Hacker News Reader

Comment by eddythompson80 | Hacker News Reader

Not really sure that’s safe. There has been at least 1 Qubes OS specific VM escapes this year and 2 KVM guest->host control ones.

View on HN

There were only two VM escapes from Qubes OS in the last 20 years [0]. How is this not sufficiently secure?

[0] https://forum.qubes-os.org/t/qsb-116-multiple-xen-issues-xsa...

You can set it up with FreeBSD's jail as well. You can create several types of jails on the fly too - either ephemeral or thin/thick jails. And with ZFS snapshots everything is very efficient.

You could also use a VM on FreeBSD too, but I would argue that it's very inefficient to boot up a VM for each application instance. A container/jail is virtually the same as a VM, except a VM uses your host's kernel. And kernels are probably the least of worries in terms of security for apps.

How many FreeBSD's jail escapes did we have in the last 20 years? Same question about VMs there.

> but I would argue that it's very inefficient to boot up a VM for each application instance

https://doc.qubes-os.org/en/latest/introduction/faq.html#doe...

> A container/jail is virtually the same as a VM

No, it's not, https://hn.algolia.com/?q=container+escape

Also Qubes doesn't just use VMs but enforces virtualization with hardware (VT-d).

Yes, that’s pretty bad. Best to keep that in mind when choosing a solution.

Which other OS provides a better security?

Reply on news.ycombinator.com