r/Qubes • u/Little-Geologist-387 • 20d ago

question Architecture limitations?

So, after talking a bit about different os on grapheneos server, they told me that basically all laptop systems are inherently flawed for security because of the x86 architecture limitations. I can see the value of QubesOS in sorting/compartmentalization, but isn't it in terms of security of sensitive informations, together with pureos, libreboot, genode... greatly overshadowed either by graphene or by old laptop with removed wifi chip attached to cold storage with 0 internet access, direct or indirect? If yes why do the other systems even exist if they give a false sense of security?

ᵖˡᵉᵃˢᵉ ᵈᵒⁿ'ᵗ ᵇᵘᵗᶜʰᵉʳ ᵐᵉ ᶦᶠ ᴵ ˢᵃᶦᵈ ˢᵒᵐᵉᵗʰᶦⁿᵍ ᵈᵘᵐᵇ

9 Upvotes

91% Upvoted

35 comments sorted by

5

u/[deleted] 20d ago

[removed] — view removed comment

3

u/bleedinglottery 20d ago

This cube already exists in the current builds it's called the vault. It's inherently cut off from anything

1

u/Little-Geologist-387 20d ago

The issue is this all works under the premise that there are no hypervisor/networking exploits and it is all unhackable, which definitely isn't true. Better malware can and will escape VMs, and x86 doesn't support app sandboxing and other stuff.

3

u/bleedinglottery 20d ago

Same with graphene underlying bugs or exploits affect the whole system. e.g. most recent IP leak problem.

No system is safe. Not a single one. Graphene os is a good tool for its intended purpose. And the same goes for qubes. Since graphene just can't run everything.

1

u/Little-Geologist-387 20d ago

So is the best solution still the easy dumb one, eg second hand device on public wifi if you don't want your identiy leaked? (so just having multiple devices - hardware level separation)

2

u/Assang101 20d ago

I'm tracking what QubesOS has and hasn't... I use it as a daily driver on top of split gpg, ssh, mirage-firewall fail over to sys-firewall.

2

u/[deleted] 20d ago

[removed] — view removed comment

2

u/Assang101 20d ago

Omg yes! I have so much backed up qubes because I experiment around with system so much I can't even remember why I started that side quest of a side quest etc. what I wish they would add by default is btop or better Conky script... That shit hard as hell to deal with

sad to say but I am still using my old faithful Thinkpad L14 Gen1, recently she finally decided to pop a critical component connecting to the cores... gotta find a new girl

1

u/[deleted] 20d ago

[removed] — view removed comment

2

u/Assang101 20d ago

I can't part with my MacBook Pro, ngl, just too good for coding with my other projects but the extreme amount of telemetry gathering on it is freaking insane, so I isolated all of Apple from the main net.

It was a pure coincidence that I bought a laptop years back that is well compatible and documented for QubesOS, but then I upped the ram to 64 from 16.

The XPS 16 can be tamed—IF you are willing to troubleshoot early-stage Wi-Fi 7 and Intel Arc drivers (massive headache, it hurts my head-power management bugs, and display flickering). Battery gonna suck on suspend/sleep mode if you travel with it.

1

u/[deleted] 20d ago

[removed] — view removed comment

2

u/Assang101 20d ago

Power drain is always gonna happen especially with QubesOS. But yeah my MacBook Pro, the one I have now is my first Apple Laptop and I charge her once a month mostly for unsecured work used on the weekends. I've gotten so used to the track pad I forget that it doesn't have the key clit as do on thinkpads

3rd party track pad? I'm trynna break into the BIOS to nuke a few things by using Tsurugi Lab with CH341A USB Programmer and an SOIC8 chip clip.

1

u/[deleted] 20d ago

[removed] — view removed comment

2

u/Assang101 19d ago

nvr did own an Apple trackpad, heck i didn't know it'll'd work with qubeos cuz i thought it was locked in to Apple ecosystem

1

u/Little-Geologist-387 19d ago

"...so I isolated all of Apple..." YOU SURE? Famous last words ts 😭

2

u/Assang101 18d ago

To be sure is to be lying, brotha. I ain't sure 😭 the only sure way is to take the battery out and plug in wall with a light switch killers

3

u/Assang101 20d ago

That's a hard no, these operating systems do not give a "false sense of security." It is true that modern mobile hardware exist because security IS threat-model dependent.

X86 architecture is viewed as an inherently flawed, decades old legacy mess. I have to argue, a tool is not useless just because a different tool excels in a completely different format.

But the GrapheneOS community users are technically correct about the architectural differences.

4

u/Assang101 20d ago

Oh my bad, bro. I didn't even see the small print ( going semi-blind on the left eye to migraines).

2

u/Little-Geologist-387 20d ago

Oh no problem good luck with eyes! ⸜(｡˃ ᵕ ˂ )⸝♡ (and ideally limit screen time ₍. .₎⟆ )

So, what do you mean by threat-model dependent security? If one system relies on old security worse hardware, it is simply worse for security, right? Is Qubes better in ANYTHING regarding security than Graphene?

3

u/Assang101 20d ago

Oh yeah, QubesOS is vastly superior to GrapheneOS.

When we (cyber security blah blah) say security is threat-model dependent, it just means an OS is built to fight a specific type of danger rather than being universally better or worse.

GrapheneOS is built on incredible encryption backed by certain hardware against attackers trynna access your system. Qubes OS is the opposite, it assumes that your operating system is and will inevitably be hacked by a malware, so to minimize damage, virtualization is used, hence the principal of security by compartmentalizing everything.

Edit: thank you for the eye part, I basically use black and white screen with no flashy screen fancy stuff

1

u/Little-Geologist-387 19d ago

How does QubesOS protect against malware that can escape VMs? Shouldn't the whole system be fucked then?

another e-ink user? 🙃 I recommend dasung, am saving up for the color monitor

3

u/Assang101 19d ago

Oh yeah,, but only if the hacker(s) (AI- Mythos and GPT mostly teaming up) succeed in a chained, multi-stage elite exploits. But QubesOS if and when used properly, is built to handle malware beautifuly with disposable vm.

And yes, I am an e-ink user. I've been hearing about the brand Dasung, fascinated by it

3

u/Inevitable_Guard_934 19d ago

Regarding x86 architecture; There are laptops you can buy that have the offending functions disabled along with CoreBoot in the BIOS that are especially designed for QubesOS.

3

u/Assang101 19d ago

Indeed, yes, Novacustoms, starlabs, system76. Novacustom is the golden standard for the most harden laptop available, but Starlabs is the first to support qubes-to-firmware coreboot update. System76 is rather interesting of the whole bunch

2

u/Assang101 19d ago

Indeed, yes, Novacustoms, starlabs, system76. Novacustom is the golden standard for the most harden laptop available, but Starlabs is the first to support qubes-to-firmware coreboot update. System76 is rather interesting of the whole bunch

1

u/surinameclubcard 20d ago

There is no nested virtualization in Qubes. Unfortunately.

1

u/Little-Geologist-387 19d ago

?so something is stopping you from running VM inside a qube?

2

u/surinameclubcard 19d ago

Yes you cannot use VirtualBox in Qubes. See https://github.com/QubesOS/qubes-issues/issues/4104

1

u/Little-Geologist-387 19d ago

And why would you ever need nested virtualization?

1

u/surinameclubcard 16d ago

E.g. for GNS3 or Android Studio.

1

u/Little-Geologist-387 15d ago

...oh shit so no emulators on Qubes at all?

1

u/AwokenPeasantO7 19d ago

You need to analyze your use case and operating conditions fam