Hacker News Reader

Comment by fsflover | Hacker News Reader

> How do you secure your workstation without living like a monk?

Using Qubes OS. It's really easier than you might think. The UX is amazing. Can't recommend it enough.

Not too familar with Qubes, but it looks like it offers security by using virtualized domains (e.g. one for your dev environment, another for personal browsing, etc.) and the interactions between the domains are controlled. However, in the OP's case of a VSCode plugin containing malware, his entire dev domain will as a result be compromised as a result of this plugin. If he uses the same VSCode plugin in his personal domain as well, that will also get compromised.

I wonder if an approach similar to Firejail would work better, by say severely restricting what VSCode can do (e.g. what directories it can access, controlled network access, etc.).

Yes, Qubes provides security with virtual machines. You can compartmentalize you dev environment further: develop different things separately and use disposable virtual machines for most untrusted stuff. Also, you can simultaneously harden your development VMs.

When I've been on video calls with people using Qubes (admittedly rare, since few users), they inevitably can't get video or sound working or have to wait 5-10 minutes into the call for them to re-enable some system access to drivers for the window for the video call.

Not a problem for a developer who mostly communicates internally with a singular video call setup that you can optimize. But impossible for a founder, executive or salesperson that constantly has to be interacting with every video/call system in existence and doing screenshares and everything.

Video calls work fine for me. It's all about the Linux-compatible hardware. Here is a good list: https://forum.qubes-os.org/t/community-recommended-computers....

Apart from that, on Qubes you need to manually choose which VM will have access to a microphone and camera, so it may take an additional minute (but not ten minutes!). Persistent connection to a chosen VM should also be possible.

There's no reason why everything should happen on the same machine, hardware is relatively cheap. Don't shit where you eat; don't do your web browsing / videoconferencing / exploration of interesting new tools on the same machine from which you have privileged access to sensitive things. Virtualization is an option, but just buying an extra laptop might be more straightforward.

I find myself frequently wanting to screen share the things that I’m actively working on. I suppose I could use HDMI capture and confine myself to sharing only full screens (which might suck for viewers at 4K res or require me to switch to 1080p on that screen), but for a lot of people there is perhaps more overlap between video conferencing and work than full segregation would support.

If you're on Linux, xpra might be an option here. Just stream the rendered window from your sensitive access computer to wherever you need to show it.

> Don't shit where you eat

1) Chromebook for web, social media. Separate profiles for personal trusted (banking), personal untrusted (browsing and social media), office/client work.

2) Separate laptop as VM host for development. Never pollute the host with third-party libraries or anything downloaded from the web, all that happens in disposable guests.

3) ssh and sftp from Chromebook to VMs as needed.

I’ve been thinking about something similar. I have an old laptop that I’ve been thinking of throwing proxmox or something similar on and just hosting VMs for my “daily driver” laptop to connect to

Yeah, the more I think about it, the more it seems like this might be the way to go. What are the drawbacks? I know GPUs are hamstrung, so gaming isn't viable. But I can use another machine for that. What else?

The main challenge is that you need to adjust your workflows, making them separate for separate security domains. For example, never run untrusted application in a trusted banking VM etc. Otherwise there is this: https://forum.qubes-os.org/t/major-ux-pain-points. Many of those pain points are solved by Qubes 4.1, which is not released yet, but there is a release candidate: https://www.qubes-os.org/news/2021/11/17/qubes-4-1-rc2/.

> I know GPUs are hamstrung, so gaming isn't viable.

Technially, you can also make a GPU passthrough.

Reply on news.ycombinator.com