Hacker News Reader

Comment by boesboes | Hacker News Reader

Nice work. I wonder whether we are on the right track with such architectures though. It seems with every security framework envisioned to combat some set of attacks, a whole new class of issues pop up. And I don't _feel_ like things are more secure in the end. A bit like dutch tax law, it is just a stack of patches to fix exploits and it might have achieved consciousness already! ;)

View on HN

Because many of these systems aren't designed end to end to be properly secure.

The right way to do it usually fails the market due to backwards compatibility or developer pushback to adopt such features (see WinRT sandbox).

Mobile phones security has it easier, because there wasn't backwards compatibility to care about, and so far the stores gatekeeping means that developers that want to play there have to oblige anyway.

> developers that want to play there

That pun was superb btw

That's not fair. The sandbox was not the reason for WinRT/UWP's failure in the market. It was the mostly unfinished tablet UI that they half ported from their phone and told developers that was the future. They even copied Apple and threw in some half-baked store with it. There was no way Microsoft was going to become successful at it, especially when Apple couldn't even get developers excited about their own implementation.

Most desktop software needs to provide value for customers, or they would just build the web version of it. Being "native" isn't enough.

So, if you want to require that us developers run our stuff inside of sandboxes, that's fine. Just make sure the sandbox doesn't prevent our software from getting access to the same important desktop surfaces.

windows had an app store back in vista days.

Ultimately security is incompatible with backwards compatibility. All OSes in prod today need to be rebuilt from the ground up to be secure for the next century. That means throwing out a lot of code too. It's the cost to pay.

> All OSes in prod today need to be rebuilt from the ground up to be secure for the next century

Qubes OS solves this with hardware virtualization, which is really fast and secure.

Compartmentalization is only a part of the solution. Once you have that finished, you still need to deal with the actual vulnerabilities in guests, which will contain your secrets and be exposed to the internet, one way or another.

Guests don't have to be exposed to the Internet [0] or even run full OSes [1].

[0] https://www.qubes-os.org/doc/how-to-organize-your-qubes/

[1] https://www.qubes-os.org/doc/templates/minimal/

In what way are [1] not “full OSes”? They’re minimal templates, but afaik they still run systemd, the kernel, etc. needed to boot the standard Linux systems they are.

When I clicked the link I was expecting something like a unikernel, eg https://roscidus.com/blog/blog/2016/01/01/a-unikernel-firewa...

You certainly can run distros without systemd [0] or something very different like *BSD or Mirage [2].

[0] https://forum.qubes-os.org/t/devuan-or-other-non-systemd-tem...

https://forum.qubes-os.org/t/alpine-linux-template-non-offic...

[1] https://forum.qubes-os.org/t/openbsd-as-a-ubes-os-component/...

[2] https://forum.qubes-os.org/t/mirage-firewall-0-9-0-released/...

> You certainly can run distros without systemd

Does it then become not a full OS anymore? Mirage is what I linked to above.

> Does it then become not a full OS anymore?

Probably not. I mentioned it, because you mentioned systemd. And yes, I saw your Mirage link and showed how you can use it on Qubes.

Qubes is nigh impossible for normal users, even if setup for them. They need extension training and discipline.

If you set it up, users can run anything themselves. Just use the start menu and the apps will automatically run in the corresponding VMs (shown as windows with colored borders).

Anything, except for practical applications that people actually use.

* music production software * discord * games * copy and pasting

Everything that works on Linux will generally work on Qubes, apart from the GPU-heavy applications [0], which will be addressed in the future [1]. Copying and pasting works fine [2]. OK, music production may not be possible at the moment [3].

[0] https://www.qubes-os.org/faq/#can-i-run-applications-like-ga...

[1] https://github.com/QubesOS/qubes-issues/issues/8552

[2] https://www.qubes-os.org/doc/how-to-copy-and-paste-text/

[3] https://forum.qubes-os.org/t/question-quality-of-external-us...

