Apple does a good job at securing their devices. Macbooks are way ahead in terms of hardware/firmware security compared to other laptops. See [1]. Also MacOS is more secure than Windows or your average Linux desktop distro and the difference has gotten even bigger with MIE, with better use of exploit mitigations and mandatory sandboxing for apps from their store. iPhones are one of the two most secure smartphone devices available to the general public, especially with MIE and lockdown mode. Just look at the huge exploit chains attackers usually need to fully exploit an iPhone, like DarkSword, which needed 6 exploits chained together.
Proprietary software can be as secure as open source software. Let’s say I develop an open source software project, which follows best practices, uses memory-safe languages and sandboxes critical parts etc. Would making it closed source suddenly less secure?
Governments and military in different parts of the world use Apple and Microsoft products. Don’t you think they have audited their products?
The Linux kernel is mainly developed by big tech. I don’t see what this has got to do with socialism.
Nothing is magically secure. The most common misconception I see about Qubes OS is that simply starting to use it will magically make you secure. In my opinion, the major security difference between Qubes OS and Microsoft or Apple, aside from virtualization and compartmentalization, is that Qubes OS gives you total control over your own security, while those big tech companies do not. You have to trust them to keep you secure, and they repeatedly violate that trust in favor of their profits.
The issue is trust. Once you make the software closed-source, we can never be sure whether you (or someone else) have introduced a backdoor afterward. Governments always want user data and routinely demand that companies provide access to it. Big tech companies comply because they prioritize profits and prefer not to antagonize government agencies. This is neither a conspiracy nor a secret, these companies openly acknowledge it.
Closed source can be secure, but the provider of that closed source must at least intend to create something secure and must not be under an obligation to build backdoors into their product. With companies like Microsoft and Apple, neither of these conditions can be assumed:
Our data is what they are interested in, for targeted advertising or worse motives. Making their systems secure would hamper the possibilities to get at that data, so the motivation to build something they cannot crack is small or non-existent.
Looking at US companies and the current US government, this increases the doubts. There are reported cases in which the government forced Microsoft to engage in illegal or at least questionable actions against some customers, such as the International Court of Justice or the Amsterdam Trade Bank, and also Microsoft was convicted of having placed tracking cookies on schoolchildren’s laptops.
Even if systems like Windows are subject to security audits with full disclosure of the source code, there is zero possibility that carefully hidden backdoors can be discovered. The code base is just too large and too badly structured for a complete analysis. Furthermore, such audits have already shown the bad and unmanageable security of the system. For instance, there is the German government-sponsored project SiSyPHuS, which tries to analyze the security of Windows and to provide help for securing this system - and which shows clearly that you need infinite resources to put it into at least a semi-secure state.
Given these conditions, you have to have faith in the Big Tech companies and the political and economic environment in which they are working if you believe that they will provide secure closed source systems. It makes more sense to believe in Santa Claus.
GrapheneOS is a “small” project too (sitting on top of a larger open source one).
Very similar, in many aspects. Different in one.
I use both QubesOS & GrapheneOS, and found NOTHING better, with or without a free donation business model, so far.
I am very thankfull, as, for sure, more and more people being left behind by the ultracapitalist train (or rocket), although they may have lots of competencies and “value”.
Cheers,
PS: if you can, and if you care, please feel free to donate!
Honestly this difference that grapheneos and qubes has against other operating systems is that the former 2 are made for security while every other is made for monetization, tracking and spying, fun(99%, of Linux distros) etc
Not to mention that most programs are made by aloof people with almost no understanding on security and privacy or the reasons the former 2 are important.
QubesOS and GrapheneOS on the other hand are made by people who said “enough is enough”, it has nothing to do with budget, most security heuristics these projects follow have had white papers releases years ago proving that’s the most secure way to build an OS, not to mention all the million other white papers that prove most common OS practices are insecure.
The problem is that the industry PRETENDS to go fast because they DON’T WANT to follow these safe heuristics that the security minded people have been screaming for decades that they should follow.
