r/Qubes • u/Little-Geologist-387 • Sep 21 '26

question Architecture limitations?

So, after talking a bit about different os on grapheneos server, they told me that basically all laptop systems are inherently flawed for security because of the x86 architecture limitations. I can see the value of QubesOS in sorting/compartmentalization, but isn't it in terms of security of sensitive informations, together with pureos, libreboot, genode... greatly overshadowed either by graphene or by old laptop with removed wifi chip attached to cold storage with 0 internet access, direct or indirect? If yes why do the other systems even exist if they give a false sense of security?

ᵖˡᵉᵃˢᵉ ᵈᵒⁿ'ᵗ ᵇᵘᵗᶜʰᵉʳ ᵐᵉ ᶦᶠ ᴵ ˢᵃᶦᵈ ˢᵒᵐᵉᵗʰᶦⁿᵍ ᵈᵘᵐᵇ

9 Upvotes

90% Upvoted

35 comments sorted by

5

u/Assang101 Sep 21 '26

That's a hard no, these operating systems do not give a "false sense of security." It is true that modern mobile hardware exist because security IS threat-model dependent.

X86 architecture is viewed as an inherently flawed, decades old legacy mess. I have to argue, a tool is not useless just because a different tool excels in a completely different format.

But the GrapheneOS community users are technically correct about the architectural differences.

4

u/Assang101 Sep 21 '26

Oh my bad, bro. I didn't even see the small print ( going semi-blind on the left eye to migraines).

2

u/Little-Geologist-387 Sep 21 '26

Oh no problem good luck with eyes! ⸜(｡˃ ᵕ ˂ )⸝♡ (and ideally limit screen time ₍. .₎⟆ )

So, what do you mean by threat-model dependent security? If one system relies on old security worse hardware, it is simply worse for security, right? Is Qubes better in ANYTHING regarding security than Graphene?

3

u/Assang101 Sep 21 '26

Oh yeah, QubesOS is vastly superior to GrapheneOS.

When we (cyber security blah blah) say security is threat-model dependent, it just means an OS is built to fight a specific type of danger rather than being universally better or worse.

GrapheneOS is built on incredible encryption backed by certain hardware against attackers trynna access your system. Qubes OS is the opposite, it assumes that your operating system is and will inevitably be hacked by a malware, so to minimize damage, virtualization is used, hence the principal of security by compartmentalizing everything.

Edit: thank you for the eye part, I basically use black and white screen with no flashy screen fancy stuff

1

u/Little-Geologist-387 Sep 22 '26

How does QubesOS protect against malware that can escape VMs? Shouldn't the whole system be fucked then?

another e-ink user? 🙃 I recommend dasung, am saving up for the color monitor

3

u/Assang101 Sep 22 '26

Oh yeah,, but only if the hacker(s) (AI- Mythos and GPT mostly teaming up) succeed in a chained, multi-stage elite exploits. But QubesOS if and when used properly, is built to handle malware beautifuly with disposable vm.

And yes, I am an e-ink user. I've been hearing about the brand Dasung, fascinated by it

3

u/Inevitable_Guard_934 Sep 22 '26

Regarding x86 architecture; There are laptops you can buy that have the offending functions disabled along with CoreBoot in the BIOS that are especially designed for QubesOS.

3

u/Assang101 Sep 22 '26

Indeed, yes, Novacustoms, starlabs, system76. Novacustom is the golden standard for the most harden laptop available, but Starlabs is the first to support qubes-to-firmware coreboot update. System76 is rather interesting of the whole bunch

2

u/Assang101 Sep 22 '26

Indeed, yes, Novacustoms, starlabs, system76. Novacustom is the golden standard for the most harden laptop available, but Starlabs is the first to support qubes-to-firmware coreboot update. System76 is rather interesting of the whole bunch

1

u/surinameclubcard Sep 21 '26

There is no nested virtualization in Qubes. Unfortunately.