I run LM-Studio and [can run] Siemens PLM NX inside a Windows Server qube. GPU passthrough is no issue for me at least.

Can't comment on music production since I don't produce music (could be the need for realtime).

Discord runs fine both in-browser and in application. Raptor Lake seems to have zero issue with video voice chat, whereas Comet Lake can drag a bit in large rooms without a GPU. Qubes OS makes it dirt easy to multiprofile from all around the world.

I don't really game like others do; eye candy doesn't draw me in, but solving interesting puzzles/challenges does.

Copy & paste is superior in Qubes, skill issue sorry not-sorry. GIT GUD!

> Copy & paste is superior in Qubes, skill issue sorry not-sorry. GIT GUD!

How is it superior? Gamer insults aren't going to win folks over here. They're more likely to cause people to dismiss you.

I set up Qubes OS for and with technical, less-technical and non-technical people and I very much disagree. It only works well for those who are prepared and motivated to learn, and even then, it sometimes can be frustrating.

The copy-pasting between VMs, mentioned in a sibling, requires four steps: (1) copying to the source VM's clipboard, (2) copying to the global clipboard, (3) copying to the destination VM's clipboard, and (4) pasting to the destination. The shortcuts become part of your muscle memory after some use, but until they are, that is just one way in which Qubes gets in the way of productivity.

There are a bunch of minor quirks, often specific to the hardware, which the user needs to learn about and find workarounds for. But if they do, Qubes is probably the most seamless way to work with tons of (well-isolated) VMs. For example, SecureDrop [0] is based on Qubes and does seem to work well for journalists for securely receiving and working with documents from anonymous sources.

[0]: https://securedrop.org/

> and I very much disagree

> The shortcuts become part of your muscle memory after some use

So you agree that it's doable, just that it requires a bit more effort. It's definitely true.

> bunch of minor quirks, often specific to the hardware

Which is why there is a list of recommended hardware: https://forum.qubes-os.org/t/community-recommended-computers...

> That means throwing out a lot of code too. It's the cost to pay.

And likely, upsetting power users who want to run with all the safeties off.

It’s not just power users either. Regular Windows users howled with outrage when they had to enter their password to permit software to do a privileged task.

Also, users who actually want to get shit done.

Not necessarily “all the safeties off.” I’d define that as like, running as root always.

It’s more about not being locked out of actual admin access to my own computer.

I expect to have at minimum a developer mode that allows me to enter my password to allow me to run whatever code I want without OS vendor blessing. Heck, add a small coding challenge to unlock it. Whatever.

It kind of sounds like you're advocating the type of security where the computer is secure against its owner, can't be programmed by its owner, doesn't support modifications to the OS, and so on. Is that right, or so you envision a highly secure system that can be controlled by its owner?

Funny that you should mention Dutch tax law. I don't think it's controversial to say that some of those "exploits" were deliberately inserted. One may speculate that there are also some powerful forces pushing for more vulnerabilities in consumer computing.

Here are high-profile examples of each:

https://en.wikipedia.org/wiki/Dutch_Sandwich

https://en.wikipedia.org/wiki/Intel_Management_Engine#Assert...

Barium-class downboats appear to be sinking your battleship! :^O

Think again.

I'd be happy to, world you like to offer a suggestion?

As long as I don't see you joining the usual "duh this is a government backdoor" crowd next time any bug comes up, sure.

This blog post describes a class of vulnerabilities. That's why there are ten of them. A well-resourced adversary with the capability to influence software development would want their backdoor to be small and difficult to discover. In many cases they would like guarantees that they are the only entity to be able to abuse such a vulnerability. While one can argue that these bugs were difficult to find–they were only fixed now–they really aren't very good backdoor bugs. Why leave dozens of holes all over the place when you only need a few? It's much more likely that this is just a failure case that someone failed to consider.

Reply on news.ycombinator.com