Slashdot Mirror


Ask Slashdot: Why Are There No True Dual-System Laptops Or Tablet Computers?

dryriver writes: This is not a question about dual-booting OSs -- having 2 or more different OSs installed on the same machine. Rather, imagine that I'm a business person or product engineer or management consultant with a Windows 10 laptop that has confidential client emails, word documents, financial spreadsheets, product CAD files or similar on it. Business stuff that needs to stay confidential per my employment contract or NDAs or any other agreement I may have signed. When I have to access the internet from an untrusted internet access point that somebody else controls -- free WiFi in a restaurant, cafe or airport lounge in a foreign country for example -- I do not want my main Win 10 OS, Intel/AMD laptop hardware or other software exposed to this untrusted internet connection at all. Rather, I want to use a 2nd and completely separate System On Chip or SOC inside my Laptop running Linux or Android to do my internet accessing. In other words, I want to be able to switch to a small 2nd standalone Android/Linux computer inside my Windows 10 laptop, so that I can do my emailing and internet browsing just about anywhere without any worries at all, because in that mode, only the small SOC hardware and its RAM is exposed to the internet, not any of the rest of my laptop or tablet. A hardware switch on the laptop casing would let me turn the 2nd SOC computer on when I need to use it, and it would take over the screen, trackpad and keyboard when used. But the SOC computer would have no physical connection at all to my main OS, BIOS, CPU, RAM, SSD, USB ports and so on. Does something like this exist at all (if so, I've never seen it...)? And if not, isn't this a major oversight? Wouldn't it be worth sticking a 200 Dollar Android or Linux SOC computer into a laptop computer if that enables you access internet anywhere, without any worries that your main OS and hardware can be compromised by 3rd parties while you do this?

12 of 378 comments (clear)

  1. just run the 2nd OS in a VM and call it a day by iggymanz · · Score: 5, Insightful

    real exploits of that situation are rare

    1. Re:just run the 2nd OS in a VM and call it a day by mysidia · · Score: 4, Insightful

      Run BOTH systems as VMs of a more secure system such as a Citrix or VMware Client Hypervisor or Qubes OS.

    2. Re:just run the 2nd OS in a VM and call it a day by ctilsie242 · · Score: 5, Informative

      If truly worried, I'd just have a dedicated machine where the sensitive OS runs in a VM. You can even set up some secure remote access so you don't have to lug two machines around everywhere. In fact, I'd consider multiple separate VMs, one for each client, so a compromise doesn't mean everything is lost, just whatever is opened at the time.

      Attacks where something jumping across or out of VMs is extremely rare. It can happen, but this is not a big attack vector, relatively.

      Plus, if you store your VM on an eSATA or USB 3.1 drive, when done with it, just unplug the drive and toss it somewhere secure. $200 buys you a FIPS compliant external SSD with hardware encryption from Apricorn. This takes care of the DAR (data at test) element, regardless of the OS. From there, a PC with VirtualBox, Hyper-V, VMWare, or Parallels can run the VM.

    3. Re:just run the 2nd OS in a VM and call it a day by DoraLives · · Score: 4, Interesting

      This is the answer.

      My own implementation presumes Windows as the (very) weak link in the chain, and it's run as a VM inside of Linux. I've given up on ever trusting Microsoft again, in light of the recent, ongoing, and ever-doubling-down, privacy horrors, endless stream of newly-discovered exploitable vulnerabilities, and forced corporateware installations associated with Win 10. So ok. So no Win 10. I went the other way. Win 7 Starter Edition SP1, stripped down to the ground floor, no Windows Updates, no antivirus, no anything, just the bare OS, to run the proprietary software (if the software demands an x64 OS, well then, we'll move up the Win7 hierarchy one notch) that demands Windows, to run smoothly enough, hassle-free. This Win7 VM is considered to be laying on the floor with its legs spread, and it only runs the programs it must run, and nothing whatsoever else. No games. No VOIP. Certainly no web browsers. It's drawbacks are obvious, but with adult supervision, nothing that cannot be dealt with, and it's lightning fast in its stripped-down state.

      If he wants a second Linux VM running alongside the Win7 VM inside the first one, well then, ok, so he shall have it. Whatever suits the situation most appropriately.

      Toss in a TAILS USB stick with encrypted persistent storage for situations that seem a bit sketchy for the above "standard" setup, and we're good to go.

      Again, your answer is the correct one.

      --
      Is it fascism yet?
  2. It's in your pocket by Syphonius · · Score: 5, Interesting

    That second system you are looking for, to browse and email and such, it's in your pocket.

    It's called your phone.

    The need you are describing is apparently not widespread nor strong enough for anyone to invest in implementing it in the way you describe.

    Use your phone.

