I don’t know if the average person really has an advantage. Thanks to AI, we now have new attack vectors like prompt injection, etc.
1 Like
Do you mean: adrelanos
1 Like
the whole “is it a honeypot?” question is ridiculous because, as you note, you only need one or a few plants within an organization to compromise it.
take any significant software org, whether open source or corporate, and even a single dev can plant bugs with plausible deniability. you can rest assured that pretty much every notable org has one or more intel plants in it.
if qubes does have one or more such plants in it, does it mean it’s a honeypot? i would argue no, and i would be unsurprised if it didn’t have said plants, personally. good luck finding any os project that is worth using that hasn’t been similarly targeted.
3 Likes
1 malicious developer gives a low chance to compromise the system. But the detection chance is very high if the devops is good.
When important packages get updated, other developers need to sign off on it after reviewing the change with a diff tool.
They can quickly check if it’s an expected standard update or if it’s an update that needs a closer review.
If it needs a closer review, they can also ask AI to check if this change could cause any vulnerabilities. A developer will know more precise questions to ask the AI, relevant to the project.
Every update gets logged with all the meta data because the signing keys are on a server with monitoring and strict restrictions in what they can do when connected to the server.
Anything that is logged as suspicious gets flagged and many eyes will review it and have to sign off on it.
Not even the devops engineers can bypass the restrictions of the signing keys server because it’s all in a container technology (being intentionally vague), and the code for the container/restrictions are on a website like github where every change is logged and reviewed.
And if the developers of the OS is decentralizd, in many different countries, not part of each other social networks, that makes it even less likely there’s any secret collusion/conspiracy happening. Anything critical always needs several people to sign off on it.
These examples I gave are far from complete of a proper devops system but it just meant to give you the idea that a proper devops decentralized system is extremely secure. And if you want to see someting like this in practice, you can look at Arch OS. I think their devops is probably the most secure of any other OS.
Yes. I was going from my memory immediately after reading the post. And Arellanos is a popular mexican name.
2 Likes
While when Qubes is I always had an urge to see new security features (and convenience ones too, I am guilty) introduced, I always suppressed that urge with the fact that there are only a few devs, which means better decisions (as in project management) and better overall control of the processes and outcomes.
Also, having few developers means focusing on security goals prior to anything else, which is again proven with Qubes.
So, when I see new version of Qubes, I know its security got significantly improved, and not only new fancy icons and wallpapers. When I see a new version of Qubes, its not about patching old holes and introducing new ones.
When I see new version of Qubes, it’s not about consumerism as discussed in other topics.
When I don’t trust Qubes on a said reasoning, I better drop digital life…
1 Like
I never did a count -just a quick look-see, but for Qubes there is a good chunk of the code that is turned off, and quite a lot of the Xen tooling that is never used.
It is worth comparing the number of Xen-related Qubes security announcements with the number of ones for Xen itself. Qubes just sidesteps almost all of them.
Thank you, Qubes Team.
3 Likes
Everything in the modern world is a honeypot. The question is, how much of a honeypot is it?
1 Like
It is up to you if you value the comparison, and I am not part of the Qubes OS team.
You are right to point it out - I will correct myself:
Thank you to Qubes Team AND Thank you to all those others who volunteer their time to making Qubes and its community better.
As to simple metrics of complex systems...
IMO: Lines of code, CVE count, and so on, are of limited, probably zero value, for almost anything. It is exactly zero for answering the fundamental question of this thread/topic. Maybe that was my point above…
OTOH, SLOC in lower levels of Xen/Qubes does give me an idea about where the meat is, and whether a quick look in vi might be worthwhile when I have a question about the workings. Not that having a phceac poke around in the code could ever bring anything useful to the discussion.
4 Likes
I was banned by Israel from using digital services, after login into it using disposable qubes during few months. “Suspicious device, please use windows pc or your mobile”.
Even if QubesOS is a state sponsored honeypot, it doesn’t belongs to USA and Israel for sure 
2 Likes
What service was this? 
1 Like
taasuka.gov.il and ps.btl.gov.il, both known on physical world as operators of private investigations teams and persecution of citizens.
So, I can testify that i’m subject for fingerprinting and persecution on digital environment by them. While they don’t have any rights as law enforcement authority for persecution of citizens.
2 Likes
Did a windows qube work? xD
2 Likes
I don’t use windows on qubes, it should run as HVM with higher attack surface compare to pvh.
1 Like
Is this real? I never heard of such a thing. seriously.
1 Like
If gov.il doesn’t like Qubes-OS, then I would consider it a good sign… although it could be a feint!
4 Likes
While the topic itself is highly important, I’m very concerned about selective moderation and the health of the forum in general.
A user to claim civilian job sites are spy tools and that he is being drugged by a foreign government(and so on), validates dangerous paranoid and antisemitic adjacent narratives while suppressing valid security skepticism.
Discussions about Intel ME(just as an example) are immediately locked or hidden, while users as above are permitted to spread dangerous, evidence-free FUD targeting a specific nation.
1 Like
@owasperrin bit overkill, imho.
I respect your freedom of speech to say that you think what he wrote is bollocks, but I think he should have the freedom of speech to say what he said above.
Also “I think this israelian website does h4x0r things” isn’t antisemetic. I want to add that if he would have said something that is against jewish religion, or jewish cultrure, I’d be on your side and say something too. But I don’t see that anywhere (not in the slightest) in his post.
PS: I’m curious, is “drugged” a hacking term I’m not familiar with or does drugged mean involuntarily given narcotics in this case?
3 Likes
You’re very new to the forum and Qubes(technically speaking), and you’re clearly out of your knowledge scope. If you don’t understand the topic - don’t claim.
You have good intentions and it’s valuable, keep it that way.
These are not some websites, these are official government websites for civilian purposes only. Also, these claims are systemic. This is not the first time the user has done this.
You’re wrong, but this is not a place for political or racial discussions.
Exactly.
Even people who often visit the forum not necessarily will remember each and every user and his actions across the forum or big topics like this one.
It’s also not realistically possible to search the forum each and every time for every message(we clearly see this on your exact example).
As a result of this, moderating and cleaning messages that are off-topic(even for broad topics like this one) is the key to keep the forum healthy.
1 Like
We should start from ourselves giving examples, because this could be read as a clear and present threat, while at the same time the other user at worst could wisely be smearing by hiding his motives, wrapping them with a tie to Qubes, thus having formal excuse it’s not off-topic.
We don’t know each other’s motives, so we should abstain from judging and involving ourselves knowing this, even when 1o1, not to mention involving in a third party matters.
1 Like