Hacker News Reader

Comment by fsflover | Hacker News Reader

Expected that Qubes OS is used somewhere, but it's not. By the way, it's sometimes more secure than air gapping: https://invisiblethingslab.com/resources/2014/Software_compa....

View on HN

Qubes is awesome, I think the main thing it protects against though is an application you don't trust too much escalating it's privileges (for example a website sandbox escapes into the browser and then tries to go up further) - Since we're on an air-gapped, immutable system all the tools we have on our CD have some implicit trust, so if you manage to get software that isn't playing nice onto the OS, you've probably done it through hijacking the OS CD anyway (I covered a similar-ish question here: https://community.monzo.com/t/how-we-protect-our-most-sensit... )

We also don't run that many complex commands on the actual OS, it's basically one of three things 99% of the time:

- Mount this CD containing some CSRs or etc

- Ask the HSM to please sign this

- Burn a CD with these files and then report the hash / PGP word list of the content on the CD

Does coen boot from CD and switch to RAM? Or do you have 2-disk-drives to mount the second disk?

Coen boots off a CD and mounts itself into RAM as and when parts of it are loaded, but you still need the CD in the computer for it to load stuff not in RAM so we have a 2nd CD reader + writer for the material

You can tell if you're using a part of the OS that hasn't been used in a session yet because you can hear the CD drive with the OS CD in it physically spin up :)

QubesOS is security by compartmentalisation and allows you to segregate and air gap hardware virtually (which requires VT-d/IOMMU and trust there’s no Xen guest escape or hypervisor exploit). It’s a neat project though IMHO would be weaker for the threat model you describe in your blogpost.

https://forum.qubes-os.org/t/the-benefits-and-drawbacks-of-a...

Reply on news.ycombinator.com