Qubes OS 4.0 has been released | Hacker News Reader

Qubes OS 4.0 has been released

qubes-os.org

At Latacora, some of us use Qubes in order to get a workable desktop while also getting clean separation between different client environments. I’ve been consistently impressed with it. It’s not totally flawless, but it’s easy enough to learn enough about the model and tooling that you can quickly debug most issues. Overall this is about as usable as any other XFCE4 desktop, which is pretty darn good.

Would be happy to use Qubes if I could also get a certified laptop to run it on. Even after months their hardware requirements page still says "Unfortunately, there are currently no certified laptops for Qubes R3.x or R4.x. This page will be updated once certified laptops are available."

Anyone have any insider ETA or recommendations? Prefer a practical/reliable laptop over some expensive racehorse.

What laptop does Snowden use?

https://en.wikipedia.org/wiki/Epson_HX-20

Wow, does it run NetBSD? :)

Snowden: "I’ll just namecheck Qubes here, just because it’s interesting. I’m really excited about Qubes because the idea of VM-separating machines, requiring expensive, costly sandbox escapes to get persistence on a machine, is a big step up in terms of burdening the attacker with greater resource and sophistication requirements for maintaining a compromise. I’d love to see them continue this project. I’d love to see them make it more accessible and much more secure. [You can read more about how to use Qubes here and here.]

Something that we haven’t seen that we need to see is a greater hardening of the overall kernels of every operating system through things like grsecurity [a set of patches to improve Linux security], but unfortunately there’s a big usability gap between the capabilities that are out there, that are possible, and what is attainable for the average user."

https://theintercept.com/2015/11/12/edward-snowden-explains-...

I wonder if there was any progress on integrating with ReactOS[1].

[1] https://github.com/QubesOS/qubes-issues/issues/2809

Now that most VMs are fully virtualized now on 4.x, how much RAM and disk space do you need in order to have a usable system? The 'minimum requirements' they list of 4GB RAM and 32GB hdd wouldn't be enough to run more than a small handful of VMs.

It depends how many things you want to use concurrently. At Latacora some of us use Qubes to guarantee client separation, so lots of domains open and all of them running Slack, so, yeah, my machine has 32GB and that’s not a massive luxury.

With 8Gb of RAM I have been happily using Qubes 4 in my work workstation since rc2. I suggest to use the mirage firewall image [1] to save aound a Gb of RAM

The fedora 27 images can easily reach 5Gb of use under heavy load, but in gneneral I have pretty good performances and I usually have a couple of throwaway VMs and the main work VM running and dealing with web, co pilations of various sort and editing.

[1]: https://github.com/talex5/qubes-mirage-firewall

Why use Fedora for images and not something leaner, like Arch or Alpine Linux? (just examples, there are others too)

Does anyone know any good guides for installing this on a X1 Carbon Gen 5?

I've been wanting to try this out on my X1, but there isn't really any nuance when it comes to guides for it. Just a list of problems and what does and doesn't work.

I've been running qubes 4 on an X1 Gen 5 carbon. I can put together a guide tomorrow. Message me again just in case I forget and do it again on Monday just in case again.

Well I can't message you on here, but you should definitely reply to this comment and post it when you do it!

Is this secure against Spectre/Meltdown?

Here's a link to Qubes' security tracker with the updated details about it: https://github.com/QubesOS/qubes-secpack/blob/master/QSBs/qs...

How is the GPU pass-through support in this release?

I'd love to use Qubes but I sometimes want to use my GPU for games or other OpenGL stuff.

Is this already working good or is it still a bit bumpy?

Afaik they are not working on that at all.

I sometimes use 3d CAD software to design parts for 3D printing. Lack of 3d acceleration is one of the major hurdles keeping me away from Qubes, although I have used it and the bits that work well work extremely well. It's a very promising project.

Yeah, I agree it's a very interesting and promising project.

Hopefully this will be improved and then I would definitely make this my daily OS.

GPU pass-through support should be as good as any other distro on Linux 4.14. You'd need two GPU's still though. If you're talking just general GPU performance in a VM, that's still not 100%, though Qubes is not involved in that work as far as I know.

Houra ! Such a great work... I love the USB applet (at top right once logged in).

Just plug your device and mount it into one of your VM. Really user friendly :-)

Qubes OS' virtualization technology is awesome - love the peace of mind it gives!

I've been interested in Qubes OS for a long while, ever since I first heard about it years ago.

