 has been released - https://news.ycombinator.com/item?id=40959109 https://news.ycombinator.com/item?id=40959109 - July 2024 (5 comments) Working with Qubes OS at the Guardian - https://news.ycombinator.com/item?id=39949882 https://news.ycombinator.com/item?id=39949882 - April 2024 (74 comments) Qubes OS 4.2.1 has been released - https://news.ycombinator.com/item?id=39833245 https://news.ycombinator.com/item?id=39833245 - March 2024 (11 comments) A modest update to Qubes OS - https://news.ycombinator.com/item?id=39490264 https://news.ycombinator.com/item?id=39490264 - Feb 2024 (31 comments) Qubes OS 4.2.0 has been released - https://news.ycombinator.com/item?id=38690597 https://news.ycombinator.com/item?id=38690597 - Dec 2023 (21 comments) QubesOS – A reasonably secure operating system - https://news.ycombinator.com/item?id=36684946 https://news.ycombinator.com/item?id=36684946 - July 2023 (135 comments) Qubes OS 4.2-rc1 is available for testing - https://news.ycombinator.com/item?id=36178205 https://news.ycombinator.com/item?id=36178205 - June 2023 (3 comments) New user guide: How to organize your qubes - https://news.ycombinator.com/item?id=33396604 https://news.ycombinator.com/item?id=33396604 - Oct 2022 (15 comments) Opsec considerations when using WiFi - https://news.ycombinator.com/item?id=32148920 https://news.ycombinator.com/item?id=32148920 - July 2022 (2 comments) What Is Qubes OS? - https://news.ycombinator.com/item?id=32036899 https://news.ycombinator.com/item?id=32036899 - July 2022 (82 comments) Automated OS testing on physical laptops - https://news.ycombinator.com/item?id=31281107 https://news.ycombinator.com/item?id=31281107 - May 2022 (4 comments) Qubes OS: A reasonably secure operating system - https://news.ycombinator.com/item?id=30776103 https://news.ycombinator.com/item?id=30776103 - March 2022 (97 comments) Qubes OS 4.1.0 has been released - https://news.ycombinator.com/item?id=30215210 https://news.ycombinator.com/item?id=30215210 - Feb 2022 (1 comment) Ask HN: Qubes OS or just separate VMs for separating work and private files? - https://news.ycombinator.com/item?id=29537961 https://news.ycombinator.com/item?id=29537961 - Dec 2021 (6 comments) Qubes OS 4.1-rc1 has been released - https://news.ycombinator.com/item?id=28856957 https://news.ycombinator.com/item?id=28856957 - Oct 2021 (5 comments) Qubes OS 4.0 has been released - https://news.ycombinator.com/item?id=16699900 https://news.ycombinator.com/item?id=16699900 - March 2018 (39 comments) Qubes OS: A reasonably secure operating system - https://news.ycombinator.com/item?id=15734416 https://news.ycombinator.com/item?id=15734416 - Nov 2017 (144 comments) Reasonably Secure Computing in the Decentralized World - https://news.ycombinator.com/item?id=15566563 https://news.ycombinator.com/item?id=15566563 - Oct 2017 (44 comments) Toward a Reasonably Secure Laptop - https://news.ycombinator.com/item?id=14743238 https://news.ycombinator.com/item?id=14743238 - July 2017 (100 comments) “Paranoid Mode” Compromise Recovery on Qubes OS - https://news.ycombinator.com/item?id=14218504 https://news.ycombinator.com/item?id=14218504 - April 2017 (14 comments) Qubes OS Begins Commercialization and Community Funding Efforts - https://news.ycombinator.com/item?id=13069615 https://news.ycombinator.com/item?id=13069615 - Nov 2016 (24 comments) Qubes OS 3.2 has been released - https://news.ycombinator.com/item?id=12604417 https://news.ycombinator.com/item?id=12604417 - Sept 2016 (30 comments) Security challenges for the Qubes build process - https://news.ycombinator.com/item?id=11801093 https://news.ycombinator.com/item?id=11801093 - May 2016 (17 comments) Qubes OS 3.1 has been released - https://news.ycombinator.com/item?id=11260857 https://news.ycombinator.com/item?id=11260857 - March 2016 (44 comments) Converting untrusted PDFs into trusted ones: The Qubes Way (2013) - https://news.ycombinator.com/item?id=10538888 https://news.ycombinator.com/item?id=10538888 - Nov 2015 (5 comments) Intel x86 considered harmful – survey of attacks against x86 over last 10 years - https://news.ycombinator.com/item?id=10458318 https://news.ycombinator.com/item?id=10458318 - Oct 2015 (169 comments) Qubes – Secure Desktop OS Using Security by Compartmentalization - https://news.ycombinator.com/item?id=8428453 https://news.ycombinator.com/item?id=8428453 - Oct 2014 (49 comments) Introducing Qubes 1.0 ("a stable and reasonably secure desktop OS") - https://news.ycombinator.com/item?id=4472403 https://news.ycombinator.com/item?id=4472403 - Sept 2012 (59 comments) Qubes: an open source OS with strong security for desktop computing - https://news.ycombinator.com/item?id=2645170 https://news.ycombinator.com/item?id=2645170 - June 2011 (16 comments) Review: Qubes OS Beta 1 — a new and refreshing approach to system security - https://news.ycombinator.com/item?id=2504274 https://news.ycombinator.com/item?id=2504274 - May 2011 (1 comment) The Linux Security Circus: On GUI isolation - https://news.ycombinator.com/item?id=2477667 https://news.ycombinator.com/item?id=2477667 - April 2011 (47 comments) Qubes Beta 1 has been released (strong desktop security OS) - https://news.ycombinator.com/item?id=2439096 https://news.ycombinator.com/item?id=2439096 - April 2011 (3 comments) Qubes Architecture - actual security-oriented OS - https://news.ycombinator.com/item?id=1796384 https://news.ycombinator.com/item?id=1796384 - Oct 2010 (1 comment) Open source Qubes OS is ultra secure - https://news.ycombinator.com/item?id=1249857 https://news.ycombinator.com/item?id=1249857 - April 2010 (7 comments) Introducing Qubes OS - https://news.ycombinator.com/item?id=1246990 https://news.ycombinator.com/item?id=1246990 - April 2010 (20 comments)

