Martin @martinmuc

**chappedafloat** @chappedafloat@lemmy.wtf · 17. Dez. 2024

lemmy.wtfMy take on Linux vs QubesOS regarding privacy and security - Lemmy.wtfEveryone who wants privacy also needs to pick the most optimal OS for privacy and we all know that isn’t Windows. It’s going to be either Linux or QubesOS. #Part 1: QubesOS is known as the most secure OS. It is a reputation earned because compartmentalizing different identities (helps with privacy too) and software into different VMs/qubes is better than hardening via SELinux or Apparmor or other similar solutions and sandboxing technologies. But Linux is also capable of doing that with VM technologies like Virtual Box or Qemu/KVM. But QubesOS wins because Xen is better at it because it’s faster because it’s type 1 but vbox or qemu/kvm is type 2 hypervisor. But speed isn’t really about security or privacy. And maybe we find the speed on type 2 hypervisors to be good enough. Then we are almost at a stalemate now comparing Linux vs QubesOS, although QubesOS is leading so far. #Part 2: QubesOS can be built from source code but none of the linux distros can. But it doesn’t really matter because it’s so incredibly secure to download the built image when you have canary, hash, gpg signing. And even if you don’t think that’s enough and decide to build QubesOS from source anyway, you would still need to trust hash, signing, canary is enough when doing updates and upgrades. This puts Linux and QubesOS at a stalemate again. Also, you don’t even keep data on “qubesos” aka dom0. All data is kept on the qubes (VMs) which run Linux. So even if you use QubesOS you have to for the most part trust Linux with your data. #Part 3: Firmware updates. linux kernel gets updates through linux-firmware package. I don’t know how qubesos does it and I don’t know if QubesOS has better firmware protection. QubesOS has for example completely disabled hyperthreading which greatly slows down the computer but it removes many of the spectre and meltdown threats. Does linux protect against those threats without disabling hyperthreading? I don’t know. I also haven’t looked into if it’s easy to disable hyperthreading yourself if you have linux instead of QubesOS. But if you can then I think we are at a stalemate again. It’s also possible that the reason Linux doesn’t disable hyperthreading but QubesOS does is because QubesOS is often run on old bricks that don’t get micro-code updates anymore. Maybe the more modern computers that Linux users use have got the microcode updates that stop the threat which QubesOS disables hyperthreading for. I don’t know, this is just a theory really that needs to be researched further. #Part 4: QubesOS says clearly it doesn’t use the GPU in any qube. It’s only used for dom0. The reason given is an attacker could use the GPU to see everything it renders, which means seeing all the qubes (VMs), that’s why QubesOS doesn’t use the GPU outside the dom0. But when you use qemu/kvm in Linux, your GPU is by default not passed through, so it’s really the same situation on Linux because it’s only used on the host. But QubesOS does have a big non-privacy non-security advantage here which is it instead uses some kind of technology where they use the CPU to “render” the qubes. I can’t remember the details but summary is that it makes QubesOS faster than Linux when it comes to using VMs. #Part 5 USB safety is important. USB has by default configured a usb port to be only used by a special usb qube. This way you can safely plug in untrustworthy USB drives because if something goes wrong, it will only affect the usb qube. You can do something similar, maybe exactly the same on Linux. I just don’t know yet if it’s exactly the same. I read something about that the usb drive first goes through the host and then passed onward to the guest VM. So maybe linux and qubes are equal on this part as well or maybe qubesos is superior on this, i’m not sure yet. There is also usbguard you can use on linux and it’s probably enough but it comes back to hardening a host system vs compartmentalizing with VMs/Qubes, so usbguard is not as secure from that perspective. #Part 6 In summary when it comes to privacy and security, Linux and QubesOS are probably equal to each other. But QubesOS does have a much smoother and streamlined system for this type of qubes/vm management with compartmentalizing and it has some speed advantages as well. So, I don’t think there is any reason to use Linux instead of QubesOS unless your computer doesn’t support QubesOS.

Frühere Suchanfragen

Suchoptionen

Verwaltet von:

Serverstatistik:

Frühere Suchanfragen

Suchoptionen

Verwaltet von:

Serverstatistik:

Zurück