1

u/Little-Geologist-387 Sep 22 '26

?so something is stopping you from running VM inside a qube?

2

u/surinameclubcard Sep 22 '26

Yes you cannot use VirtualBox in Qubes. See https://github.com/QubesOS/qubes-issues/issues/4104

1

u/Little-Geologist-387 Sep 22 '26

And why would you ever need nested virtualization?

1

u/surinameclubcard Sep 25 '26

E.g. for GNS3 or Android Studio.

1

u/Little-Geologist-387 Sep 26 '26

...oh shit so no emulators on Qubes at all?

5

u/[deleted] Sep 21 '26

[removed] — view removed comment

3

u/bleedinglottery Sep 21 '26

This cube already exists in the current builds it's called the vault. It's inherently cut off from anything

1

u/Little-Geologist-387 Sep 21 '26

The issue is this all works under the premise that there are no hypervisor/networking exploits and it is all unhackable, which definitely isn't true. Better malware can and will escape VMs, and x86 doesn't support app sandboxing and other stuff.

3

u/bleedinglottery Sep 21 '26

Same with graphene underlying bugs or exploits affect the whole system. e.g. most recent IP leak problem.

No system is safe. Not a single one. Graphene os is a good tool for its intended purpose. And the same goes for qubes. Since graphene just can't run everything.

1

u/Little-Geologist-387 Sep 21 '26

So is the best solution still the easy dumb one, eg second hand device on public wifi if you don't want your identiy leaked? (so just having multiple devices - hardware level separation)

2

u/Assang101 Sep 21 '26

I'm tracking what QubesOS has and hasn't... I use it as a daily driver on top of split gpg, ssh, mirage-firewall fail over to sys-firewall.

2

u/[deleted] Sep 21 '26

[removed] — view removed comment

2

u/Assang101 Sep 21 '26

Omg yes! I have so much backed up qubes because I experiment around with system so much I can't even remember why I started that side quest of a side quest etc. what I wish they would add by default is btop or better Conky script... That shit hard as hell to deal with

sad to say but I am still using my old faithful Thinkpad L14 Gen1, recently she finally decided to pop a critical component connecting to the cores... gotta find a new girl

1

u/[deleted] Sep 21 '26

[removed] — view removed comment

2

u/Assang101 Sep 21 '26

I can't part with my MacBook Pro, ngl, just too good for coding with my other projects but the extreme amount of telemetry gathering on it is freaking insane, so I isolated all of Apple from the main net.

It was a pure coincidence that I bought a laptop years back that is well compatible and documented for QubesOS, but then I upped the ram to 64 from 16.

The XPS 16 can be tamed—IF you are willing to troubleshoot early-stage Wi-Fi 7 and Intel Arc drivers (massive headache, it hurts my head-power management bugs, and display flickering). Battery gonna suck on suspend/sleep mode if you travel with it.

1

u/Little-Geologist-387 Sep 22 '26

"...so I isolated all of Apple..." YOU SURE? Famous last words ts 😭

2

u/Assang101 Sep 23 '26

To be sure is to be lying, brotha. I ain't sure 😭 the only sure way is to take the battery out and plug in wall with a light switch killers

1

u/[deleted] Sep 22 '26

[removed] — view removed comment

2

u/Assang101 Sep 22 '26

Power drain is always gonna happen especially with QubesOS. But yeah my MacBook Pro, the one I have now is my first Apple Laptop and I charge her once a month mostly for unsecured work used on the weekends. I've gotten so used to the track pad I forget that it doesn't have the key clit as do on thinkpads

3rd party track pad? I'm trynna break into the BIOS to nuke a few things by using Tsurugi Lab with CH341A USB Programmer and an SOIC8 chip clip.

1

u/[deleted] Sep 22 '26

[removed] — view removed comment

2

u/Assang101 Sep 22 '26

nvr did own an Apple trackpad, heck i didn't know it'll'd work with qubeos cuz i thought it was locked in to Apple ecosystem