Slashdot Mirror
Ask Slashdot: Why Are There No True Dual-System Laptops Or Tablet Computers?
dryriver writes: This is not a question about dual-booting OSs -- having 2 or more different OSs installed on the same machine. Rather, imagine that I'm a business person or product engineer or management consultant with a Windows 10 laptop that has confidential client emails, word documents, financial spreadsheets, product CAD files or similar on it. Business stuff that needs to stay confidential per my employment contract or NDAs or any other agreement I may have signed. When I have to access the internet from an untrusted internet access point that somebody else controls -- free WiFi in a restaurant, cafe or airport lounge in a foreign country for example -- I do not want my main Win 10 OS, Intel/AMD laptop hardware or other software exposed to this untrusted internet connection at all. Rather, I want to use a 2nd and completely separate System On Chip or SOC inside my Laptop running Linux or Android to do my internet accessing. In other words, I want to be able to switch to a small 2nd standalone Android/Linux computer inside my Windows 10 laptop, so that I can do my emailing and internet browsing just about anywhere without any worries at all, because in that mode, only the small SOC hardware and its RAM is exposed to the internet, not any of the rest of my laptop or tablet. A hardware switch on the laptop casing would let me turn the 2nd SOC computer on when I need to use it, and it would take over the screen, trackpad and keyboard when used. But the SOC computer would have no physical connection at all to my main OS, BIOS, CPU, RAM, SSD, USB ports and so on. Does something like this exist at all (if so, I've never seen it...)? And if not, isn't this a major oversight? Wouldn't it be worth sticking a 200 Dollar Android or Linux SOC computer into a laptop computer if that enables you access internet anywhere, without any worries that your main OS and hardware can be compromised by 3rd parties while you do this?
real exploits of that situation are rare
End thread.
It would be complex, expensive, huge and stupid. Dual boot, encrypt both partitions.
That second system you are looking for, to browse and email and such, it's in your pocket.
It's called your phone.
The need you are describing is apparently not widespread nor strong enough for anyone to invest in implementing it in the way you describe.
Use your phone.
'If the women don't find you handsome, they should at least find you handy.' — Red Green
#DeleteFacebook
Just carry a second laptop around! 2 Surface Pros are still less weight and size than just 1 typical laptop from 4 years ago!
Virtualization is the obvious answer. Inside your VMs you can run Linux, or Windows, or whatever. It's quite safe. You should run your work-related stuff in one VM, and your personal stuff in another VM, and not use the native OS for anything except the virtualization software.
This is the most secure option you will find, and modern virtualization platforms (VMware, etc) will even let you set flashpoints where the VM is saved, and if there's an issue, you can rewind to the safe point and continue.
There's little to no performance penalty as long as the hosted OSes run natively on Intel.
- Vincit qui patitur.
I think you said the same thing twice. I also think you said the same thing twice. ;-)
A hardware division of your resources is problematic because they'll never be fully indepedent. They will at least share a keyboard, monitor and probably camera and microphone. So a route between each system is still possible to establish and may be difficult to protect with a hardware only solution.
From software side you can implement more complex policies and enforce them with virtualization. There are OSes specifically to address what you are looking for and do so at different layers, for example Qubes OS lets you do a VM per window and color codes them. And something like BitVisor has a narrower focus on protecting your VPN keys and encrypting your harddrive, from there you can dual-boot and have only your "business" system access certain encrypted partitions and use the VPN. without exposing that information to your personal system. (and vice versa if you choose)
But sadly there are a lot of problems with virtualization that is secure these days due to flaws in CPU architectures. I feel that these issues will be mostly if not completely resolved, but it may take two or three years.
“Common sense is not so common.” — Voltaire
What the hell is googling? Let me bing that...
#DeleteFacebook
This question originated in a patent writing effort I was a part of 3 years ago. Basically, we were drafting the patent document for an invention on one PC that had no internet connection at all - to keep the invention safe from prying eyes until the patent could be filed. And we were using another computer with internet connection in a different room to look up stuff on the internet, like patent writing regulations, patent formatting guidelines, patent filing deadlines, technical stuff and so on. It was a pain in the ass because to keep the invention to be patented confidential, we had to write the patent on one computer with no internet whatsoever, and do everything internet related on a separate computer, going back and forth between the 2 machines for weeks. So I thought - why not make a computer that can go on the internet WITHOUT potentially exposing the entire machine to the internet. Having a 2nd mini-PC inside the main computer that can go online but cannot expose the rest of the computer to any would-be hackers seemed like a great solution for this. There are many real-world situations where you DO need the power of a full Win 10/Core i7 PC to accomplish something, and DO need to look stuff up on the internet all the time while you are doing this - technical details or technical knowhow for example - but are constantly fretting that exposing the ENTIRE PC or laptop to the internet could result in your work being stolen. So I came up with the idea of 2 computers in one casing - 1 large, fully featured computer that is not seen by the internet, and 1 much simpler SOC computer that CAN see the internet and be seen by the internet. Its kind of like using little netbook computer alongside your main laptop for internet stuff, but the netbook is built into your main machine, and can run parallel to it when needed.
Why did the chicken cross the road? Because Elon Musk put an AI chip in its head.
You're trying to solve a problem in hardware. We're about twenty years past that. Hardware doesn't do anything anymore.
Back in my day, "drivers" were a bad thing -- there were modems, and there were winmodems, that latter needed software drivers. That logic has flipped. Now hardware does nothing without software driving it.
You're trying to double your hardware, and then add more hardware to switch between them. That's just not the equation anymore.
