Slashdot Mirror
Qubes OS 3.1 Has Been Released
Burz writes: Invisible Things Labs has released Qubes OS 3.1. Some of the features recently introduced into this secure concept, single-user desktop OS are Salt management, the Odyssey abstraction layer, and UEFI boot support. The 3.x series also lays the groundwork for distributed verifiable builds, Whonix VMs for Tor isolation, split-GPG key management, USB sandboxing, and a host of others.
Qubes has recently gained a following among privacy advocates, notable among them journalist J.M. Porup, Micah Lee at The Intercept and Edward Snowden.
Embodying a shift away from complex kernel-based security and towards bare metal hypervisors and IOMMUs for strict isolation of hardware components, Qubes seals off the usual channels for 'VM breakout' and DMA attacks. It isolates NICs and USB hardware within unprivileged VMs which are themselves are a re-working of the usual concept, each booting from read-only OS 'templates' which can be shared. Graphics are also virtualized behind a simple, hardened interface. Some of the more interesting attacks mitigated by Qubes are Evil Maid, BadBIOS, BadUSB and Mousejack.
Parole?
Only if you want to boot a completely secure OS and then spend a lot of time doing absolutely nothing useful with it. I guess maybe you could hammer out a decent manifesto with it, as long as you stuck to plain text. Odds are nobody would hack in and find it until you e-mailed it to the newspaper after your attack.
So... like, nuh uh dude, the FBI and CIA too!
Neither article nor front page of linked website says.
Last time I tried it, there were no games. Hopefully this has improved in this release.
When announcing a new "thing" or a new version, it's often helpful to tell people WHAT IT IS and WHAT IT IS FOR.
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
I'm waiting for 3.11 - Qubes for Workgroups.
not interested in it because it uses systemd.
OK, I'll bite... Yes, you probably could run Fallout 4 on Qubes IF you installed an additional graphics card on the system and assigned its PCI device to the VM were you installed the game. Qubes cannot yet virtualize 3d GPU access, so VMs either have to go through the shared virtual 2d mode or have a whole (additional) graphics card assigned to them via the IOMMU.
Its also possible you could run the game in the privileged domain where it would have access to the GPU, but I'm not sure if taking that risk would be worth it.
There has been some experimentation with GPU virtualization, but progress has been slow on that front.
Just a few ideas for the Qubes OS...
Qubes OS needs to use the Mirage OS model for all its master (dom0) and utility VMs (network, VPN, firewall, usb controller/multiplexer, vault, storage, crypto, ...). If there was a way to use the Linux loadable module interfaced easily in the Mirage OS it would allow access a larger number of available/newly updated device drivers. Another possibility is to use minimal kernels like Atom or CoreOs and add the modules as required. Full OS VMs would still be allowed for things like work, personal, private (TOR) browsing, ...
The GUI needs a permanent VM status bar (VMsb) that only the dom0 controls. It would be positioned on the top of the main display monitor. This would mean that no other VM would be able to have full screen access to the monitor. The VMsb provides the following information: name of the active VM window, security level, color security coding, dynamic VM window change (task bar flashing?), drop down tool for providing USB access for the active VM, drop down tool for active VM security/network/devices). This would allow for special processes like a password entry/authorization system.
One of the problems with all operating system Window systems is protecting the entry of passwords. The dom0 can control that by: opening a password entry window, indicating via the VMsb that a password entry window is open, graying out all background VM windows. All utility VMs will have a module that requests from the dom0 a password verification (send VM, user name) and the dom0 returns an authentication token. The full VMs could have special PAM modules added to them to allow them to access the new password entry/authorization system.
The USB controller/multiplexer VM should allow the dom0 to allocate individual USB devices to specific VMs. It would act lice a USB firewall router. This could mitigate the issue with IOMMU only allowing all or nothing access to the USB controller and all devices on the controller bus. It would also allow the dom0 to run all keyboard, mouse/track pad entry past any possible malware attempting to read confidential input information (passwords,...).
Could this run on Raspberry Pi or does that lack some necessary hardware support?
I won't be playing that game again until I find a mod that lets me shoot Preston Garvey in the face and have him fall to the ground, dead, never to rise again, and then lets me craft a wall trophy with his salvaged head, stupid hat, and some wood that I can mount on a random wall somewhere in a settlement I'll rarely have cause to visit.
Fuck your shitty radiant quests, Bethesda. Leave the Fallout games to people with a clue like Obsidian in the future please. Also, where the fuck is the GECK so people can get around to properly repairing your abortion of a game that never manages to do much more than look a bit pretty?
This is why I love Slashdot. Ask a stupid question and get a thoughtful, serious answer that might actually be useful.
Thanks, Burz. You're OK.
You are welcome on my lawn.
Can I run applications, like games, which require 3D support?
Those won’t fly. We do not provide OpenGL virtualization for AppVMs. This is mostly a security decision, as implementing such a feature would most likely introduce a great deal of complexity into the GUI virtualization infrastructure. However, Qubes does allow for the use of accelerated graphics (OpenGL) in Dom0’s Window Manager, so all the fancy desktop effects should still work.
Sooo.... not desktop then? Like I give a fuck if my windows wobble. I need my apps to do 3d stuff too, otherwise it's like I don't have a 3d card. How 1980's of you.
Sorry, Qubes is too complicated for your handicapped brain. Don't use it, I don't want it to become "idiot-friendly" to appeal the masses, otherwise one day it'll be a spyware like windows 10.
You're OK too, for a corrupt ex-Pope :P
..Can I run Enlightenment or XFCE (for example) or am I bound to KDE?
Now, if you'll excuse me, I have backups to corrupt.
good
https://www.youtube.com/watch?v=5wldG1nbiOU
Back 10 years ago, when researching game exploits for anticheats, I remember first reading about Joanna Rutkowska - who is a dev on Qubes - and (no proof of this) I think I recall reading that she may have sold some exploit code, maybe even a full exploit framework, for money (to who, I don't know - but think about who the major buyers of such exploits are...), i.e. placing her firmly in black-hat territory, which means there may be a potentially huge conflict of interest on this privacy OS project.
I could be wrong about this, it could just have been a rumour - but people should hound the devs of Qubes, for a disclosure of past conflicts of interest.
Most especially, find out if any of them have ever accepted any money at all, from any intelligence agencies known for spying using exploit code - and in general, find out if any of them have ever sold exploit code, and if so, to who.