4 ms·

Previously: http://news.ycombinator.com/item?id=1246990 http://news.ycombinator.com/item?id=1246990 http://news.ycombinator.com/item?id=2645170 http://news.yc

Previously: http://news.ycombinator.com/item?id=1246990 http://news.ycombinator.com/item?id=1246990 http://news.ycombinator.com/item?id=2645170 http://news.ycombinator.com/item?id=2645170 This story won't see much traction on HN. The cult of Mac is too strong, and HN users generally aren't interested in secure operating systems.

m0nastic 14y ago
Yes, Apple is the reason most people don't care about an unbelievably inconvenient desktop sandbox.
- djcapelis 14y ago
  Haha. :) To be fair, Apple's focus on usability and convenience could be linked to Qubes, in that they represent very different points on the "How much users should be thinking about security" spectrum.
  - m0nastic 14y ago
    Qubes to me seems like what I imagine would happen if DARPA threw a roomful of security nerds together in the 90's and told them to come up with something to let intelligence analysts process mixed-class data. The software equivalent of a one-way-transfer device. It makes me long for the day that current pc's end up relegated to the attic of computing.
    - djcapelis 14y ago
      Oh no, not at all, Qubes is a much lighter weight alternative to what the roomful of security people DARPA did throw together in the 90s to try and design those systems. They're throwing another roomful of people together to build something similar right now. If Joanna wants and maneuvers right, her lab could end up getting a lot of the contracts to do a lot of things the DoD wants done. I'm not sure whether she's interested in that though, or whether she's pursued it already. They'd probably ask for a bunch of stuff that would involve headaches. Either that or she's already doing work on it. Dunno, to be honest.
ChuckMcM 14y ago
Actually folks on HN are interested in secure operating systems but they recognize that creating such is a Hard Problem (tm) which someone who is an unknown [1] in the field is unlikely to have achieved. Now you can read up on Mark Miller's published papers [2] on Joule (actually pretty secure) and some of the issues associated with making things secure and get a much better feeling of solidity (for example). So when the press release comes out that its passed the Defense department's B1/B2 review, then I suspect it will get a lot of interest here and else where. [1] http://www.linkedin.com/profile/view?id=10279027 http://www.linkedin.com/profile/view?id=10279027 LinkedIn profile, one job CEO of this thing? A blog full of black hat sort of exploits but I didn't see any peer reviewed work. [2] http://research.google.com/pubs/author35958.html http://research.google.com/pubs/author35958.html [3] http://en.wikipedia.org/wiki/Trusted_Computer_System_Evaluation_Criteria http://en.wikipedia.org/wiki/Trusted_Computer_System_Evaluat...
- tptacek 14y ago
  Joanna Rutkowska is famous in computer security circles and highly credible on this particular topic. The "black hat sorts of exploits" attributed to her tend to be things like, "abusing odd, barely-documented corners of x86 chipsets to bypass hardware-encrypted trusted boot roots". Thinking less of a professional in my field for having exploits attributed to them tends to be a bad idea, but it's a uniquely bad idea in Rutkowska's case. Outside of conference presentations, Rutkowska doesn't have much peer-reviewed work in the literature. That's because Rutkowska is originally from the malware/rootkit/virus part of the industry. For obvious reasons, antivirus doesn't generate a lot of peer-reviewed academic research. One of those obvious reasons is that they're too busy printing money hats to bother. (This to my chagrin; I am very much not from the AV/malware part of the field). I'm not vouching for Qubes or even saying that I think the approach (of semi-transparently allocating secure VMs for each application or trust domain on the system) is viable. But Rutkowska is worth taking seriously.
  - viraptor 14y ago
    > Outside of conference presentations, ... Almost on topic: I have to say the team is also really cool and approachable at conferences - and for that I'm very grateful as a member of the unexperienced audience. They can really adjust the explanations to the right level for the general crowd, which must be quite hard considering the topic.
tptacek 14y ago
I cannot for the life of me see what Qubes has to do with Apple.
sciurus 14y ago
Thanks for linking to the previous discussions. It would have ben better if you hadn't tried to derail this discussion with the prediction of how the post would fare and "cult of mac" comment.

