25 ms·

Everything but the specific usage

esperent 4mo ago
But what does that mean? Can I browse a webpage, open a doc, if those are listed as specific usage? And if not, what's the purpose of this and why are people talking about it with such import?
- saidnooneever 4mo ago
  most people dont do a lot on their machines. they have specific tasks they want to do. The idea is to isolate by default and crack open gaps by policy. You can still do 'anything' but you wouldnt want to enable 'anything' to be possible in the policy..
  - fsflover 4mo ago
    Sounds like security through compartmentalization is more user-friendly: You can run whatever you want and how you want it in a dedicated VM, keeping sensitive things safely isolated, without much thinking of what to enable. Case in point: Qubes OS, my daily driver. Btw it already exists and is stable.
    - ethbr1 4mo ago
      > security through compartmentalization is more user-friendly: You can run whatever you want and how you want it in a dedicated VM, keeping sensitive things safely isolated My brain hurts. How is a system where you can run whatever you want, however you want, but still keep sensitive things safely isolated possible? Either you have restrictions on what you can run or access (in which case those limit sandboxed capabilities) or you have a hypothetically secure system, the security features of which you never leverage (because sandboxes have absolute freedom). Unless you were talking about the ability to guarantee a monitor-only hypervisor or resource slice a machine into multiple tenants? (i.e. no/light touch hypervisor situations)
      - fsflover 4mo ago
        I'm not sure I understand your question. VMs run full operating systems on top of Xen hypervisor relying on hardware-assisted virtualization (VT-d or similar). You can run untrusted software in a dedicated VM and keep your sensitive data in another offline VM. The dom0 has no network and doesn't manage, e.g., USB devices.
        ethbr1 4mo ago
        You can't have full general purpose computing on a system and perfect isolation for free. By definition, the latter implies limits on the former. Either you have complete freedom to run whatever you want, however you want, or you enforce limits to guarantee system behavior and enforce isolation. And if you do the latter... then you don't have the former.
        fsflover 4mo ago
        Can you elaborate? I'm not a computer scientists. In my understanding, full VMs are practically equivalent to general purpose computers. What are their limitations? Malware escapes? Last VM escape in VT-d was discovered in 2006 by the Qubes founder, so I really feel safe on Qubes, https://en.wikipedia.org/wiki/Blue_Pill_(software) https://en.wikipedia.org/wiki/Blue_Pill_(software)
        ethbr1 4mo ago
        We're talking about apples and oranges. I thought your original point above was that VMs freed you from having to come up with policy-based isolation rules (which have always been a UX weakness of policy-based isolation systems). The point I was making is that VMs don't provide any security guarantees unless you also use the trusted hypervisor layer to enforce something. At lightest touch, this might be time-slicing resources and ensuring they're evenly split between VMs, regardless of what individual VMs try to do. But to provide policy-alike granular security control on VMs, you fundamentally have to generate similar rules. E.g. network can only be used by this VM in this way, etc. Which gets you right back to having to define policies. From an architecture security perspective, sure, having a trusted hypervisor enforcing the rules is nice. But it doesn't fundamentally fix the problem of getting policies right... if you're trying to guarantee the same level of control.
    - saidnooneever 4mo ago
      QubesOS is not bad indeed. its not perfect (they are looking i think to replace Xen or make it much more thin layer). Its definitely the way i think if u want to retain compatibility with existing OSes/tools.
      - fsflover 4mo ago
        They are not looking to replace Xen. They plan to add support of KVM without breaking Xen: https://github.com/QubesOS/qubes-issues/issues/7051#issuecomment-986323294 https://github.com/QubesOS/qubes-issues/issues/7051#issuecom... They also plan to replace Fedora in dom0 with something minimized https://github.com/QubesOS/qubes-issues/issues/1919#issuecomment-480546054 https://github.com/QubesOS/qubes-issues/issues/1919#issuecom.... Is this a problem for you?

But what does that mean? Can I browse a webpage, open a doc, if those are listed as specific usage? And if not, what's the purpose of this and why are people talking about it with such import?

saidnooneever 4mo ago
most people dont do a lot on their machines. they have specific tasks they want to do. The idea is to isolate by default and crack open gaps by policy. You can still do 'anything' but you wouldnt want to enable 'anything' to be possible in the policy..
- fsflover 4mo ago
  Sounds like security through compartmentalization is more user-friendly: You can run whatever you want and how you want it in a dedicated VM, keeping sensitive things safely isolated, without much thinking of what to enable. Case in point: Qubes OS, my daily driver. Btw it already exists and is stable.
  - ethbr1 4mo ago
    > security through compartmentalization is more user-friendly: You can run whatever you want and how you want it in a dedicated VM, keeping sensitive things safely isolated My brain hurts. How is a system where you can run whatever you want, however you want, but still keep sensitive things safely isolated possible? Either you have restrictions on what you can run or access (in which case those limit sandboxed capabilities) or you have a hypothetically secure system, the security features of which you never leverage (because sandboxes have absolute freedom). Unless you were talking about the ability to guarantee a monitor-only hypervisor or resource slice a machine into multiple tenants? (i.e. no/light touch hypervisor situations)
    - fsflover 4mo ago
      I'm not sure I understand your question. VMs run full operating systems on top of Xen hypervisor relying on hardware-assisted virtualization (VT-d or similar). You can run untrusted software in a dedicated VM and keep your sensitive data in another offline VM. The dom0 has no network and doesn't manage, e.g., USB devices.
      - ethbr1 4mo ago
        You can't have full general purpose computing on a system and perfect isolation for free. By definition, the latter implies limits on the former. Either you have complete freedom to run whatever you want, however you want, or you enforce limits to guarantee system behavior and enforce isolation. And if you do the latter... then you don't have the former.
        fsflover 4mo ago
        Can you elaborate? I'm not a computer scientists. In my understanding, full VMs are practically equivalent to general purpose computers. What are their limitations? Malware escapes? Last VM escape in VT-d was discovered in 2006 by the Qubes founder, so I really feel safe on Qubes, https://en.wikipedia.org/wiki/Blue_Pill_(software) https://en.wikipedia.org/wiki/Blue_Pill_(software)
        ethbr1 4mo ago
        We're talking about apples and oranges. I thought your original point above was that VMs freed you from having to come up with policy-based isolation rules (which have always been a UX weakness of policy-based isolation systems). The point I was making is that VMs don't provide any security guarantees unless you also use the trusted hypervisor layer to enforce something. At lightest touch, this might be time-slicing resources and ensuring they're evenly split between VMs, regardless of what individual VMs try to do. But to provide policy-alike granular security control on VMs, you fundamentally have to generate similar rules. E.g. network can only be used by this VM in this way, etc. Which gets you right back to having to define policies. From an architecture security perspective, sure, having a trusted hypervisor enforcing the rules is nice. But it doesn't fundamentally fix the problem of getting policies right... if you're trying to guarantee the same level of control.
  - saidnooneever 4mo ago
    QubesOS is not bad indeed. its not perfect (they are looking i think to replace Xen or make it much more thin layer). Its definitely the way i think if u want to retain compatibility with existing OSes/tools.
    - fsflover 4mo ago
      They are not looking to replace Xen. They plan to add support of KVM without breaking Xen: https://github.com/QubesOS/qubes-issues/issues/7051#issuecomment-986323294 https://github.com/QubesOS/qubes-issues/issues/7051#issuecom... They also plan to replace Fedora in dom0 with something minimized https://github.com/QubesOS/qubes-issues/issues/1919#issuecomment-480546054 https://github.com/QubesOS/qubes-issues/issues/1919#issuecom.... Is this a problem for you?