And in truth, you wouldn't want that. You wouldn't want to be using your SOC to browse the web, and then not be able to get that document/data/image onto your work hardware to, you know, actually work with it.
As far as protections are concerned, you're either using your SOC to access the internet to get sensitive data anyway (like e-mail) and hence you've secured absolutely nothing, or you're getting a file to transfer to your work machine, and hence you've breached your own security anyway.
If you know what you're doing, and it sounds like you could, then it's not difficult to secure your work data from your internet connection. Think about the easy things -- like a second hdd/ssd for the work file.
Secondary storage drives are easily turned off in device manager on a whim.
Don't visit terrible sites at all. Don't walk down dark alleys with your 10-year-old daughter ever.
Know how to clear buffers, and generally know that all's clear before spinning up that work drive.
But most of all, know:
that Ethan Hunt can always break in,
that there aren't as many Ethan Hunts as you've been led to believe,
that most of the time, Ethan Hunt doesn't actually harm you when he gets what he wants.
You aren't actually responsible for the edge cases, so don't expend all of your energy defending against them.
My now-ancient ASUS G50VT included ExpressGate. Based on Splashtop, burned into the BIOS ROM, manageable. Rudimentary Firefox browser, email client, Skype, and obviously hard to update. But it ran independently of any OS installed on storage.
Splashtop is now done, but it was also used by ASUS on some motherboards, and then endured obscurity, competition, and finally turned into something else.
It did work. It was pretty minimal, and could have been cool. And it certainly is possible today, even in BIOS, with flexibility and update capabilities, but somehow I don't see any of this on the market.
The obvious solution would be to embed ChromeOS or something similar, fairly lightweight and useful. This could let you keep your primary OS invisible.
Cost?
deleting the extra space after periods so i can stay relevant, yeah.
actually some companies have indeed exactly tried that, with products such as SplashTop:
some of the first Dell laptops to feature "Latitude On" where exactly that: a special custom SOC in a specially modified mini-PCIe card, that was able to run some restricted Linux (a web kiosk and a few built in apps. basically a distant ancestror of the chromebook concept), while accessing the nornal regular laptop screen and keyboard (but not much beyond that and certainly no access to any Sata mass storage).
it had a few minor advantage (mainly, instant power-on, and lower power usage of the SoC compared to the main CPU)
but a lot of disadvantage (complexity and restrictions due to the switching concept)
and cannot be used at the same time as the main CPU with Windows.
eventually, later version of "Latitude On" evolves into exaclty what you're suggesting: the mini-PCIe card evolved into an SSD with a Linux installation on it, and the main CPU simply dual booted into either the Linux installation on SSD or the Windows installation on SATA HDD.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
You want a second OS? Use a VM. You want to keep your confidential files private? Encrypt them and only decrypt them when you feel like it's safe to do so. You don't like people trying to spy on you when you're connected to public wifi? Use a VPN. Everything you listed already has solutions readily available and that frankly are better options than booting into a completely different OS.
basically what you're asking for is perfectly reasonable but "not considered financially viable". even for EOMA68 (for which i'm the copyright holder of the Certification Mark), if you are expecting to have the power of a "modern" intel-based laptop in the form of a physically removable Computer Card where you would be able to isolate "work" from "external stuff", it's going to take another 4-5 years before the power reductions and performance increases from are sufficient so that it's actually even possible to fit a complete "high to medium performance" quad or octal core 3+ ghz computer plus 8 to 16 GB of RAM into such a small space.
the only *hardware*-level system that i ever heard of which had some form of dual (independent) processor system in it was about three to five years ago, it was announced here on slashdot: it was something like Lenovo or Dell who had put in an independent processor that could boot from the "BIOS" (if it's a full operating system it's hardly a BIOS but you know what i mean) into a complete and self-contained GNU/Linux OS with its own web browser.
aside from that, the only viable suggestions that you will get (and there will be some which will get lots of +1 moderations) will be dual-boot, or hypervisor-based (not that that means much any more with the spectres and meltdowns coming out the woodwork) virtual machining, or external USB memory-stick-based GNU/Linux OSes, and so on and so forth, all of which provide physical access to the drive, consequently *in theory* could actually maliciously be exploited and end up damaging the drive.
unless the work OS hard drive is removable. or the work OS hard drive *IS* the external USB stick and you swap over the USB sticks from work to "other" and back again. that would actually do the job that you're looking for, albeit with the performance penalty associated with some forms of external USB media, so you would have to do your research.
sorry it's not better news! honestly, though, if you absolutely really want to use the on-board (internal) drive, do consider virtualising the entire windows OS and sandboxing it... *and* sandbox the "other" OS as well. so that's 3 operating systems: the hypervisor / manager one (which you NEVER permit access to the internet) and that one should without a shadow of doubt be GNU/Linux-based. then you run Windows under QEMU (please don't use oracle virtualisation products), *AND* you run the "other" OS also under QEMU (or other suitable hypervisor system, do investigate XEN etc.) but... like i said: for all of these, you have to take into account the fuckups by Intel in the design of their processors where they prioritised profit over security: spectres, meltdowns and much more yet to be discovered.
In business unless you're working in IT, the security of your work laptop will be out of your hands as well as generally not your problem. If your work laptop gets compromised and you didn't hand out your credentials or physical access to someone then the IT dept didn't do their job properly.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
.
Your NIC with its DMA controller is IOMMU constrained inside the sys-net VM, so it wont let it write to memory outside its own memory space. The sys-filewall VM and its iptables and nat keeps all your internal user VM's safe from the network.