For me, I have a technological inept family who has had their bank accounts hacked more then 4 times alltogether, a father with early stage Alzheimer’s who downloads more viruses and releases so match personal information on the internet that I don’t dare to speak in a room where he has his phones on because I know for a fact by android debugging and checking my router firewall that they are recording him 24/7
I don’t see any schools, NGOs or any other small group trying to do ANYTHING to educate the younger populous at all either and to be frank I don’t think anyone in power ever cared, to me weak software is just an excuse for “oh we got hacked so now we need a new law or you are going to die of thirst or we luckily found incriminating data on some of y’all because we got hacked so now we will arrest ya etc etc” its all about controlling the populous, either choose security and wait for Gestapo to smash your fingers with a led pipe for the password or obedience and bend over
I find this post FUD or ignorant and these are both equally bad imo
Edit: also there is genodeOS but that’s too small for now
PS: I would love to see xen implemented in genode , they could implement it using one component for the dom0 and one for the domU and you could run multiple dom0s that way to isolate VMS more
No, they create a certification program and use that as an approval badge, just like how Privacy Guides has a list of recommendations based on public reputation and user experience, not source code audits.
Certification is done (almost?) always based on ISO 15408, aka Common Criteria. Here, the extent of trust you can place in an audit depends on the Evaluation Assurance Level (EAL) used, because the EAL defines what must be audited.
For general operating systems like Windows or Linux, the maximum level that can be reached will be EAL 4 or, at best, EAL4+. Higher levels are not attainable for such systems because the audit costs would be astronomical, and the audit would take so long that the audited system would be obsolete long before it could be completed.
EAL4 is defined as “Methodically designed, tested and reviewed” and requires “assurance from positive security engineering based on good commercial development practices which, though rigorous, do not require substantial specialist knowledge, skills, and other resources” (according to Wikipedia). At this level, there is no requirement to analyze the source code, so closed source may remain closed despite the audit!
Furthermore, as far as I could find out, the latest Windows versions to be certified were Windows 7 and Server 2008. Newer versions were not mentioned at all, and MacOS seems never to have been certified. The results of the SiSyPHuS project that I mentioned in my earlier post strongly suggest that an audit and certification of a current Windows version could no longer be paid for at all.
Microsoft’s Government Security Program gives access to source code. And governments very much make use of it. Even non-allies like China got access to the source code.
There is one more aspect that is often overlooked: Systems like Windows, macOS, and Linux are built as monolithic blobs that try to protect sensitive parts using some sort of access control. This works only as long as their internal mechanisms are not compromised. If there is a security-relevant bug somewhere in their privileged part, i.e., the kernel and any privileged device drivers, the security is broken in such a way that it cannot be saved anymore. In this case, a hacker who finds such a hole can take over the system completely, modify and even destroy it.
In Qubes, this is also true for any operating system running in a VM. A hacker who finds a fatal security flaw within such an operating system can take over the VM where it is running. The difference is that this attack is restricted to a single qube and does not affect the rest of Qubes as long as the security of Xen is not compromised. But this would need a second hole, namely in Xen, but that is outside the compromised VM.
The consequences of such a successful attack depend on the type of VM that was broken:
A standalone VM is lost completely if no provision for reverting to an earlier version was made in its configuration. This is a strong argument for using standalones only if using a template/AppVM structure is much too complicated or not feasible at all.
An AppVM is lost, too, but after a restart, any system modifications made by the hacker have disappeared, and the system is clean again. There may, however, remain infected private data that could be harmful if accessed again.
When a dispVM is closed, anything the hacker did inside it will disappear completely. But be aware that any data exported from such a compromised dispVM before its shutdown may be suspect.
If a template is compromised, it will stay so, and any AppVMs and dispVMs derived from it will be compromised in the future. For this reason, it is essential to reduce the possibility of such a compromise as much as possible: Never run any application in a template, never connect it to a network, and never perform updates using a direct external connection. But, alas, the haphazard way in which some software is written may make this difficult or even impossible to do in a strict way. For instance, so far, I have found no way to cause Windows templates to use the update proxy that is used for the rest of the supported templates.
The same applies todom0, even in a much more relevant way, because its compromise would be fatal for the whole Qubes system.
The consequence of all this is that, except for a compromise of a template or evendom0, any use of a security hole in an operating system running under Qubes, the effect of a successful hack is rather restricted and can be remedied easily. On the other hand, hacking these central parts can be made very difficult for the attacker if proper operating procedures are used.
