Is QubesOS really more secure on its shoe-string budget compared to tech giants like Apple, Microsoft?

General Discussion
1

Firstly I’d like state that I love QubesOS and have utmost respect for the team, but there are times where I have my doubts.

This is one of those times.

I have seen numerous bugs with Qubes, far more than I’ve experienced on any other linux distro, and it just gives me pause as to the security guarantees of the OS.

If there is a bug in the GUI window manager, whynot in the virtualisation that is the primary defense against attacks and indeed the main selling point of Qubes?

Given all the new vulnerabilities being discovered by the latest AI models, how can we be sure we are safe when the resources of the Qubes dev team is so much smaller compared to the behemoth budget of the tech giants like Apple and Microsoft?

I think what the team has done is amazing given their budget, but there is only so far you can go when you don’t have billions of dollars.

It begs the question - is QubesOS really more secure than MacOS or Windows?

3 Likes
2

Yes.

8 Likes
3

Yes.

If there is a bug in the GUI window manager, whynot in the virtualisation that is the primary defense against attacks and indeed the main selling point of Qubes?

XEN is not only used by Qubes but also many VERY large companies like cloud providers. If there is a bug in XEN, Qubes is the smallest problem - or better said other large companies have a VERY deep interest in XEN being secure, not only Qubes.

Given all the new vulnerabilities being discovered by the latest AI models, how can we be sure we are safe when the resources of the Qubes dev team is so much smaller compared to the behemoth budget of the tech giants like Apple and Microsoft?

There are a few very reasonable donations to Qubes, so its not that they don’t have a budget. AI audits are cheap, and I’m sure Qubes team is doing those as well. Qubes is FOSS while microsoft and osx is not, so everybody can audit the software, not just hackers that buy the source on the black market to find 0days to exploit in it.

Besides this Qubes is build with security being more important than usability (hence its rather technically versed userbase). Qubes has a completely different target audience (paranoid ppl) compared to OSX and Windows (they want to sell).

So long story short: Yes :wink:

5 Likes
4

Qubes OS doesn’t have an enormous budget… but brilliant minds. Your issues have been considered since the beginning of the project: Qubes OS Architecture v0.3 (PDF ~2Mo) It is from 2010 but still a good read. For something more recent:

5 Likes
5

Do not forget that Polish girl embarrassed the Giant back then.

But even simple logic / common sense would prove why Qubes is less insecure: immensely smaller attack surface, not considering anything deeper than that.

3 Likes
6

How did she embarrass them?

1 Like
7

Sounds like an apples and bananas comparison.

Do Apple or Microsoft have anything even a little bit comparable to Qubes-type isolation and compartmentalisation?

I thought they were things you might run inside a qube, if you really needed them.

For more information, can you give us an idea of what bugs you saw in Qubes-OS that give these thoughts?

Did any of them have any bearing on the inter-qube isolation that underlies the Qubes security model?

The latest 3 Xen CVEs did, but I think that we would have heard if people were getting contents of their Vault qubes exfiltrated or their offline secure qubes ransomwared (I hope!)

3 Likes
8

Threat actors which are sophisticated enough to have access to Qubes VM escapes probably are more interested in spying on users as undetected as possible.

2 Likes
9

Yes, they do - or at least some M$ machines do.
You should read about the work done by Ian Pratt,(chief architect
of Xen and founder of XenSource ),and on Bromium, which provided
micro-virtualization. That project is now rolled in to HP, and available
on many machines.
There are Virtualization offerings built in to Apple, but they are
Level2.

There are other security focussed OS which use compartmentalisation, but
they are not commercially available to the public. Some use familiar
methods - window coloring, inter window copy/paste etc.

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.

4 Likes
10

A system that is at least partially very similar to Qubes OS - based on Xen, allowing Windows and Linux guests and showing them on the same desktop, using differently colored windows - is AIS SecureView, which was originally developed by the American Air Force. I have no idea if it is available outside a restricted circle.

3 Likes
11

As their code isn’t open source, I want to say that they may promise that they have, but we can’t properly verify that.

3 Likes
12

Looking at the software quality produced by large teams, I have serious doubts if bigger means better. If M$ publishes an OS simulator with more than 600 security-relevant bugs in 1 year, that indicates lousy software quality. On the other hand, there are lots of software products, especially in the FOSS area, that are produced by small teams and are excellent with respect to functionality and security.

With respect to the security of Qubes, we must distinguish between “normal” bugs affecting only functionality, on the one hand, and security-relevant bugs that undermine compartmentalization, on the other. The effects of normal bugs, even indom0, are restricted to some VM, while security-relevant bugs allow the breakout out of this VM. Due to the Xen architecture, any bug in a VM, except for `dom0, will not allow such a breakout. (This is even confirmed by AI - I checked with ChatGPT.)

