Qubes OS📢. Страница 4
904
@QubesOS
Get updates about QubeOS as soon as the announcements are released from the developers.
-
Qubes OS📢
If you are unable to chat, you will have to update Telegram. Old Telegram clients can only reply to messages, they can not send messages without replying. -
Qubes OS📢
The QubesOS chat will be unlinked from this channel within a few mins. That means you won't be able to make comments anymore until Telegram adds the feature to link to topic groups. The group is getting converted into a topics group meaning there will be multiple chats in the group (check out @TheForum) If you haven't yet joined the group, I recommend doing so now. You'll be able to participate in many different topics about QubesOS that peeks your interest. This is a community where everyone helps everyone. New topic ideas are always welcomed. Here's the group link. Conversation will happen soon! http://t.me/joinchat/B8FHpkEToMfgdREGV7wzRQ QubesOS Chat (Unofficial Support) @QubesOS >No spam/ads/NSFW/shit posts/spam bots >Keep media like/stickers to a minimum. >Respect others >Use common sense >Stay close to on topic If you need help ask! Rules are enforced with ban or restrictions. thinfi.com/5byw
-
Qubes OS📢
Charles Hoskinson - Cardano founder $ADA (ex co-founder of $ETH & $ETC) mentions QubesOS! 💪 https://m.youtube.com/watch?v=oH5AZ5f43Qo -
Реклама
-
Qubes OS📢
QSB-085: Xenstore: Guests can crash xenstored (XSA-414) www.qubes-os.org/news/20…/qsb-085 We have just published Qubes Security Bulletin (QSB) 085: Xenstore: Guests can crash xenstored (XSA-414) (github.com/QubesOS…2022.txt). The text of this QSB is reproduced below. This QSB and its accompanying signatures will always be available in the Qubes Security Pack (qubes-secpack) (https://www.qubes-os.org/security/pack/). More information about QSBs, including a complete historical list, is available here (https://www.qubes-os.org/security/qsb/). ---===[ Qubes Security Bulletin 085 ]===--- 2022-11-01 Xenstore: Guests can crash xenstored (XSA-414) User action required --------------------- Users must install the following specific packages in order to address the issues discussed in this bulletin: For Qubes 4.1, in dom0: - Xen packages, version 4.14.5-12 These packages will migrate from the security-testing repository to the current (stable) repository over the next two weeks after being tested by the community. [1] Once available, the packages are to be installed via the Qubes Update tool or its command-line equivalents. [2] Dom0 must be restarted afterward in order for the updates to take effect. If you use Anti Evil Maid, you will need to reseal your secret passphrase to new PCR values, as PCR18+19 will change due to the new Xen binaries. Summary -------- On 2022-11-01, the Xen Project published XSA-414, "Xenstore: Guests can crash xenstored" [3]: | Due to a bug in the fix of XSA-115 a malicious guest can cause | xenstored to use a wrong pointer during node creation in an error | path, resulting in a crash of xenstored or a memory corruption in | xenstored causing further damage. | | Entering the error path can be controlled by the guest e.g. by | exceeding the quota value of maximum nodes per domain. Impact ------- The Xen Project's impact description also applies to Qubes OS: | A malicious guest can cause xenstored to crash, resulting in the | inability to create new guests or to change the configuration of | running guests. | | Memory corruption in xenstored or privilege escalation of a guest | can't be ruled out. (Note: In Qubes terminology, a Xen guest is referred to as a "qube.") Credits -------- See the original Xen Security Advisory. References ----------- [1] https://www.qubes-os.org/doc/testing/ [2] https://www.qubes-os.org/doc/how-to-update/ [3] https://xenbits.xen.org/xsa/advisory-414.html -- The Qubes Security Team https://www.qubes-os.org/security/ -
Qubes OS📢
XSAs released on 2022-11-01 www.qubes-os.org/news/20…22-11-01 The Xen Project has released one or more Xen Security Advisories (XSAs). The security of Qubes OS is affected. Therefore, user action is required. XSAs that DO affect the security of Qubes OS The following XSAs do affect the security of Qubes OS: XSA-414 Please see QSB-085 (www.qubes-os.org/news/20…/qsb-085) for further details. XSAs that DO NOT affect the security of Qubes OS The following XSAs do not affect the security of Qubes OS, and no user action is necessary: XSA-326 (denial-of-service only) XSA-412 (affects only version 4.16) XSA-415 (denial-of-service only) XSA-416 (denial-of-service only) XSA-417 (domid is never reused) XSA-418 (denial-of-service only) XSA-419 (denial-of-service only) XSA-420 (oxenstored is not used in Qubes OS) XSA-421 (denial-of-service only) Related links Xen XSA list (https://xenbits.xen.org/xsa/) Qubes XSA tracker (https://www.qubes-os.org/security/xsa/) Qubes security pack (qubes-secpack) (https://www.qubes-os.org/security/pack/) Qubes security bulletins (QSBs) (https://www.qubes-os.org/security/qsb/) -
