←back to thread

Qubes OS: A reasonably secure operating system

(www.qubes-os.org)
441 points ploggingdev | 1 comments | 19 Nov 17 16:06 UTC | HN request time: 0s | source
Show context
snvzz ◴[19 Nov 17 17:00 UTC] No.15734641[source]▶
Their weakest point is the hypervisor, Xen, which while a better choice than Linux/KVM, is still extremely bloated and has a poor security history.

Thankfully, better designs such as seL4's VMM do exist, although it might need a little more work [1] until usable for the purpose.

[1] https://sel4.systems/Info/Roadmap/

replies(6): >>15734676 #>>15734739 #>>15734803 #>>15734841 #>>15734956 #>>15735067 #
mmrezaie ◴[19 Nov 17 17:17 UTC] No.15734739[source]▶
Xen's hypervisor's size is very small. Qubes is about security and trustability of the whole system. In operating systems for measuring the trustability of the system, one very important measure is the lines of the code. Xen has a smaller footprint in the hypervisor part. Additionally, Xen has a robust model isolation for the drivers. That's why they went for Xen not KVM. But boy I wish to see more seL4. It was sad to see Gnu Hurd/seL4 didn't make it.
replies(3): >>15734755 #>>15734790 #>>15735029 #
xyzzyz ◴[19 Nov 17 17:19 UTC] No.15734755[source]▶
The problem with Xen is that no major industry player is backing it, especially with Amazon going KVM now.

(disclaimer: working at Google on virtualization security)

replies(3): >>15734816 #>>15734838 #>>15737654 #
pjmlp ◴[19 Nov 17 17:29 UTC] No.15734816[source]▶
What about Cisco?
replies(2): >>15738401 #>>15738863 #
gggvvh[dead post] ◴[20 Nov 17 07:33 UTC] No.15738401[source]▶
What about an Indian company selling overpriced market-segmented-to-hell shit?
1. pjmlp ◴[20 Nov 17 08:58 UTC] No.15738696{3}[source]▶
I don't know, doing business like every other major IT company?