3 ms·
If you want security through compartmentalization, you should consider Qubes OS, my daily driver, https://qubes-os.org https://qubes-os.org.
by fsflover 2y ago
If you want security through compartmentalization, you should consider Qubes OS, my daily driver, https://qubes-os.org https://qubes-os.org.
- charcircuit 2y agoThis only secures between vms. This side steps the problem and people can still easily run multiple applications in the same qube.
- fsflover 2y agoIt's impossible to isolate applications inside one VM as securely as with Qubes virtualization. You should not rely on intra-VM hardening if you really care about security. Having said that, Qubes does provide ways to harden the VMs: https://forum.qubes-os.org/t/hardening-qubes-os/4935/3 https://forum.qubes-os.org/t/hardening-qubes-os/4935/3, https://forum.qubes-os.org/t/replacing-passwordless-root-with-a-dom0-prompt/19074 https://forum.qubes-os.org/t/replacing-passwordless-root-wit....
- charcircuit 2y agoPeople may want to have multiple apps work together. It makes sense to have security within a qube itself than to just declare it a free for all.
- fsflover 2y agoIf the apps work together, they typically belong to the same security domain / trust level. Do you have examples when you still have to isolate them from each other?
- charcircuit 2y agoEven if things are on the same trust level that doesn't mean that if one gets compromised I don't care that it affects the 2nd.
- fsflover 2y agoSo just run them in different VMs? Apart from that, any hardening in Fedora can be utilized inside a Fedora VM on Qubes. Qubes doesn't force you to use VMs with no isolation inside.
- charcircuit 2y agoBut then the files can't be shared.
- fsflover 2y agoQubes has such functionality.
- AshamedCaptain 2y agoAnd you just deduced why sandboxing as it is implemented today is really pointless for the desktop .
- fsflover 2y agoI'm using Qubes as my daily driver on my desktop, so no.
- AshamedCaptain 2y agoWhat do you get from it? Specially considering that from above "programs that work together go in the same context"..
- fsflover 2y agoWhat I get from it: https://forum.qubes-os.org/t/whats-your-system-layout-like/844/6 https://forum.qubes-os.org/t/whats-your-system-layout-like/8... Two official examples of how one could benefit from Qubes: https://www.qubes-os.org/news/2022/10/28/how-to-organize-your-qubes/ https://www.qubes-os.org/news/2022/10/28/how-to-organize-you... and https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html https://blog.invisiblethings.org/2011/03/13/partitioning-my-... See also: https://forum.qubes-os.org/t/how-to-pitch-qubes-os/4499/15 https://forum.qubes-os.org/t/how-to-pitch-qubes-os/4499/15