Hacker News Reader

Comment by fsflover | Hacker News Reader

Qubes OS defends even from such attacks: it doesn't show non-ASCII symbols in window titles in dom0: https://www.qubes-os.org/doc/config-files.

I think this OS deserves more attention. By the way, new version 4.1 is out: https://www.qubes-os.org/news/2022/02/04/qubes-4-1-0/.

View on HN

Not supporting unicode as a feature leaves out most of the world’s population. I’m not interested in such “features” as a non-native English speaker.

In window titles, that s fine. I like my French accents too but I can give them up for the hypervisor communication...

More than accents are non-Latin scripts.

Japanese, Korean, Chinese, Arabic, Hebrew, Russian, Tamil, Thai, etc begs to be remembered.

If you open my link, you will find how to switch it on.

> it doesn't show non-ASCI symbols in window titles in dom0:

Seems like one of the least interesting aspects of qubes. Was there a zero day in the font renderer? I would assume such a thing would be more about homograph attacks.

There have been many exploits related to Unicode text rendering.

> Was there a zero day in the font renderer?

As far as I'm concerned, freetype is another spelling for CVE. There have been multiple high impact vulns. Though it usually seems to require crafted fonts, so I wouldn't be too concerned about window titles using system fonts. Web fonts on the other hand.. disable 'em.

I used Qubes as a daily driver for much of 2021. It hogged too much ram so I stopped. Never disliked the lack of non-ascii support. Security is always more important.

> Never disliked the lack of non-ascii support.

Ah, the elusive quadruple-negative.

Each negative means +1 standard deviation verbal iq.

+1 for the reader. -1 for the writer.

I’ll have you know I’m in the top 50 on the wordle leaderboard.

What language? Prolog?

SHA-256 Passwordle, of course.

Also segregates every app/workspace into a different vritualized system IIRC

Yes this is in fact the main feature :-) Though it's not exactly as you say it. VMs are a first-class entity. You can easily make as many as you want to represent different security domains. But it's not every app (unless you want it to be).

I didn't even notice the unicode thing. But it doesn't surprise me. They have various similar conservative features. For instance, by default an app in a VM cannot get full screen access. To full-screen a video in youtube you have to full-screen in app and then hit Alt-F11. The concern is that the app somehow tricks the user into thinking that they're interacting with the host OS desktop. Also the host OS doesn't have Internet access; update package files are downloaded by another VM and copied over.

It's fairly paranoid by design, and their tagline is "a reasonably secure operating system".

If you have so little faith in your system that Unicode characters will lead to an exploit that you block them in window titles, your problem isn't Unicode, the problem is your code that processes and renders it. You still have a problem, you're just making it the user's burden to bear.

You should not have faith in software. You should verify and isolate.

I very explicitly didn't say "software". You should be distrustful of software. If you can't trust the system you've created, you've used or created bad software and then failed to build necessary safeguards. The answer is not to restrict the user, it's to make more robust systems.

What do you mean by "system you've created"? I didn't create anything. I use third-party software (e.g. Firefox) on my third-party OS (e.g. Debian).

Qubes runs Debian in a VM and isolates it to defend the user from threats.

They should just force the use of bitmap fonts. Unicode isn't the enemy.

Reply on news.ycombinator.com