Qubes OS📢
your overall Qubes system on different examples. You probably also noticed that there are commonalities among them. Most people need to use email, for example, so most people will need at least one email qube and a suitable template to base it on. But not everyone will need Split GPG (https://www.qubes-os.org/doc/split-gpg/), and not everyone will want to use the same email client. On the other hand, almost everyone will need a password manager, and it pretty much always makes sense to keep it in an offline, network-isolated vault. As you gain experience with Qubes, you may find yourself disagreeing with some of the decisions our fictional friends made. That's okay! There are many different ways to organize a Qubes system, and the most important criterion is that it serves the needs of its owner. Since everyone's needs are different, it's perfectly normal to find yourself doing things a bit differently. Nonetheless, there are some general principles that almost all users find helpful, especially when they're first starting out. As you’re designing your own Qubes system, keep in mind some of the following lessons from our case studies: You’ll probably change your mind as you go. You’ll realize that one qube should really be split into two, or you’ll realize that it doesn’t really make sense for two qubes to be separate and that they should instead be merged into one. That’s okay. Qubes OS supports your ability to adapt and make changes as you go. Try to maintain a flexible mindset. Things will eventually settle down, and you’ll find your groove. Changes to the way you organize your qubes will become less drastic and less frequent over time. Make frequent backups. (www.qubes-os.org/doc/how…-migrate) Losing data is never fun, whether it’s from an accidental deletion, a system crash, buggy software, or a hardware failure. By getting into the habit of making frequent backups now, you’ll save yourself from a lot of pain in the future. Many people never take backups seriously until they suffer catastrophic data loss. That’s human nature. If you’ve experienced that before, then you know the pain. Resolve now never to let it happen again. If you’ve never experienced it, count yourself lucky and try to learn from the hard-won experience of others. Keeping good backups also allows you to be a bit more free with reorganizations. You can delete qubes that you think you won’t need anymore without having to worry that you might need them again someday, since you know you can always restore them from a backup. Think about which programs you want to run and where you want to store data. In some cases, it makes sense to run programs and store data in the same qube, for example, if the data is generated by that program. In other cases, it makes sense to have qubes that are exclusively for storing data (e.g., offline data storage vaults) and other qubes that are exclusively for running programs (e.g., web browser-only qubes). Remember that when you make backups, it’s only essential to back up data that can’t be replaced. This can allow you to achieve minimal backups that are quite small compared to the total size of your installation. Templates, service qubes, and qubes that are used exclusively for running programs and that contain no data don’t necessarily have to be backed up as long as you’re confident that you can recreate them if needed. This is why it’s a good practice to keep notes on which packages you installed in which templates and which customizations and configurations you made. Then you can refer to your notes the next time you need to recreate those qubes. Of course, backing up everything is not a bad idea either. It may require a bit more time and disk space upfront, but for some people, it can be just as important as backing up their irreplaceable data. If your system is mission-critical, and you can’t afford more than a -
Qubes OS📢
certain amount of downtime, then by all means, back everything up! Introspect on your own behavior. For example, if you find yourself wanting to find some way to get two qubes to share the same storage space, then this is probably a sign that those two qubes shouldn’t be separate in the first place. Sharing storage with each other largely breaks down the secure wall between them, making the separation somewhat pointless. But you probably had a good reason for wanting to make them two separate qubes instead of one to begin with. What exactly was that reason? If it has to do with security, then why are you okay with them freely sharing data that could allow one to infect the other? If you’re sure sharing the data wouldn’t cause one to infect the other, then what’s the security rationale for keeping them