Hacker News Reader

Comment by fsflover | Hacker News Reader

I am glad I am using Qubes OS, which isolates usb devices from the rest of the system.

macOS is also moving into this direction: https://developer.apple.com/system-extensions/

"DriverKit provides a fully modernized replacement for IOKit to create device drivers. System extensions and drivers built with DriverKit run in user space, where they can’t compromise the security or stability of macOS."

Sadly, DriverKit doesn't actually address all the reasons why you'd want a kernel extension.

Do you have an example?

Little Snitch, the most critical piece of Mac software after the kernel.

Tbh, is that not viable through packet fence? I also use little snitch and had not considered this.

Little Snitch will be fine. They will use the new API.

https://blog.obdev.at/little-snitch-and-the-deprecation-of-k...

Me too. However, I can't run it on one of my computers because I need to do development on it which requires the GPU.

I really wish there was a reasonable solution for using the GPU with Qubes. If that existed I wouldn't have to use any other distribution, ever.

Have you tried GPU passthrough? Will need two GPUs for that though.

Seems like a pretty ridiculous hoop to have to jump through.

What do you mean? The two GPUs or the part where you need to give the VM a GPU if you want that VM to have a GPU ?

You do realize you are talking to a person running Qubes?

I can confirm that Qubes requires additional mental, time and computational resources to run. Many people do not have those and for them it would indeed be ridiculous to use Qubes. Its advantages are not important enough to everyone.

How is Qubes? Was thinking about a Purism laptop w/ Qubes as a way of indulging my paranoia.

It's a cool idea and I've been lookin at it for a while, but it seems onerous to isolate everything.

Librem 15 is exactly what I am using with Qubes. It is my daily driver. Isolation not only helps against threats but also helps to organize my work and life. Unbelievably easy backups help too.

I always assume plugging in an untrusted USB to be security-suicide. At least on Windows it can run arbitrary code, by design. Given that, these bugs don't really affect my threat model at all.

I'm pretty sure I dont have an evil maid.

I do wince as my mate, who works as a binman, tests found devices on a Windows laptop.

So far he has got is about a terrabyte of free storage and no problems.

> and no problems

...that he knows about.

It's not just about software security, a simple USB device can fry its host (your computer).

https://en.wikipedia.org/wiki/USB_Killer

https://hackaday.com/2015/03/11/killer-usb-drive-is-designed...

https://hackaday.com/2015/10/10/the-usb-killer-version-2-0/

Reply on news.ycombinator.com