Route internet traffic through multiple firewall appvms - does it make sense?

[fsflover]

@Singer

What can be done usefully beyond these simple measures?

Hardening Qubes OS?

I was wondering whether anyone has any tips on how to further ‘harden’ Qubes OS. I am currently running all my sys-* as disposable vm’s. These sys* vm’s are all based on fedora-33-minimal. I also use 1 appvm/standalone per program. Any further tips would be appreciated!

Questions about 0days and OS hardening

From what I understand, Qubes entirely relies on the hypervisor for security. My issue is that it leaves me with a single point of failure. AFAIK Qubes doesn’t automatically harden the Linux distributions it uses by default (Fedora, Debian, Whonix) so I’m thinking of hardening it myself. But this leaves me with a few questions. Are there any tips/tools I can use to prevent or mitigate the effects of a Xen 0day? Should I try to harden dom0? Even if it means installing additional software to…

[qubes-users] Hardening Guide for Paranoid Noobs?

I was reminded about qubes hardening that Chris L has been working on and also noticed that Patrick/Whonix is now basing whonix on thier kicksecure distro and was trying (not so successfully) to absorb all of this. I got the impression that Chris's work wouldnt jive so well with kicksecure (fair enough, can just use it on non-whoinx setups) but wasnt sure. Also there is the idea of DVM sys-* (net/usb/firewall/etc) vms sounded like they would add an extra layer of security, maybe based on centos …