patrakov 2y ago

It does not matter in the real world whether the vendor declares it secure. Did it help anyone pass any kind of security audit? In other words, do auditors recognize it as a valid environment for working with potentially malicious documents, or only as a toy?

adastra22 2y ago
Three points: (1) Qubes is open-source. (2) Qubes is written and maintained by security professionals. (3) Most (all?) security audits are worse than useless.

tasn 2y ago

I've always wanted to switch to qubes, but it just feels so constraining. It's safer to never leave the house, but I don't want to live in a self imposed prison. On the other hand, the isolation provided by containers and flatpak is more accessible, but with a much larger attack vector. Maybe we need immutable OS + an audit layer on anything that could allow exploits to persist (bashrc and the likes).

flubbergusto 2y ago
[dead]
irundebian 2y ago
After Qubes OS I ended up using Fedora with Wayland, Flatpaks and running applications as different users but this introduced other problems. The security profiles of many "flatpacked" applications are quite permissive (see https://flatkill.org/ https://flatkill.org/) so that they could be circumvented. Besides that I'm experience some convenience issues when accessing files on my drive. It's especially annoying when using "flatpacked" office such as onlyoffice.
bobertlo 2y ago
I just really appreciate separating things like access credentials from things like web browsers without running multiple accounts. I do all my most and least secure activities on Qubes and use other computers for a lot of the other stuff in between.

pgaddict 2y ago

I'm using Qubes OS as my primary for years - I think I started with the 2.0 release in 2014 (I might have tried/used the 1.0 release, I don't recall.) and I was immediately hooked. I understand the usual story is that the goal is security benefits, and the compartmentalization (or rather the implied inconvenience) is the price for that. But for me the compartmentalization turned out to be a benefit on it's own, and actually convenient. I find it extremely convenient to have multiple isolated / virtual workspaces for different stuff, even if you assume attackers / malice do not exist. Having separate VMs is not the same as having separate folders. I also love the VM templates, which allow me to do all kinds of experiments (e.g. install packages in the app VM, which disappear after restart). Or run VMs with a mix of distros/versions/... Yes, I could do some of that with plain VMs, but Qubes integrates that in a way that I find very convenient. The commands for copying stuff between VMs are muscle memory at this point. Yes, there are limitations, like the lack of GPU acceleration. But movies in 1080p play just fine without it, and I'm not a gamer, so I don't mind much. I can't play with CUDA etc. on these QubesOS machines, and scrolling web pages with large images is laggy, but I find this to be an acceptable price. I went through multiple laptops / workstations over the years, and the situation improved a lot I think. Initially I had to solve quite a few issues with installer, some hardware not working (or requiring setting something special), or poor battery life on the laptops. But after a while that mostly either went away, especially once I switched to laptops with official Linux support (Dell Precision were good, I'm on Thinkpad P1 G7 now). The battery life is pretty decent too (especially once I disabled HT in BIOS). Is it perfect for everyone? No, certainly not. But it sure is great for me, and I hope they keep working on it.