separate? By critically examining your own thought process in this way, you can uncover inconsistencies and contradictions that allow you to better refine your system, resulting in a more logical organization that serves your needs better and better over time. Don’t assume that just because you can’t find a way to attack your system, an adversary wouldn’t be able to. When you’re thinking about whether it’s a good idea to combine different activities or data in a single qube, for example, you might think, “Well, I can’t really see how these pose a risk to each other.” The problem is that we often miss attack vectors that sophisticated adversaries spot and can use against us. After all, most people don’t think that using a conventional monolithic operating system is risky, when in reality their entire digital life can be taken down in one fell swoop. That’s why a good rule of thumb is: When in doubt, compartmentalize. But remember that compartmentalization — like everything else — can be taken to an extreme. The appropriate amount depends on your temperament, time, patience, experience, risk tolerance, and expertise. In short, there can be such a thing as too much compartmentalization! You also have to be able to actually use your computer efficiently to do the things you need to do. For example, if you immediately try to jump into doing everything in disposables (www.qubes-os.org/doc/how…posables) and find yourself constantly losing working (e.g., because you forget to transfer it out before the disposable self-destructs), then that’s a big problem! Your extra self-imposed security measures are interfering with the very thing they’re designed to protect. At times like these, take a deep breath and remember that you’ve already reaped the vast majority of the security benefit simply by using Qubes OS in the first place and performing basic compartmentalization (e.g., no random web browsing in templates). Each further step of hardening and compartmentalization beyond that represents an incremental gain with diminishing marginal utility. Try not to allow the perfect to be the enemy of the good! -
Qubes OS📢
One qube for each investment firm and bank. Carol has a few different retirement accounts, brokerage accounts, and bank accounts. She treats each qube like a “secure terminal” for accessing only that one institution’s website. She makes her transactions and saves any statements and confirmations she downloads in that qube. She uses the Qubes firewall (https://www.qubes-os.org/doc/firewall/) to enable access only to that institution’s website in that qube so that she doesn’t accidentally visit any others. Since most of what she does involves using websites and PDFs, most of Carol’s app qubes are based on a minimal template (https://www.qubes-os.org/doc/templates/minimal/) with just a web browser (which doubles as a PDF viewer) and a file manager installed. One qube for all her credit card accounts. Carol started to make a separate qube for each credit card account but ultimately decided against it. For one thing, the consumer protections for credit card fraud in her country are much better than for losing assets to theft or fraud in a bank or brokerage account, so the security risk isn’t as high. Second, there’s actually not a whole lot that an attacker could do with access to her credit cards’ online accounts or her old credit card statements, since online access to these generally doesn’t allow spending or withdrawing any money. So, even the worst case scenario here wouldn’t be catastrophic, unlike with her bank and brokerage accounts. Third, she’s not too worried about any of her credit card company websites being used to attach each other or her qube (As long as it’s contained to a single qube, she’s fine with that level of risk.) Last, but not least: She has way too many credit cards! While Carol is very frugal, she likes to collect the sign-up bonuses that are offered for opening new cards, so she’s accumulated quite a few of them. (However, she’s always careful to pay off her balance each month, so she never pays interest. She’s also pretty disciplined about only spending what she would have spent anyway and not being tempted to spend more just to meet a spending requirement or because she can.) At any rate, Carol has decided that the tiny benefit she stands to gain from having a separate qube for every credit card website wouldn’t be worth the hassle of having to manage so many extra qubes. A qube for credit monitoring, credit reports, and credit history services. Carol has worked hard to build up a good credit score, and she’s concerned about identity theft, so she has one qube dedicated to managing her free credit monitoring services and downloading her free annual credit reports. Two qubes for taxes. Carol has a Windows qube (github.com/Qubes-C…ndows.md) for running her Windows-only