A little while ago I upgraded my desktop and I now have an 8-core Ryzen 7 1700 (that's 16 threads!) and 32 GB of RAM. I installed Kubuntu on it after the first few results on Google suggested Ubuntu would let me install and use the proprietary drivers for the graphics card that I bought; a GeForce 1060 GTX with 6GB VRAM.

Ubuntu is one of my least favorite distros but the promise of easy setup of Nvidia drivers combined with knowing that a lot of third-parties have Ubuntu quite high up on the list of distros they try and support with their software made me pick Ubuntu (well Kubuntu but it's almost the same except at least I get a Desktop that I think is nice).

Kubuntu works pretty well. Not perfectly but tbh nothing ever really does. One thing that I find particularly annoying though is that the computer freezes on boot when I enter the Full-Disk Encryption key unless I boot it in recovery mode. It became this way after I installed the proprietary Nvidia drivers and because the regular boot FDE key input is graphical whereas the recovery mode boot is text only at the FDE key input stage I think it is related to the Nvidia driver. So not even the thing that primarily made me choose Ubuntu works quite as well as I'd hoped. There is one graphical glitch that occurs while I'm on my desktop also but anyway like I said there will always be some problems, and I won't go into too much detail. Primarily I just wanted to point out that things aren't perfect currently so Qubes OS need not be perfect either.

Probably a lot of people on HN have work stations that are even nicer than this but for me this is such a monumental step up from the computers I have used to have that it feels like I am sitting in front of a TOP500 Supercomputer that somehow everyone else that had access forgot about and so I am left with being able to use it all by myself :P

Here are some of the things that my computer can do and that I enjoy being able to do;

- Run the most recent stable release of Blender (they add awesome new features every now and then that are really useful) - Play video games from Steam and capture my desktop with OBS Studio while doing so. - Use Spotify. - Use Firefox.

Bunch of other things as well.

Anyhow, I was wondering, can I easily install and use the proprietary Nvidia drivers with Qubes OS? Can I play video games from Steam, make use of the CUDA cores for Blender etc, record my desktop with OBS Studio,

Because if so then sign me the heck up :) I would love to run the web browser in isolation for example. Perhaps even have different "cubes" like for example have the web browser that I log into my online bank be separate from everything else, have the browser where I log into YouTube be separate so I can be signed into Google while not being tracked as much across other sites at the same time, separate cube for Reddit, separate cube for HN. Not too many separate cubes but something like that. Speaking of which did anyone set up firewall rules for this kind of separation so that you don't accidentally visit sites outside of YouTube in the YouTube-dedicated browser etc?

But yeah first and foremost I would like to know about Blender and Spotify and Steam and OBS Studio with Qubes OS. Also, full disk encryption and LVM volume groups. How about ZFS? And what kind of guests can run? Can I run FreeBSD guests? I have a lot more questions too I think but I can't think of them all right now and besides too many questions lead to none or just a few getting answered anyway.

I'm not sure I understand all the way. Qubes is more for people looking to have their internet connection completely private, and almost everything in the way it's run (preferably from a VM, I guess) is for that reason. Steam is best kept on Windows because it would be pretty obvious since *you're connecting to your Steam account and you would lose the privacy from it. Linux is also not the best environment for your video card, either, because nVidia doesn't have open-source drivers available. Now, yes, there are drivers available for some version of Linux, but they are generally close-source and very likely not the best for privacy reasons.

> Qubes is more for people looking to have their internet connection completely private

It was my impression that part of the point was also to isolate programs from one-another in case one of them is compromised. I may be mistaken in my understanding, but if Qubes OS did that then that is a good reason for me if I could for example isolate Steam and all of the proprietary games from the rest of my computer. Likewise with the isolating the environments that I visit different sites from.

> Steam is best kept on Windows because it would be pretty obvious since *you're connecting to your Steam account and you would lose the privacy from it.

I don't run Windows.

> Linux is also not the best environment for your video card, either, because nVidia doesn't have open-source drivers available. Now, yes, there are drivers available for some version of Linux, but they are generally close-source and very likely not the best for privacy reasons.

Proprietary drivers on Linux are still better than proprietary drivers on an OS that is also proprietary. Besides I plain don't like the Windows experience. I use Windows on my work computer because I have to but I will not use in on my private computers (aside from occasionally in a VM for some purpose or other).