To escape from a VM, you will need a security hole in Xen itself, and Xen is supported very carefully and outside of Qubes, because any compromise of its security will endanger some of the largest clouds. It is not impossible that 0days might exist in Xen, but they are surely not available on the common black market, because they have an immense value for an attacker.

So, Qubes is secure against attacks of “normal” hackers as long as dom0 is not compromised, and all available fixes are installed for Xen.

The situation is different, however, if we talk about attackers with unlimited resources, possibly state-sponsored, who are able to subvert Xen. But then you have to ask yourself if you are important enough to get into their focus, which will not apply to most users, because these super-hackers will not attack unimportant targets, since that would reveal their own secrets.

But if you have to protect yourself from such attacks, you should not rely on any available software - including software that you yourself have created. Stay completely offline, without any network connection, and maybe even consider emigrating to a more secure location. You might consider the Heard and McDonald islands - their inhabitants are Linux-friendly and known never to have hacked IT systems. :grin:

King_Penguins_on_Heard_Island
King_Penguins_on_Heard_Island250×167 11.5 KB

5 Likes
13

This. “Only amateurs attack machines; professionals target people.” (Bruce Schneier)

Edith adds the source. Still worth a read:

3 Likes
14

Consider:

  • Qubes is not a Linux distro
  • The number of bugs per se is not a measure for the security of a system

Given all the new vulnerabilities being discovered by the latest AI models, how can we be sure we are safe when the resources of the Qubes dev team is so much smaller compared to the behemoth budget of the tech giants like Apple and Microsoft?

How can we be sure that the food we buy from the store is safe to eat and not result in e.g. cancer within next 5 years? Which food has higher probability of safety: one produced by behemoths that care only about profit or by e.g. a small local farm that does not use pesticides and GMO?

It begs the question - is QubesOS really more secure than MacOS or Windows?

Secure against what? (AKA “define the threat model”)

7 Likes
15

Hi, I’m not very knowledgeable about technology, but as I understand it, the “compartmentalization” part of Qubes OS is what makes it Qubes OS. This is a small code base. It’s deliberately kept small for better security (less code = less bugs) and ease of maintenance (less people needed), and because it’s not necessary to be big to perform its job.

This Qubes code base acts like a bridge between Linux, Xen and hardware (TPM, Intel-V), which are pre-existing, bulky softwares with large teams behind them, which perform the bulk of the work and code. The purpose of Qubes OS is to “compartmentalize” all the work these huge softwares do and for that task it’s not necessary to have a big codebase.

It’s not really a unique OS, but rather a unique Linux distro with compartmentalization.

3 Likes
16

Yes: Frequently asked questions (FAQ) — Qubes OS Documentation

Qubes is technically not a Linux distro: Frequently asked questions (FAQ) — Qubes OS Documentation

2 Likes
17

I think I may have come across that - it was in my mind as I wrote my bold semi-rhetorical question.

I think it was a bit more limited in terms of compartmentalisation, and a source of such pain for the application I was supporting, due to network device virtualisation, that I had to ask my user to switch the HP for another PC…

…so not at all unlike a regular Qubes experience :slight_smile:

I shall look into it, now I know where it came from (and now the memory of a day of fighting it has faded.)

Edit: Of course, after thinking about it, I suspect that the need to fight is maybe an indication that it was doing its job… another similarity with Qubes!

1 Like
18

:smiley: nothing to add here

4 Likes
19

The most pragmatic answer of them all

Edit: socialism has never works as a standalone, it always works in antithesis to other centralized power systems, but when it works then systems like Linux are born, all we have to do is be vigilant of the security and protect against people building in backdoors like age and ID checks being build-in

1 Like
20

Apple and Microsoft OS are fundamentally insecure by design:

  1. They are closed source, so they cannot be independently audited. There is no way to know what their code is doing, so they cannot be trusted a priori. I am not saying here that open source is necessarily secure, but that closed source cannot be secure.
  2. A direct consequence is that you have very poor control on your machine. You relies on the pre-installed OS, and cannot fiddle with it. The only security model is a security by trust: you need blind faith in what they are doing to your machine.
  3. Microsoft/Apple OS heavily relies on customer accounts you have to sign for. It is extremely difficult to be sure that your data or information remains private to you. Many security problems that are reported for these OSes stems for design choice rather than bugs, namely related to data collection.
  4. All these points are indeed not solely relevant to QubeOS, to any open source OS. By design, If you want a secure OS, you have no other choice that using open source OSes, that do not rely on corporate accounts and full data control.

Among these OSes, QubeOS is one that is specifically focusing on security. You can discuss the level of security of course, but you should not forget that because it is based on Open Source code, you should not only see the security layer as the one deployed by QubeOS developers. It is sitting on top of a huge assemblage of code developed by an extremely large community of developers. You do not have to consider the sole budget of QubeOS, bu the one of the full linux, Xen, etc. community.

5 Likes