tax software. She also has an offline vault where she stores all of her tax-related forms and documents, organized by year. A qube for financial planning and tracking. Carol loves spreadsheets, so this offline qube is where she maintains a master spreadsheet to track all of her investments and her savings rate. She also keeps her budgeting spreadsheet, insurance spreadsheet, and written investment policy statement here. This qube is based on a template with some additional productivity software, like LibreOffice and Gnumeric (so that Carol can run her own Monte Carlo simulations). Various email qubes. Carol likes to have one email qube for her most important financial accounts; a separate one for her credit cards accounts, online shopping accounts, and insurance companies; and another one for personal email. They’re all based on the same template with Thunderbird installed. A password manager vault. A network-isolated qube where Carol stores all of her account usernames and passwords in KeePassXC. She uses the Qubes global clipboard (www.qubes-os.org/doc/how…ste-text) to copy and paste them -
Qubes OS📢
into her other qubes when she needs to log into her accounts. Bonus: Carol explores new financial technology The vast majority of Carol’s assets are in broad-based, low-cost, passively-managed indexed funds. Lately, however, she’s started getting interested in cryptocurrency. She’s still committed to staying the course with her tried-and-true investments, and she’s always been skeptical of new asset classes, especially those that don’t generate cash flows or that often seem to be associated with scams or wild speculation. However, she finds the ability to self-custody a portion of her assets appealing from a long-term risk management perspective, particularly as a hedge against certain types of political risk. Some of Carol's friends warned her that cryptocurrency is extremely volatile and that hacking and theft are common occurrences. Carol agreed and reassured them that she's educated herself about the risks and will make sure she never invests more than she can afford to lose. Carol has added the following to her Qubes setup: A standalone qube for running Bitcoin Core and an offline wallet vault. Carol finds the design and security properties of Bitcoin very interesting, so she’s experimenting with running a full node. She also created a network-isolated vault in order to try running a copy of Bitcoin Core completely offline as a “cold storage” wallet. She’s still trying to figure out how this compares to an actual hardware wallet, paper wallet, or physically air-gapped machine, but she’s figures they all have different security properties. She also recently heard about using Electrum as a “split” wallet in Qubes (github.com/Qubes-C…tcoin.md) and is interested in exploring that further. Whonix qubes. Carol read somewhere that Bitcoin nodes should be run over Tor for privacy and security. She found it very convenient that Whonix is already integrated into Qubes, so she simply set her Bitcoin Core “full node” qube to use sys-whonix as its networking qube. Various qubes for DeFi and web3. Carol has also started getting into DeFi (decentralized finance) and web3 on Ethereum and other smart contract blockchains, so a friend recommended that she get a Ledger hardware wallet. She downloaded the Ledger Live software in an app qube and set up her system to recognize the Ledger (www.kicksecure.com/wiki/Le…e_Wallet). She can now start her USB qube (https://www.qubes-os.org/doc/usb-qubes/), plug her Ledger into it into a USB port, use the Qubes Devices widget to attach it (https://www.qubes-os.org/doc/how-to-use-devices/) to her Ledger Live qube, and from there she can interact with the software. She has a separate qube with the Metamask extension installed in a web browser. She can also use the Qubes Devices widget to attach her Ledger to this qube so she can use Metamask in conjunction with her Ledger to interact with smart contracts and decentralized exchanges. Various qubes for research and centralized exchanges. Carol uses these when she wants to check block explorer websites, coin listing and market cap sites, aggregation tools, or just to see what the latest buzz is on Crypto Twitter. Carol makes sure to back up all of her qubes that contain important account statements, confirmations, spreadsheets, cryptocurrency wallets, and her password manager vault. If she has extra storage space, she’ll also back up her templates and even her Bitcoin full node qube, but she’ll skip them if she doesn’t have time or space, since she knows she can always recreate them again later and download what she needs from the Internet. Conclusion The characters we’ve met today may be fictional, but they represent the needs of real users like you. You may find that your own needs overlap with more than one of them, in which case you may find it useful to model certain subsets of -
