Slashdot Mirror
Qubes OS 3.1 Has Been Released
Burz writes: Invisible Things Labs has released Qubes OS 3.1. Some of the features recently introduced into this secure concept, single-user desktop OS are Salt management, the Odyssey abstraction layer, and UEFI boot support. The 3.x series also lays the groundwork for distributed verifiable builds, Whonix VMs for Tor isolation, split-GPG key management, USB sandboxing, and a host of others.
Qubes has recently gained a following among privacy advocates, notable among them journalist J.M. Porup, Micah Lee at The Intercept and Edward Snowden.
Embodying a shift away from complex kernel-based security and towards bare metal hypervisors and IOMMUs for strict isolation of hardware components, Qubes seals off the usual channels for 'VM breakout' and DMA attacks. It isolates NICs and USB hardware within unprivileged VMs which are themselves are a re-working of the usual concept, each booting from read-only OS 'templates' which can be shared. Graphics are also virtualized behind a simple, hardened interface. Some of the more interesting attacks mitigated by Qubes are Evil Maid, BadBIOS, BadUSB and Mousejack.
Parole?
Only if you want to boot a completely secure OS and then spend a lot of time doing absolutely nothing useful with it. I guess maybe you could hammer out a decent manifesto with it, as long as you stuck to plain text. Odds are nobody would hack in and find it until you e-mailed it to the newspaper after your attack.
So, can I run Fallout 4 on this bad boy or what? Or is it just for journalists, privacy activists, criminals, and members of ISIS?
You are welcome on my lawn.
Neither article nor front page of linked website says.
Last time I tried it, there were no games. Hopefully this has improved in this release.
When announcing a new "thing" or a new version, it's often helpful to tell people WHAT IT IS and WHAT IT IS FOR.
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
I'm waiting for 3.11 - Qubes for Workgroups.
not interested in it because it uses systemd.
Just a few ideas for the Qubes OS...
Qubes OS needs to use the Mirage OS model for all its master (dom0) and utility VMs (network, VPN, firewall, usb controller/multiplexer, vault, storage, crypto, ...). If there was a way to use the Linux loadable module interfaced easily in the Mirage OS it would allow access a larger number of available/newly updated device drivers. Another possibility is to use minimal kernels like Atom or CoreOs and add the modules as required. Full OS VMs would still be allowed for things like work, personal, private (TOR) browsing, ...
The GUI needs a permanent VM status bar (VMsb) that only the dom0 controls. It would be positioned on the top of the main display monitor. This would mean that no other VM would be able to have full screen access to the monitor. The VMsb provides the following information: name of the active VM window, security level, color security coding, dynamic VM window change (task bar flashing?), drop down tool for providing USB access for the active VM, drop down tool for active VM security/network/devices). This would allow for special processes like a password entry/authorization system.
One of the problems with all operating system Window systems is protecting the entry of passwords. The dom0 can control that by: opening a password entry window, indicating via the VMsb that a password entry window is open, graying out all background VM windows. All utility VMs will have a module that requests from the dom0 a password verification (send VM, user name) and the dom0 returns an authentication token. The full VMs could have special PAM modules added to them to allow them to access the new password entry/authorization system.
The USB controller/multiplexer VM should allow the dom0 to allocate individual USB devices to specific VMs. It would act lice a USB firewall router. This could mitigate the issue with IOMMU only allowing all or nothing access to the USB controller and all devices on the controller bus. It would also allow the dom0 to run all keyboard, mouse/track pad entry past any possible malware attempting to read confidential input information (passwords,...).
Could this run on Raspberry Pi or does that lack some necessary hardware support?
Can I run applications, like games, which require 3D support?
Those won’t fly. We do not provide OpenGL virtualization for AppVMs. This is mostly a security decision, as implementing such a feature would most likely introduce a great deal of complexity into the GUI virtualization infrastructure. However, Qubes does allow for the use of accelerated graphics (OpenGL) in Dom0’s Window Manager, so all the fancy desktop effects should still work.
Sooo.... not desktop then? Like I give a fuck if my windows wobble. I need my apps to do 3d stuff too, otherwise it's like I don't have a 3d card. How 1980's of you.
..Can I run Enlightenment or XFCE (for example) or am I bound to KDE?
Now, if you'll excuse me, I have backups to corrupt.
good
https://www.youtube.com/watch?v=5wldG1nbiOU
Back 10 years ago, when researching game exploits for anticheats, I remember first reading about Joanna Rutkowska - who is a dev on Qubes - and (no proof of this) I think I recall reading that she may have sold some exploit code, maybe even a full exploit framework, for money (to who, I don't know - but think about who the major buyers of such exploits are...), i.e. placing her firmly in black-hat territory, which means there may be a potentially huge conflict of interest on this privacy OS project.
I could be wrong about this, it could just have been a rumour - but people should hound the devs of Qubes, for a disclosure of past conflicts of interest.
Most especially, find out if any of them have ever accepted any money at all, from any intelligence agencies known for spying using exploit code - and in general, find out if any of them have ever sold exploit code, and if so, to who.