  3. Duct tape another laptop to your main laptop by DontBeAMoran · · Score: 5, Informative

    'If the women don't find you handsome, they should at least find you handy.' — Red Green

    --
    #DeleteFacebook
  4. Virtualization is the answer. by Arkham · · Score: 5, Interesting

    Virtualization is the obvious answer. Inside your VMs you can run Linux, or Windows, or whatever. It's quite safe. You should run your work-related stuff in one VM, and your personal stuff in another VM, and not use the native OS for anything except the virtualization software.

    This is the most secure option you will find, and modern virtualization platforms (VMware, etc) will even let you set flashpoints where the VM is saved, and if there's an issue, you can rewind to the safe point and continue.

    There's little to no performance penalty as long as the hosted OSes run natively on Intel.

    --
    - Vincit qui patitur.
  5. Re: It's just easier to have a 2nd device by TimMD909 · · Score: 4, Funny

    I think you said the same thing twice. I also think you said the same thing twice. ;-)

  6. To Explain Where This Question Came From by dryriver · · Score: 4, Interesting

    This question originated in a patent writing effort I was a part of 3 years ago. Basically, we were drafting the patent document for an invention on one PC that had no internet connection at all - to keep the invention safe from prying eyes until the patent could be filed. And we were using another computer with internet connection in a different room to look up stuff on the internet, like patent writing regulations, patent formatting guidelines, patent filing deadlines, technical stuff and so on. It was a pain in the ass because to keep the invention to be patented confidential, we had to write the patent on one computer with no internet whatsoever, and do everything internet related on a separate computer, going back and forth between the 2 machines for weeks. So I thought - why not make a computer that can go on the internet WITHOUT potentially exposing the entire machine to the internet. Having a 2nd mini-PC inside the main computer that can go online but cannot expose the rest of the computer to any would-be hackers seemed like a great solution for this. There are many real-world situations where you DO need the power of a full Win 10/Core i7 PC to accomplish something, and DO need to look stuff up on the internet all the time while you are doing this - technical details or technical knowhow for example - but are constantly fretting that exposing the ENTIRE PC or laptop to the internet could result in your work being stolen. So I came up with the idea of 2 computers in one casing - 1 large, fully featured computer that is not seen by the internet, and 1 much simpler SOC computer that CAN see the internet and be seen by the internet. Its kind of like using little netbook computer alongside your main laptop for internet stuff, but the netbook is built into your main machine, and can run parallel to it when needed.

    --
    Why did the chicken cross the road? Because Elon Musk put an AI chip in its head.
  7. SplashTop by DrYak · · Score: 4, Informative

    actually some companies have indeed exactly tried that, with products such as SplashTop:

    some of the first Dell laptops to feature "Latitude On" where exactly that: a special custom SOC in a specially modified mini-PCIe card, that was able to run some restricted Linux (a web kiosk and a few built in apps. basically a distant ancestror of the chromebook concept), while accessing the nornal regular laptop screen and keyboard (but not much beyond that and certainly no access to any Sata mass storage).

    it had a few minor advantage (mainly, instant power-on, and lower power usage of the SoC compared to the main CPU)
    but a lot of disadvantage (complexity and restrictions due to the switching concept)
    and cannot be used at the same time as the main CPU with Windows.

    eventually, later version of "Latitude On" evolves into exaclty what you're suggesting: the mini-PCIe card evolved into an SSD with a Linux installation on it, and the main CPU simply dual booted into either the Linux installation on SSD or the Windows installation on SATA HDD.

    --
    "Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
  8. Re:Because.... by AmiMoJo · · Score: 4, Insightful

    Most people would just buy a tablet and optional Bluetooth keyboard for this purpose.

    Integrating a second SoC into a laptop is actually more complex than you probably realize. For example, how are you going to do things like share the screen between the SoC and main GPU? Okay, you need an extra video switch... But the screen power and backlight are also controlled by the main laptop chipset, so you need to split that out and allow the SoC to access that functionality as well. Same for the keyboard, trackpad, USB ports, wifi, battery charging system, audio subsystem and amps...

    --
    const int one = 65536; (Silvermoon, Texture.cs)
    SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
  9. Re:Dude... by twdorris · · Score: 4, Insightful

    You have a dog in this fight. You need to stop replying and start listening. Take the advice/comments you like and ignore the others. Your use case is simply too narrow to justify development. At some point you'll need to accept this and move on to the other (seeming reasonable, IMO) suggestions. For example, if you really have a big ol' 17" CAD laptop that you have to lug around, then an extra, thin, light weight tablet is *not* going to be noticeable to you...and given that no commercial application like what you're looking for has been maintained beyond initial release due to lack of interest as a previous commenter pointed out, you should probably start to acknowledge that no matter how good the idea might seem to you and your specific situation, it's doesn't apply to enough other people to justify it.

    And, BTW, referring to the extra IC as "little" and "small" over and over again isn't going to change the effort, complexity or market reality one bit. You're trying to trivialize the issue with verbal trickery. It's lame. Stop.