Qubes OS📢
the need to try out new software or tweak any settings, so he can do everything he needs to do on a daily basis without having to interact with the command line. Carol, the investor Carol works hard and lives below her means so that she can save money and invest it for her future. She hopes to become financially independent and maybe even retire early someday, and she’s decided that her best bet for achieving this is by investing for the long term and allow compounding to do its work. However, after doing some research into her country’s consumer financial protection laws, she learned that there’s no legal guarantee that customers will be made whole in the event of theft or fraud. The various insurance and protection organizations only guarantee recovery in the case of a financial institution failing, which is quite different from an individual customer being hacked. Moreover, even though many financial institutions have their own cybercrime policies, rarely, if ever, do they explicitly guarantee reimbursement in the event that a customer gets hacked (rather than the institution itself). Carol looked into how thieves might actually try to steal her hard-earned wealth and was surprised to learn that they have all sorts of ploys that she had never even considered. For example, she had assumed that any theft would, at the bare minimum, have to involve transferring money out of her account. That seems like a safe assumption. But then she read about "pump and dump" attacks, where thieves buy up some penny stock, hack into innocent people's brokerage accounts, then use the victims' funds to buy that same penny stock, "pumping" up its price so that the thieves can "dump" their shares on the market, leaving the victims with worthless shares. No money is ever transferred into or out of the victims' account; it's just used to buy and sell securities. So, all the safeguards preventing new bank accounts from being added or requiring extra approval for outbound transfers do nothing to protect victims' funds in cases like these. And this is just one example! Carol realized that she couldn't assume that existing safeguards against specific, known attacks were enough. She had to think about security at a more fundamental level and design it into her digital life from the ground up. After learning about all this, Carol decided that it was ultimately up to her to take care of her own cybersecurity. She couldn’t rely on anyone else to do it for her. Sure, most people just use regular consumer tech and will probably end up fine, but, she reminded herself, most people also don’t have as much to lose. It’s not a risk that she was willing to take with her future, especially knowing that there’s probably no government bailout waiting for her and that all the brokerage firms’ vaguely reassuring marketing language about cybersecurity isn’t legally binding. So, Carol started reading more about computer security and eventually stumbled upon Qubes OS after searching the web for “most secure operating system.” She read about how it’s designed and why. Although she didn’t immediately understand all of the technical details, the fundamental principle of security-by-compartmentalization (https://www.qubes-os.org/doc/architecture/) made intuitive sense to her, and the more she learned about the technical aspects, the more she realized that this is what she’d been looking for. Today, her setup looks like this: -
Qubes OS📢
so that it doesn’t risk infecting the rest of his machine. Bob isn’t a super technical guy. He prefers to keep his tools simple so he can focus on what’s important to him: uncovering the truth, exposing the guilty, exonerating the innocent, and shining light on the dark corners of society. His mind doesn’t naturally gravitate to the technical details of how his computer works, but he’s aware that people are getting hacked all the time and that the nature of his work might make him a target. He wants to protect his sources, his colleagues, his family, and himself; and he understands that computer security is an important part of that. He has a Qubes laptop that he uses only for work, which contains: -
Qubes OS📢
