Introducing Qubes 1.0 ("a stable and reasonably secure desktop OS")

http://theinvisiblethings.blogspot.com.br/2012/09/introducing-qubes-10.html

by rbanffy • 14 years ago

122 59 14 years ago

theinvisiblethings.blogspot.com.br

sbierwagen• 14 years ago

Previously:

http://news.ycombinator.com/item?id=1246990

http://news.ycombinator.com/item?id=2645170

This story won't see much traction on HN. The cult of Mac is too strong, and HN users generally aren't interested in secure operating systems.

m0nastic2• 14 years ago

Yes, Apple is the reason most people don't care about an unbelievably inconvenient desktop sandbox.

djcapelis2• 14 years ago

Haha. :)

To be fair, Apple's focus on usability and convenience could be linked to Qubes, in that they represent very different points on the "How much users should be thinking about security" spectrum.

ChuckMcM2• 14 years ago

Actually folks on HN are interested in secure operating systems but they recognize that creating such is a Hard Problem (tm) which someone who is an unknown [1] in the field is unlikely to have achieved.

Now you can read up on Mark Miller's published papers [2] on Joule (actually pretty secure) and some of the issues associated with making things secure and get a much better feeling of solidity (for example).

So when the press release comes out that its passed the Defense department's B1/B2 review, then I suspect it will get a lot of interest here and else where.

[1] http://www.linkedin.com/profile/view?id=10279027 LinkedIn profile, one job CEO of this thing? A blog full of black hat sort of exploits but I didn't see any peer reviewed work.

[2] http://research.google.com/pubs/author35958.html

[3] http://en.wikipedia.org/wiki/Trusted_Computer_System_Evaluat...

tptacek2• 14 years ago

Joanna Rutkowska is famous in computer security circles and highly credible on this particular topic.

The "black hat sorts of exploits" attributed to her tend to be things like, "abusing odd, barely-documented corners of x86 chipsets to bypass hardware-encrypted trusted boot roots". Thinking less of a professional in my field for having exploits attributed to them tends to be a bad idea, but it's a uniquely bad idea in Rutkowska's case.

Outside of conference presentations, Rutkowska doesn't have much peer-reviewed work in the literature. That's because Rutkowska is originally from the malware/rootkit/virus part of the industry. For obvious reasons, antivirus doesn't generate a lot of peer-reviewed academic research. One of those obvious reasons is that they're too busy printing money hats to bother. (This to my chagrin; I am very much not from the AV/malware part of the field).

I'm not vouching for Qubes or even saying that I think the approach (of semi-transparently allocating secure VMs for each application or trust domain on the system) is viable. But Rutkowska is worth taking seriously.

rdl2• 14 years ago

Invisible Things is pretty well respected in the trusted computing space (at least among the hacker world, not the DoD certification world)

SKPP pretty much sucked off all the "paper-writing industry" folks a few years ago into a kind of boring niche. Mark Miller is a big exception to that, but it's not a really vibrant research area compared to other parts of security now.

EliRivers• 14 years ago

Just to throw in another data point; I have never worked on or in secure Operating Systems and have no particular interest in them. I recognise the name Joanna Rutkowska and I am aware that she is well-known and respected in this field. In my case at least, she's well-known enough that people outside the field have heard of her.

signifiers2• 14 years ago

Unknown? Rutkowska has done some of the most interesting security research in virtualization security, including most famously the "Blue Pill" and "Red Pill" demonstrations - escalating privileges to Dom0 (and detection of presence of a hypervisor by the client). For both HVM and PV architectures (e.g., Windows & Xen), she and her colleagues have done ground-breaking work that have impacted the implementation of every major commercial and open source virtualization.

Academic pubs != Relevance

Edit: But since you asserted it, here are researchers that cite her work (over 130, including IEEE and ACM folk):

http://scholar.google.com/scholar?cites=13610021170603453007...

tptacek2• 14 years ago

I cannot for the life of me see what Qubes has to do with Apple.

sciurus• 14 years ago

Thanks for linking to the previous discussions. It would have ben better if you hadn't tried to derail this discussion with the prediction of how the post would fare and "cult of mac" comment.

hazov• 14 years ago

Not exactly a security guy (I'm actually a mathematician/statistician not exactly a computer engineer) how do these compare in security terms to sandboxing applications or using lxc from the linux kernel?

