More practical security for Qubes (and more realistic threat model)


i hope this will fast

Here is how this works:

  1. You and others in the community figure out what you want
  2. You implement it and discuss it on the developer mailing list
  3. Once it works as intended you make a pull request and go through and extensive review

Alternatively you (crowd-)fund the budget to hire someone to do it.

Because the existing team has milestones and tasks many years into the future (R4.1 is just the first step in the direction of more isolated hardware).

Bottom-line: if you want something to exist, you need to will it into existence like @unman or @tasket have done frequently. Find others to help. Make it a community thing!


From my perspective qubes is already end game, and i dont need anything again, rather than wondering how defending remote attack was, i just separate my life. Like having 10 laptops (vm) in 1 laptop, and I was using qubes as identity, qubes a is anon, qubes b is my true id, qubes c is fake id and etc.

But it doesn’t mean stopping me from learning kind of attacks, hardening vm, etc. Using qubes mean i can help more people with wider topics, I believe that everyone in here is not need to take responsibility to help users, but for me, it’s kind of challange to improve myself.

I’ve mostly helped users that’s not my problem and not in my knowledge, but that’s all is really improve my skills and my knowledge.

That meme is still true :wink:

it will always true until qubes has about 75 always active developer, i guess

This is true and really sad, such an important buy very limited people are working on it

Since you mentioned logging you might be interested in this:

Sounds like you may be researching log analysis tools soon. If so, please mention any solutions you find to that thread so we can add it to the guide and everyone can benefit from them.

I’ll also be interested to see what you come up with for a Host IDS and several of the other things you propose.

1 Like

where should I look to enable Dom0 prompt me for approval of sudo bash in a qube ? Quick googling didn’t help.

I’m using Qubes again on one of my desktops. So I also interested in helping the project. Gonna apply for testing team. At least 4.1 is in testing mode now. :slight_smile:


Enabling dom0 prompt for root: Passwordless root access in qubes | Qubes OS


The resulting behavior is something like “vmName asked for sudo root, allow? yes No” or default deny and allow only in some VMs that are present in policy file with ‘vmname dom0 allow’ string?
I’ve nothing in allow policy & got ‘denied’ popups in dom0, but not the prompt with ‘yes/no’. I failed in configuration or this is what it expected to be?
@arkenoi ?

the correct configuration is “ask” policy, and the dom0 responder just silently allows everything. a simple hack to avoid making a custom dialog on dom0 side.