m0nastic 14y ago

Yes, Apple is the reason most people don't care about an unbelievably inconvenient desktop sandbox.

djcapelis 14y ago
Haha. :) To be fair, Apple's focus on usability and convenience could be linked to Qubes, in that they represent very different points on the "How much users should be thinking about security" spectrum.
- m0nastic 14y ago
  Qubes to me seems like what I imagine would happen if DARPA threw a roomful of security nerds together in the 90's and told them to come up with something to let intelligence analysts process mixed-class data. The software equivalent of a one-way-transfer device. It makes me long for the day that current pc's end up relegated to the attic of computing.
  - djcapelis 14y ago
    Oh no, not at all, Qubes is a much lighter weight alternative to what the roomful of security people DARPA did throw together in the 90s to try and design those systems. They're throwing another roomful of people together to build something similar right now. If Joanna wants and maneuvers right, her lab could end up getting a lot of the contracts to do a lot of things the DoD wants done. I'm not sure whether she's interested in that though, or whether she's pursued it already. They'd probably ask for a bunch of stuff that would involve headaches. Either that or she's already doing work on it. Dunno, to be honest.

ChuckMcM 14y ago

Actually folks on HN are interested in secure operating systems but they recognize that creating such is a Hard Problem (tm) which someone who is an unknown [1] in the field is unlikely to have achieved. Now you can read up on Mark Miller's published papers [2] on Joule (actually pretty secure) and some of the issues associated with making things secure and get a much better feeling of solidity (for example). So when the press release comes out that its passed the Defense department's B1/B2 review, then I suspect it will get a lot of interest here and else where. [1] http://www.linkedin.com/profile/view?id=10279027 http://www.linkedin.com/profile/view?id=10279027 LinkedIn profile, one job CEO of this thing? A blog full of black hat sort of exploits but I didn't see any peer reviewed work. [2] http://research.google.com/pubs/author35958.html http://research.google.com/pubs/author35958.html [3] http://en.wikipedia.org/wiki/Trusted_Computer_System_Evaluation_Criteria http://en.wikipedia.org/wiki/Trusted_Computer_System_Evaluat...

tptacek 14y ago
Joanna Rutkowska is famous in computer security circles and highly credible on this particular topic. The "black hat sorts of exploits" attributed to her tend to be things like, "abusing odd, barely-documented corners of x86 chipsets to bypass hardware-encrypted trusted boot roots". Thinking less of a professional in my field for having exploits attributed to them tends to be a bad idea, but it's a uniquely bad idea in Rutkowska's case. Outside of conference presentations, Rutkowska doesn't have much peer-reviewed work in the literature. That's because Rutkowska is originally from the malware/rootkit/virus part of the industry. For obvious reasons, antivirus doesn't generate a lot of peer-reviewed academic research. One of those obvious reasons is that they're too busy printing money hats to bother. (This to my chagrin; I am very much not from the AV/malware part of the field). I'm not vouching for Qubes or even saying that I think the approach (of semi-transparently allocating secure VMs for each application or trust domain on the system) is viable. But Rutkowska is worth taking seriously.
- viraptor 14y ago
  > Outside of conference presentations, ... Almost on topic: I have to say the team is also really cool and approachable at conferences - and for that I'm very grateful as a member of the unexperienced audience. They can really adjust the explanations to the right level for the general crowd, which must be quite hard considering the topic.

tptacek 14y ago

I cannot for the life of me see what Qubes has to do with Apple.

sciurus 14y ago

Thanks for linking to the previous discussions. It would have ben better if you hadn't tried to derail this discussion with the prediction of how the post would fare and "cult of mac" comment.