As far as I remember you could use different kernels for Xen VMs and the physical hardware, then the only way to compromise the system would be if I could escalate privileges on the hypervisor, right?

rdl2• 14 years ago

Right, but the point of this (I think) is to be able to be a "compartment mode workstation" -- a single X server which runs x clients themselves executing in multiple Xen VMs, with guarantees about isolation and how the windows are managed.

There's a continuum of security and usability between having (a) N machines in N rooms for N tasks to having (b) 1 machine on a single desk running N tasks. You can have a KVM switch and multiple computers sharing a keyboard/mouse/monitor, which gives you a high degree of isolation (very close to (a)), or you can have compartment mode, where windows themselves have security labels, but then you need an advanced system to protect apps in one window from other windows, including window masquerading attacks. If you do it well, it's ideally close to (a) as well.

The problem with virtualization on a desktop is that certain resources (video/keyboard drivers) don't like to be virtualized, so you end up running them in the system host area. Applications also tend to want pretty low-level access to those resources. It used to be the performance overhead of all of this was very high, but now it's not as big a deal (at least for normal 2d type apps).

The last good Compartment Mode Workstation I remember was Trusted A/UX (built on apple's first UNIX operating system) from the early 1990s. It wasn't particularly good.

greenyoda• 14 years ago

Brief description from their web site: "Qubes is an open source operating system designed to provide strong security for desktop computing. Qubes is based on Xen, X Window System, and Linux, and can run most Linux applications and utilize most of the Linux drivers. In the future it might also run Windows apps." (http://qubes-os.org/Home.html)

darklajid• 14 years ago

In fact, the version in development already runs Windows. The blog has a screenshot showing Windows running in 'desktop mode' (as in, you currently don't have single application windows for the Windows VM).

The extra requirements for this seem to be (ignoring that this isn't yet released) that you're having vt-x support, for all I remember.

dj2stein93• 14 years ago

Wow, talk about being out of touch with the real world. Developers, especially Linux developers, really need to give up on this whole "Desktop" operating system idea. It's not going to work. It is already dead. And I can hardly believe we are still using these ancient systems for many tasks even today. There is no future in WIMP, and people really need to stop developing these Windows clones already. It was lame 10 years ago. If you are still working on desktop OS clones today, you so are terribly out of touch with the real world there really is no hope for you or your product. Get over it.

Touch-based (and by extension, NUI-based) OS'es and mobile applications are the future. Windows always sucked. Mac OS always sucked. Every desktop OS ever built sucked because it is a horrible way to use a computer. Nobody ever really wanted to use these terrible desktop metaphor systems... they only ever did because they had to.

wittrock• 14 years ago

I'm going to go ahead and guess that the people behind Qubes were worrying less about the fact that the desktop paradigm may be fundamentally flawed in terms of usability (not going to argue on that one), but more about security, which is the stated goal of the project. Desktops may be on the way out, but that doesn't mean that we can't do some very basic security work on the heart of the OS. Looking at some of the documentation, it appears that their VM-per-application-group idea could scale very well to touch- and app-based interfaces with some work.

Security has a vital place in every OS, regardless of the skin you put over the top of it.

viraptor4• 14 years ago

I think you're missing the context here. This system is not about UI. It's not about desktop experience either. It's about making sure your email client is so separated from your $BUSINESS_APPLICATION, that exploiting one does not allow you to access anything on the other - and doing that without relying on handcrafted libvirt configs and hopefully without much processing overhead.

I guess the desktop environment was just a random choice of "this works, so just leave it in" from whatever distribution they started with.

erichocean• 14 years ago

That already exists: it's called a web browser.

Granted, browsers aren't without their security holes, but then again, neither are operating systems. Given the amount of effort being put into browsers to make them secure (especially Chrome), my money's on that.

mike-cardwell6• 14 years ago

This is what AppArmor and SELinux are for.

JasonFruit• 14 years ago

You made a lot of assertions there, but in my opinion, there's nothing like a desktop computer for day-to-day use. The future may be in touch-based applications, but if it is, it's going to tough to get anything accomplished in it. Maybe I'm just clinging to my guns and desktop computer, but I don't think I'm alone in that.

wrekkuh• 14 years ago

The reason i don't think this is funny is because it's compromising the maturity of this community. Please create a new thread stating your grievances, instead of distracting things.

SCdF2• 14 years ago

I'm sorry but none of that is even vaguely true, as true or false as something can be when it is entirely opinion.

