They cite that it removes the need for an air gapped system… They’re not claiming that it is one, just that it meets the requirements for their needs.
Also, since when was the concept of an air gap a one that only the vaunted druids of old could fathom?
1. If you need an air gapped computer, your threat model includes literally any electrical wire connecting to the outside world.
2. If you need an air gapped computer, your threat model includes literally any radio signal.
With this in mind, there is no way in fucking hell that a virtual machine can satisfy your requirements. That virtual machine literally resides on the same fucking wires as the host computer, this is even worse than a wire connecting two computers.
The Guardian is a media outlet, their job description is receiving information from sources securely. Some of that information will be extremely high value, like "the wrong people seeing this will lead to murders" extremely high value. Handling that kind of sensitive information absolutely requires air gapping to minimize your attack surface as much as humanly possible. Note humanly possible, not reasonably possible; reasonable isn't enough.
A properly air gapped computer is going to use as few physical connections to the outside world as possible. It will also be shielded from all radio signals. The only way to access it is a physical human moving from the outside world to secured space in which the air gapped computer resides.
If your threat model can be satisfactorily defended using virtual machines, you never needed air gapping in the first place.
If I need to prevent exfiltration of one logical machine’s data to another, and I’m in physical control of the hardware running both of them, I can:
(a) Try to prevent any electrical, radio, power, acoustic, or other signaling from one to the other, or:
(b) Run both in a fully deterministic mode such that the execution of one has no effect on the execution of the other.
Both have different costs and their security hinges on different sorts of verification, but it’s not at all clear to me that (a) is inherently better than (b).
A threat model that necessitates an air gap is indeed a strange one, I daresay even ridiculous.
To put it frankly, most people simply will never have to consider such a ridiculous threat model. Being suspicious of everything down to literally the copper wire in your power cord is something most people will rightfully consider ridiculous. For most people, a virtual machine will provide more than ample security for their needs, and it's been mentioned already that Qubes itself is great so nobody is discounting the value there.
The problem is we are not talking about normal people. We are talking about highly specific, highly special people handling highly valuable work, dogged by highly powerful hostiles. The very nature of these people and their work is ridiculous, which necessitates considering ridiculous threat models and implementing ridiculous security measures to guard against them.
Where someone needs an air gap, replacing that with Qubes is mind bogglingly stupid because to quote karma_pharmer who put it very poignantly[1]: That is not an air gap.
>If your threat model can be satisfactorily defended using virtual machines, you never needed air gapping in the first place.
There’s a very reasonable threat model in which KVM or Hyper-V or bhyve or Xen is inadequate and an air gap provides stronger protection.
But that’s not my point at all. Many uses of computers need to interact with potentially untrustworthy data, and make uses need to interact with untrustworthy transports that carry trusted data. An air gap is of little value if nothing can cross it. (Yes, some sets of threat models and design criteria allow data diodes.)
If I had a nation-state budget and wanted to get data across a gap, I would look toward a deterministic, formally verified VM. This is quite practical — a very simple, small VM can run an emulator that can emulate x86 or ARM. And I would also consider an air gap. But keep in mind that an air gap does not protect against persistent compromise of the thing on one side, whereas a formally verified VM does.
An air gap means there are physical barriers that are locked down (you are installing physical barriers and locking them down, right?), which means you can inspect anyone and anything trying to traverse it and prohibit anyone and anything that is even remotely suspect.
The fact you are even asking this demonstrates you (by far the most vocal of the "Qubes is enough" crowd here) don't understand air gapping.
In the article, they explain how they made a real, practical step towards a better security. Perfect is the enemy of the good.
I also like this reply: https://news.ycombinator.com/item?id=39952028
EDIT: Maybe these guys aren't experts and don't deserve to receive and handle sensitive information: https://news.ycombinator.com/item?id=39954815
There is no way to guarantee there will be no unauthorized access or movement of data without a hard, physical gap requiring manual, scrutinized traversal. No amount of software or hardware mitigations can suffice.
If Qubes is satisfactory for The Guardian, then they never needed air gapping in the first place. I find that hard to believe given what their job description is, but that is ultimately none of my business (though I won't give them any sensitive information, for the safety of both myself and others).
Meanwhile, if you need air gapping then Qubes by itself absolutely cannot satisfy your security needs. Because a virtual machine is not an air gap.
You absolutely still have not read their comment.
You can rant on about how they should treat their data as as if they’re nuclear launch codes, but they’ve made a deliberate decision to implement a solution that is secure enough for their needs.
If you still disagree, that’s fine, but the fact that you don’t understand the immense burden that a truly air gapped network would have on users and administrators speaks volumes of your own understanding of these types of systems and solutions.
>You can rant on about how they should treat their data as as if they’re nuclear launch codes, but they’ve made a deliberate decision to implement a solution that is secure enough for their needs.
Indeed, I disagree with The Guardian's assessment that virtualization is sufficient to protect their information. It's ultimately none of my business (literally so), though that won't stop me from being appalled at their callousness and I for one certainly won't provide them any information if I'm ever in such a position.
More generally in regards to this thread, I am horrified that so many people genuinely think virtualization can be a replacement for air gapping. Especially in the wake of vulnerabilities like Specter/Meltdown and Rowhammer, among many others.
>the fact that you don’t understand the immense burden
I absolutely understand how much work is required to create and maintain an air gapped environment, and the sheer inconvenience and borderline impracticality using them imposes.
I'm saying that handling sensitive information of this kind warrants all that and cannot be replaced by something easier, though I can sympathize with desires to do so because noone likes hard work.