November 21st, 2024

Why one would use Qubes OS? (2023)

Qubes OS is a security-focused operating system that uses virtualization for application compartmentalization, ideal for users needing data separation, but has high resource demands and a steep learning curve.

Read original articleLink Icon
Why one would use Qubes OS? (2023)

Qubes OS is a security-focused operating system that utilizes virtualization to compartmentalize applications and tasks, enhancing privacy and security. It operates on a minimal XFCE interface within a domain called dom0, from which users can launch virtual machines (qubes) that run various applications. Each qube can be configured to use different templates, such as Debian or Fedora, and can be set to discard changes upon reboot, ensuring a clean state. The system includes specialized qubes for network management (sys-net and sys-firewall) and USB device handling (sys-usb), allowing for secure and controlled access to external devices. While Qubes OS offers significant advantages in security, such as efficient VM management, disposable VMs, and integration with Tor, it also has drawbacks, including limited hardware support, high resource requirements, and a steep learning curve. It is particularly beneficial for users who need to run untrusted software or maintain strict separation between different tasks and data. However, it is not suitable for multimedia tasks or gaming due to the lack of GPU acceleration. Overall, Qubes OS is designed for users who prioritize security and are willing to invest time in learning its complexities.

- Qubes OS enhances security through virtualization and compartmentalization.

- It is ideal for users needing to run untrusted software or maintain data separation.

- The system has a steep learning curve and requires powerful hardware.

- It is not suitable for multimedia tasks or gaming due to limited GPU support.

- Qubes OS offers unique tools for managing security and privacy effectively.

Link Icon 6 comments
By @midenginedcoupe - 3 months
I've been using it as my daily dev machine for ~5 years now.

As per the article, the usability tradeoffs are considerable. But the separation of domains into separate VMs is really lovely. If nothing else, having a separate VM per client just feels "right". No intermingling of code and, even more importantly, secrets or credentials or even comms. Being able to use the same physical machine for personal stuff as well as work is also a bonus.

By @freeqaz - 3 months
One of the killer features of Qubes when I used it was the ability to "pause" a VM and all of the apps running in it. That's something I've tried to replicate with tools like tmuxp but I've never found an abstraction as clean as "serialize the whole process tree to disk" like Qubes has.

I gave up on it for usability reasons, but that feature is killer. Anybody else aware of anything similar?

By @fsflover - 3 months
By @nunez - 3 months
This is the same concept as CoreOS, which now lives on as Flatcar, though with harder isolation guarantees because VMs.

I love the idea. Extremely minimal attack surface.

At the moment, I'm working on building a virtual version of the NUC that I purchased that will also run Flatcar so that I can test the configuration of my Docker Compose services.

By @atmanactive - 3 months
I hope Qubes OS developed a solution for GPU passthrough by now, as, reading the article, that's the only thing that's missing, back in 2023. Similar to how sys-net and sys-usb work, we need sys-pci and ... done.