Is QubesOS really more secure on its shoe-string budget compared to tech giants like Apple, Microsoft?

General Discussion
41

No, I just said

1 Like
42

Ha ha … Ha, no wonder people think you are a robot your sense of humor is as dry as a patch of leaves in Texas summer

2 Likes
43

Never been to Texas, but I trust you somehow. :wink:

1 Like
44

What about forests in Spain, France, Canada … ?

1 Like
45
off-topic

If I were to establish a pattern there, should we expect volcano eruptions on Iceland and melting fjords in Norway next? I am not sure what to expect in Ireland though

1 Like
46

You are starting from a slightly different definition of “monolithic”. In this context, it means a system built using one common information area (programs, address spaces, data) and relying on the protection of one protected part, the so-called trusted computing base (TCB). In a standard system like Linux, this TCB typically consists of the kernel and any device drivers needing direct control of the hardware. Here, we have some problems:

  • The kernel of today’s operating systems is huge, consisting of millions of lines of code, and so is likely to contain a lot of bugs, several of which may be critical.
  • The device drivers needed make this situation even worse because they come from a lot of different sources and often may be of doubtful quality.
  • As this structure is rather fragile, it must be protected from any tampering that may undermine the security of the complete system.
  • But applications running on this system need functions provided by the TCB, like access to background storage or networks. So these applications need to transfer data into the TCB in order to specify the functions to be provided. If some of this data is malicious, it may trigger a malfunction caused by a bug in the TCB. In severe cases, this can cause the application to gain control of critical functions within the TCB, resulting in a complete takeover of the system. This is inevitable as long as there are critical bugs in the TCB, which cannot be excluded given its size and complexity.

This is just what is meant by the idea of a complete breakdown of the security of monolithic systems, which will apply to all of them, no matter who has produced them or whether they are open or closed source.

With a compartmented architecture, especially Qubes OS, the situation is different:

  • The main part of the TCB is the hypervisor. In the case of Qubes, this is Xen, or, more strictly, just a relatively small part of Xen, which is smaller than a typical operating system kernel by several orders of magnitude. So the number of critical bugs is expected to be much smaller, too.
  • In a properly configured Qubes system, there is no need for any device drivers to be included in Xen, because device handling is delegated to service qubes. As these qubes are not privileged, any malfunction cannot compromise Xen and will be restricted to a qube and not the whole system.
  • No applications are running directly in Xen, and this is forced by the fact that Xen does not even support running them, at least in the architecture of Qubes OS. Applications are running in virtual machines and are not able to transfer any data into Xen itself. Any functions that need hardware access or so are performed by a service qube, and the data needed to specify these functions is just passed through Xen to the used service qube, not into Xen. So, Xen never “sees” this external data but just transfers it as an opaque data blob. For this reason, even malicious data cannot compromise Xen because it never acts on it and has no software to do that. Here, we have the one absolutely secure way of protecting something: You cannot compromise software that does not exist! (There’s one exception to this, and that’s dom0 as the only part of the system that can interact with Xen directly, and for this reason it has to be included in the TCB.)

I hope I have made it a bit clearer what the reason is for the superior security of compartmentalized systems. But please be aware that this is a somewhat idealized description. Even Qubes may (and will) have its defects, possibly due to some compromises or programming errors, but the consequences of such faults are very much smaller.

4 Likes
47

:beer_mug: :beer_mug: :beer_mug: :beer_mug:

2 Likes
48

Oh don’t misunderstand me, I edited my first comment because I understood I came off as attacking or dismantling your first statement, I apologize for the confusion there since what I really meant to do was to add a parallel to your “monolithic” statement that is often forgotten.

I think I was talking with some people when I made my initial statement and probably confused myself a bit lol

2 Likes
49

Do I need an elevator to “travel” our collectively stacked dry humor or will a ladder suffice?

I swear this thread is turning into a deli :winking_face_with_tongue:

1 Like