Questions about 0days and OS hardening

[deeplow]

See this (read-only) thread from the mailing list:

[qubes-users] Hardening Guide for Paranoid Noobs?

Stumpy: I was reminded about qubes hardening that Chris L has been working on and also noticed that Patrick/Whonix is now basing whonix on thier kicksecure distro and was trying (not so successfully) to absorb all of this. I got the impression that Chris's work wouldnt jive so well with kicksecure (fair enough, can just use it on non-whoinx setups) but wasnt sure. Also there is the idea of DVM sys-* (net/usb/firewall/etc) vms sounded like they would add an extra layer of security, maybe…

And this:

GitHub - tasket/Qubes-VM-hardening: Fend off malware at Qubes VM startup

Also, you may also find this thread interesting:

Isolation within the same domain

QubesOS isolates almost everything and does very good job in that. but “Qubes, however, does not attempt to provide any security isolation for applications running within the same domain. For example, a buggy web browser running in a Qubes domain could still be compromised just as easily as on a regular Linux distribution. [which, out of the box, almost has no sandboxing at all]. The difference that Qubes makes is that now the attacker doesn’t have access to all the software running in the other…