Hi,
I have stopped using Windows years ago but I am facing the unfortunate need to use some specific software that doesn’t run properly in wine and requires actual Windows. (FWIW, it seems the software I have to use doesn’t need an Internet connection, so I hope I will never have to use any networking in the AppVMs.)
From the docs, I understand there are the options: Windows 7 or Windows 10/11.
I have an old Win 7 SP1 ISO and I don’t have a Win 10/11 license, so I decided to try the Win 7 route. There is something I don’t understand though:
-
QSB-091, section “Impact”, says “Dom0 is not affected” and says nothing about danger for Xen or Qubes itself.
-
the doc about Windows qubes says:
“Due to the security problems described in QSB-091, […] a possible compromise of the Xen drivers used in Qubes Windows Tools might create a risk for Xen or dom0 and thus be dangerous for Qubes itself. This risk may be small or even non-existent, as stated in QSB-091. If you understand this risk and are willing to take it, you can still install the previous version of Qubes Windows Tools for Windows 7, which will work for Windows 7, but not for Windows 10 or 11.”
This sounds contradictory: “Dom0 is not affected” vs “risk for Xen or dom0 and thus be dangerous for Qubes itself” that “may be small or even non-existent”.
I surely don’t want to endanger Qubes itself but with such confusing information it is impossible to “understand this risk” and decide how to proceed.
Can someone who uses Windows qubes clarify that?
The attack surface is pretty similar for any guest OS / PV drivers. Nothing windows-specific in it.