vigilans 2y ago
I’m in the same boat. Love the compartmentalization and being able to route VMs to different network backends and the ability to create ephemeral domains for quick tasks. Thank you Joanna, Marek, Andrew, and all the wonderful contributors. I couldn’t live without Qubes.
irundebian 2y ago
> scrolling web pages with large images is laggy Now that I've read this, I can also remember that I was also annoyed by jerks when scrolling web pages. I also found the backup management too complicated. I didn't want to back up entire VMs, just the data within the VMs. In principle, I would have had to start up all VMs for backups and run a backup script for each individual VM.

nullc 2y ago

I am a Qubes user for a couple years now, and I wish I'd switched to it years earlier. Basically every criticism you hear is about correct-- principally worse graphics performance and battery life. But the performance issues for me were less bad than I expected, and the seamlessness of its usability was much much higher than I expected. Like copy and paste, moving files between VMs, plugging usb devices into VMs, networking, etc. all pretty much just work. It's pretty impressive if you have any idea of the machinery under the hood needed to make that work. And now I don't feel anywhere near as nervous that whatever vendor program I need to use to configure a device or browser zero day is going to compromise my system. I can read documents from adverse threat actor sources in a netless VM and feel reasonably confident that it can't phone home or steal my data, etc. Obviously it doesn't replace real air gap security, but it's the closest thing you can get to a network of airgapped or firewalled per-application computers which you can fit into a laptop bag. I also like that I can use software that really only works right on fedora/redhat along side software that really only works right on debian. (Or windows, for that matter, but it's not as seamless). I like that I can substantially upgrade my operating system while running--- like I went from fedora40 to 41 just by installing the template, and switching over appvms one at a time. If anything goes wrong it's trivial to roll back, and I can have some app vms that work fine on the new stuff while others are held back if there is a compatibility issue. I like that applications that go nuts and try to use all my memory only screw up the VM that they're in instead of my whole system. It's so nice that when I want to get something working I can spin up a vm and scribble all over it until I get it working. Binary patch my libc, whatever. Then once I've solved it, I can apply the final clean solution to a persistent template. Any random experimentation just goes away when I close the appvm. Need some program just for a single thing? install it in the appvm rather than the template and it naturally is gone later. I can be intentional about changes being either ephemeral or persistent, and never have to worry that the removal of something temporary was incomplete. Of course YMMV, -- if you're someone who is mostly doing text and low performance graphics and can run it on a fast computer then its costs will be small. If you'd find a ten year old computer perfectly usable chances are that qubes on a modern computer won't seem slow or poor battery lifed to you. Particularly if you have other computers for games, 3d gfx, full screen video, etc. If you are someone who has been subjected to targeted hacking attempts the increased peace of mind will be substantial.

udev4096 2y ago

We wouldn't have to rely on security by hypervisor if linux had proper security measures, sandboxing and access controls OOTB. Qubes is still far from good although it's slowly getting there

dijit 2y ago
what are you talking about? Of course we do? We totally forgotten about mandatory access control systems? AppArmor, SELinux? problem isn’t that they don’t exist; it’s that nobody knows how to use them properly. You can even minimise the kernel attack surface these days with utilities like gVisor. people just understand virtual machines easier. It’s easy to understand the isolation it gives and easier to reduce unnecessary potential attack vectors by having minimal images that don’t contain more than necessary.
- udev4096 2y ago
  "OOTB" is the term you missed. Obviously, there are kernel features such as seccomp and other LSM but it's not easy to properly configure. Even if you do, it usually comes in your way of getting stuff done. Regarding gvisor, it's solid and I've been intending to use it on k3s
- i_love_retros 2y ago
  Am I wrong in thinking that Ubuntu has apparmor configured by default?
  - mmh0000 2y ago
    Yes, Ubuntu has AppArmor and Fedora (RHEL, et. al.) have SELinux. The problem is that both systems are quite difficult to use properly. The out-of-the-box configuration is good for a base increase in overall system security against common threats. However, if you want the real isolation benefits that these MAC systems are capable of providing, you'll need a full-time security team with years of training to manage your personal desktop.

aborsy 2y ago

It’s great for compartmentalizing the work, even if security is not important. The UI was surprisingly good when I used it.

mikewarot 2y ago

Since it doesn't look like Genode is going to be ready to be a daily driver for a while, Qubes looks like something ALMOST capabilities based that I could live with. Some day I'll just be able to run stuff without worry.... but it's not going to be any time soon. Can I run old versions of stuff like MS-DOS or Windows 3.1 under it? Or my beloved Windows 2000? Windows 2000 with Office 2000 pro (with the patches to read the new office 2007 formats) would be awesome. I miss outliner mode in Word 2000.

czk 2y ago
you can with dosbox/pcem or something similar (dont think modern xen handles 16bit virtualization) -- but you can definitely run Windows 2000 in a VM on Qubes, but the windows tools are not supported on anything under 7