Touch screens are to desktops as push bikes are to tractors. You need both. Some people even use both. Or just one. Or neither.

Maybe you feel this way because you've been driving a tractor around all this time and you feel like you've been wasting your time, however some of us (I imagine a lot of us on HN) like to do farming occasionally :-)

dj2stein93• 14 years ago

That reminds me of the John Ford quote:

  "If I had asked people what they wanted, they would have said faster horses."

People do not desire better desktop operating systems. They want computers to disappear. It simply does not matter how good this awesome new, secure, desktop OS is because it's built for a world that doesn't exist anymore.

wladimir2• 14 years ago

So please explain to me: what the hell does the input method (keyboard, mouse, touchscreen) have to do with the low-level security properties of a system? If anything, the switch to tablets and thus more ubiquitous computing makes security an extremely critical issue (see the many discussions about permission systems, application sandboxes, malware leaking personal information etc...). It will become even more pressing in the future, if you think about devices that are controlled by thought (EEG etc...).

mbq• 14 years ago

Think of a java applet in a browser catching all your keyboard input for instance; the general idea is that secure system must guarantee that user input goes where intended and only there.

zwdr• 14 years ago

That is seriously retarded. You don't use your computer to do actual work, do you? Because the keyboard simply is the best way to do things that are not downloading porn and browsing Facebook.

alberich• 14 years ago

>So, we believe Qubes OS represents a reasonably secure OS.

>(...) But then again, I'm biased, of course ;)

At least, they are honest heh

cyberpanther• 14 years ago

Very cool! So how does this compare to Chrome OS and it's sandbox technique for tabs. Yes I know it is only a browser, but with offline apps, executable code (native client), and local APIs, it is more like a normal OS.

mike-cardwell6• 14 years ago

It doesn't seem to support using full disk encryption during installation. I like the way it sandboxes things, but I'm not giving up full disk encryption for it.

mike-cardwell6• 14 years ago

I left a comment on the blog about this 7 hours ago. Seems it hasn't been approved but other comments have. Strange.

signifiers2• 14 years ago

Look again.

LUKS is used for all filesystems. Qubes was specifically engineered to block the Evil Maid scenario and similar vectors for notebooks. See pg. 31 from http://qubes-os.org/files/doc/arch-spec-0.3.pdf:

"There are several things that all together make the storage secure in the Qubes architecture:

1. Confidentiality, understood as preventing one VM from reading other VMs data

2. Confidentiality, understood as preventing access to the data when the machine is left unattended (full disk encryption, resistance to Evil Maid attacks, etc)

3. Integrity, understood as preventing one VM from interfering with the filesystem used by other VMs

4. Security non-critical role: a potential compromise of the storage subsystem doesnʼt result in other system components, like other VMs, compromise. Storage subsystem is not part of the TCB in Qubes OS."

See also, Section 7.1 System Boot Process, and 8.5 Resistance to Physical Attacks (or just search for "disk encryption").

mike-cardwell6• 14 years ago

Strange. I went through the install process in a VM and quit out when it started writing a filesystem without making any mention of disk encryption.

eckyptang3• 14 years ago

I genuinely can't think of anything else I'd rather use less than this.

I think MAC (Mandatory Access Control) applied to a desktop environment, picking a better language than C and actually thinking about stuff is more than sufficient to get around the existing problems...

Virtualization is just another pile of complexity and performance problems to deal with. It's not a magic bullet. Consider the following as well:

http://www.c0t0d0s0.org/archives/3651-Theo-de-Raadt-about-vi...

I really don't want this solution.

mike-cardwell6• 14 years ago

I will reserve judgement until I've given it a try. It might not be the ideal solution, but it looks like a nice stop-gap solution.

tjoff• 14 years ago

I really like the idea and I just can't wait for it to be more prevalent on mobile devices.

I'm sick of the lack of control over my data I have on android (not to mention iOS).

eckyptang3• 14 years ago

This is not a flame or a troll, but seriously try Windows Phone. It actually gets this spot on.

Torgo• 14 years ago

I've been following this, even tried to buy hardware to support it. Fair warning though, Version 1.0 does not support Ivy Bridge architecture. There's an unsupported experimental branch that is supposed to work, though.

Introducing Qubes 1.0 ("a stable and reasonably secure desktop OS")

Related Stories