Anyway, a sibling to your comment told me that Qubes OS does not have official GPU support so I guess it's not for me sadly.

You cannot. If you have VT-X and VT-d, you might be able to create a Windows HVM and pass through your GPU, but Qubes official support for this is close to nil, and success is very dependant on your specific setup. Some cards plainly won't work, some won't work with given CPU/Mobo combos, etc.

I made my GTX980 work on Arch, and tried on Qubes, but Qubes itself was too unstable for my daily driver, so I never got it complete.

That's too bad. Oh well.

Another approach is to run a minimal Arch on metal, and everything else in VMs. If your motherboard is compatible with GPU passthrough, the dGPU can now be passed among the VMs without hardware reboot. The GPU performance loss is minor, but I saw added latency variance when doing VR. I've seen several HN comments from folks happy with this approach.

I had the bug with the disk encryption screen on my xp13 as well. Removing the splash screen and just having a terminal helped it boot normaly. Something along the lines of this: https://askubuntu.com/questions/854388/ubuntu-16-04-cannot-e...

Please keep in mind when using Qube OS is that it does NOT protect you if your hardware is compromised. The NSA and other clandestine agencies have an easy backdoor to your computer even when running this.

No they don’t.

Sure they do, just not really Qubes OS specific ones though.

Do you have an example?

I never understood objections like this.

With a standard Linux system you have vulnerabilities X,Y,Z. With Qubes you have vulnerability X, so let's comment on Qubes and try to discourage people from using it because vulnerability X still exists? It's still better than the alternative!

I didn’t read that as discouraging people from using Qubes, but rather as a reminder than Qubes, like every OS, can’t protect you if your hardware is compromised.

That's a trivial conclusion and not related to Qubes OS. Every operating system somehow relies on hardware protection features.

If the ring architecture of processor can be circumvented, the protection of privileged code (kernel) is harmed. If you can circumvent the MMU's memory protection, the protection of privileged code is harmed. And if side channel attacks like Spectre and Meltdown are circumventing protecting features, the protection of sensitive data is harmed.

Every systems which has claims on security relies on explicit (that would be better) or implicit assumptions. And every operating systems I know of, at least implicitly assumes that the hardware isn't compromised.

Hey, this is neat! Unfortunately, after skimming the changelog, it still seems they're trotting along with Xen, and any "intermediate IT" person would still be using a bespoke solution.

What do you mean by that? What is "intermediate IT"? And what benefits do you see of a bespoke compartmentalisation system over Qubes?

Hey, sorry for the late reply. I got flagged for "posting too often," and just gave up after not being able to post this for a few hours:

Qubes is marketed as a VM for the "intermediate IT professional," i.e one that can setup a server from scratch and mess with configuration settings, even compile everything he needs from scratch, but not be able to make the informed decisions needed to harden things by himself.

So, this IT professional could install his own VM, set it up to sandbox his connections and programs, after reading documents and how-tos.

The benefits for bespoke:

1). Known toolset

This is pretty common in the "real world," where most would take a tool they're familiar with, than one they're not. In this case it would be the Linux environment. Why? Because the IT professional is already aware of the possible holes that he may need to fill and how to do it "correctly." I'm sure we all have had the experience of trying a new technology, messing up our first attempts at something decent, but then being able to make something good after practice. This is the same here. If you already know Qubes, great. If you don't and you're thinking about using it for your next project, make sure that project isn't mission critical.

2). Better documentation

Qubes OS is laughably under-documented (to parrot someone else's wording). With this comes the inability to be as flexible with the massivley-documented *BSD/Linux environment, limiting your overall productivity, and likewise, security and privacy. This also means you won't know where possible holes could develop, stemming from how the sandboxing really works in RT. This is a mostly solved problem with Unixes. You can harden your setup easily and with confidence, knowing you'll only be hit by massive zero days, if it all. With Qubes, you just don't know. Segue:

3). Qubes isn't battle-tested

The Xen debacle showed this. While Linux is not secure in any sense, we know where those insecurities lie through decades of use and misuse. This isn't the case for Qubes, which has been around less than Android.

4). Xen

Qubes uses stock Xen, which is not terribly good for security (direct access to hardware? What are you doing!?). You could better security by compiling your own version of Xen and removing all of the "niceties" that make Qubes not horrible to use. Or better yet, get a better hypervisor that's made for security in mind.

5). "A reasonably secure operating system"

Need I say more?

Reply on news.ycombinator.com