One offline qube for writing. It runs only LibreOffice Writer. This is where Bob does all of his writing. This window is usually open side-by-side with another window containing research or material from a source. Multiple email qubes. One is for receiving emails from the general public. Another is for emailing his editor and colleagues. Both are based on a minimal template (https://www.qubes-os.org/doc/templates/minimal/) with Thunderbird installed. He’s configured both to open all attachments in disposables (www.qubes-os.org/doc/how…posables) that are offline in case an attachment contains a beacon that tries to phone home. Whonix qubes. He has the standard sys-whonix service qube for providing Torified network access, and he uses disposable anon-workstation app qubes for using Tor Browser to do research on stories he’s writing. Since the topic is often of a sensitive nature and might implicate powerful individuals, it’s important that he be able to conduct this research with a degree of anonymity. He doesn’t want the subjects of his investigation to know that he’s looking into them. He also doesn’t want his network requests being traced back to his work or home IP addresses. Whonix helps with both of these concerns. He also has another Whonix-based disposable template for receiving tips anonymously via Tor, since some high-risk whistleblowers he’s interacted with have said that they can’t take a chance with any other form of communication. Two qubes for Signal (github.com/Qubes-C…ignal.md). Bob has two Signal app qubes (both on the same template in which the Signal desktop app is installed). One is linked to his own mobile number for communicating with co-workers and other known, trusted contacts. The other is a public number that serves as an additional way for sources to reach him confidentially. This is especially useful for individuals who don’t use Tor but for whom unencrypted communication could be dangerous. Several data vaults. When someone sends Bob material that turns out to be useful, or when he comes across useful material while doing his own research, he stores a copy in a completely offline, network-isolated vault qube. Most of these files are PDFs and images, though some are audio files, videos, and text files. Since most of them are from unknown or untrusted sources, Bob isn’t sure if it would be safe to put them all in the same vault, so he makes different vaults (usually one for each story or topic) just in case. This has the side benefit of helping to keep things organized. A VPN qube (github.com/Qubes-C…n/vpn.md) and associated qubes for accessing work resources. The servers at work can only be accessed from the organization’s network, so Bob has certain qubes that are connected to a VPN qube so that he can upload his work and access anything he needs on the local network when he’s not physically there. A password manager vault. Bob stores all of his login credentials in the default password manager that came with his offline vault qube. He securely copies and pastes (www.qubes-os.org/doc/how…ste-text) them into other qubes as needed. A colleague helped Bob set up his Qubes system initially and showed him how to use it. Since Bob’s workflow is pretty consistent and straightforward, the way his qubes are organized doesn’t change much, and this is just fine by him. His colleague told him to remember a few simple rules: Don’t copy or move text (www.qubes-os.org/doc/how…ste-text) or files (www.qubes-os.org/doc/how…ve-files) from less trusted to more trusted qubes; update (https://www.qubes-os.org/doc/how-to-update/) your system when prompted; and make regular backups (www.qubes-os.org/doc/how…-migrate). Bob doesn’t have -
Qubes OS📢
Several email qubes. Since Alice is a command-line aficionado, she likes to use a terminal-based email client, so both her work and personal email qubes are based on a template with Mutt (github.com/Qubes-C…/mutt.md) installed. The email qubes where she sends and receives PGP-signed and encrypted email securely accesses the private keys in her PGP backend qube (more on that below). To guard against malicious attachments, she configured Mutt to open all attachment files in disposable qubes (www.qubes-os.org/doc/how…posables). Several qubes for communication tools, like Signal, Slack, Zoom, Telegram, IRC, and Discord. This is where she teleconferences and chats with clients. She uses USB passthrough (www.qubes-os.org/doc/how…-devices) to attach her webcam to each qube as needed and detaches it afterward. Likewise, she gives each qube access to her microphone while it’s needed, then removes access afterward. This way, she doesn’t have to trust any given video chat program’s mute button and doesn’t have to worry about being spied on when she’s not on a call. She also has a qube for social media platforms like Twitter, Reddit, and Hacker News for networking and keeping up with new developments (or so she claims; in reality, it’s mostly for feuds over programming language superiority, Vim vs. Emacs wars, and tabs vs. spaces crusades). A GPG backend vault. Vaults are completely offline qubes that are isolated from the network. This particular vault holds Alice’s private keys (e.g., for code signing and email) and is securely accessed by several other “frontend” qubes via the Split GPG (https://www.qubes-os.org/doc/split-gpg/) system. Split GPG allows only the frontend qubes that Alice explicitly authorizes to have the ability to request PGP