3 ms·
This only secures between vms. This side steps the problem and people can still easily run multiple applications in the same qube.
by charcircuit 2y ago
This only secures between vms. This side steps the problem and people can still easily run multiple applications in the same qube.
- fsflover 2y agoIt's impossible to isolate applications inside one VM as securely as with Qubes virtualization. You should not rely on intra-VM hardening if you really care about security. Having said that, Qubes does provide ways to harden the VMs: https://forum.qubes-os.org/t/hardening-qubes-os/4935/3 https://forum.qubes-os.org/t/hardening-qubes-os/4935/3, https://forum.qubes-os.org/t/replacing-passwordless-root-with-a-dom0-prompt/19074 https://forum.qubes-os.org/t/replacing-passwordless-root-wit....
- charcircuit 2y agoPeople may want to have multiple apps work together. It makes sense to have security within a qube itself than to just declare it a free for all.
- fsflover 2y agoIf the apps work together, they typically belong to the same security domain / trust level. Do you have examples when you still have to isolate them from each other?
- charcircuit 2y agoEven if things are on the same trust level that doesn't mean that if one gets compromised I don't care that it affects the 2nd.
- fsflover 2y agoSo just run them in different VMs? Apart from that, any hardening in Fedora can be utilized inside a Fedora VM on Qubes. Qubes doesn't force you to use VMs with no isolation inside.
- charcircuit 2y agoBut then the files can't be shared.
- fsflover 2y agoQubes has such functionality.
- AshamedCaptain 2y agoAnd you just deduced why sandboxing as it is implemented today is really pointless for the desktop .
- fsflover 2y agoI'm using Qubes as my daily driver on my desktop, so no.
- AshamedCaptain 2y agoWhat do you get from it? Specially considering that from above "programs that work together go in the same context"..
- fsflover 2y agoWhat I get from it: https://forum.qubes-os.org/t/whats-your-system-layout-like/844/6 https://forum.qubes-os.org/t/whats-your-system-layout-like/8... Two official examples of how one could benefit from Qubes: https://www.qubes-os.org/news/2022/10/28/how-to-organize-your-qubes/ https://www.qubes-os.org/news/2022/10/28/how-to-organize-you... and https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html https://blog.invisiblethings.org/2011/03/13/partitioning-my-... See also: https://forum.qubes-os.org/t/how-to-pitch-qubes-os/4499/15 https://forum.qubes-os.org/t/how-to-pitch-qubes-os/4499/15