operations (e.g., signing and encryption) in the backend vault. Even then, no qube ever has direct access to Alice’s private keys except the backend vault itself. A password manager vault. This is another completely offline, network-isolated qube where Alice uses her offline password manager, KeePassXC, to store all of her usernames and passwords. She uses the secure copy and paste (www.qubes-os.org/doc/how…ste-text) system to quickly copy credentials into other qubes whenever she needs to log into anything. Personal qubes. One of the things Alice loves the most about Qubes is that she can use it for both work and personal stuff without having to worry about cross-contamination. Accordingly, she has several qubes that pertain to her personal life. For example, she has an offline vault that holds her medical documents, test results, and vaccination records. She has another offline vault for her government documents, birth certificate, scans of her passport, and so on. She also has some personal social media accounts in a separate qube for keeping up with family members and friends from school. When she finishes her work for a given client, Alice sends off her deliverables, backs up (www.qubes-os.org/doc/how…-migrate) the qubes containing the work for that client, and deletes them from her system. If she ever needs those qubes again or just wants to reference them, she can easily restore them from her backup, and the internal state of each one will be exactly as it was when she finished that project. Bob, the investigative journalist As part of his research and reporting, Bob is frequently forced to interact with suspicious files, often from anonymous sources. For example, he may receive an email with an attachment that claims to be a tip about a story he’s working on. Of course, he knows that it could just as easily be malware intended to infect his computer. Qubes OS is essential for Bob, since it allows him to handle all this suspicious data securely, keeping it compartmentalized -
Qubes OS📢
XSAs released on 2022-10-11 www.qubes-os.org/news/20…22-10-11 The Xen Project has released one or more Xen Security Advisories (XSAs). The security of Qubes OS is not affected. Therefore, no user action is required. XSAs that affect the security of Qubes OS (user action required) The following XSAs do affect the security of Qubes OS: (none) XSAs that do not affect the security of Qubes OS (no user action required) The following XSAs do not affect the security of Qubes OS, and no user action is necessary: XSA-409 (ARM architecture only) XSA-410 (denial-of-service only) XSA-411 (denial-of-service only; gnttab v2 is unused in Qubes OS) XSA-413 (denial-of-service only; XAPI is unused in Qubes OS) Related links Xen XSA list: https://xenbits.xen.org/xsa/ Qubes XSA tracker: https://www.qubes-os.org/security/xsa/ Qubes security pack (qubes-secpack): https://www.qubes-os.org/security/pack/ Qubes security bulletins (QSBs): https://www.qubes-os.org/security/qsb/ -
Qubes OS📢
The Qubes OS Project is now accepting donations on Ethereum! www.qubes-os.org/news/20…ethereum We are pleased to announce that the Qubes OS Project is now accepting donations (https://www.qubes-os.org/donate/) on Ethereum (https://ethereum.org/) (Mainnet) at the following address: 0xDaa04647e8ecb616801F9bE89712771F6D291a0C Warning: This Gnosis Safe (https://gnosis-safe.io/) Ethereum address supports ether (ETH) and all assets that fully comply with the ERC-20 (ethereum.org/en/deve…s/erc-20) standard (e.g., USDT, USDC, and DAI), but only on Ethereum Mainnet (ethereum.org/en/deve…networks). Please do not send assets on any other network to this address, or else your donation may be lost. For example, please do not send assets on any Ethereum Layer 2 solution (e.g., Arbitrum, Optimism) or any sidechain (e.g., Polygon, xDai) to this address. We have recently observed an increase in demand for an Ethereum donation option, both for ETH itself and for stablecoins like USDT, USDC, and DAI. As the largest smart-contract blockchain, largest proof-of-stake blockchain, and second-largest cryptocurrency by market capitalization, the Ethereum network and its native currency ETH are natural additions to our growing list of donation methods. Moreover, this new option allows users to donate any token they choose (including non-stablecoins!) so long as (1) the token fully complies with the ERC-20 standard and (2) the transaction is done on Ethereum Mainnet (as opposed to a Layer 2 solution or a sidechain). Please double-check that both of these conditions hold before sending anything to our Ethereum address, or else your donation may be lost! As with our bitcoin (BTC) and monero (XMR) donation addresses, you can verify the authenticity of our Ethereum donation address via the Qubes Security Pack (https://www.qubes-os.org/security/pack/) in the fund (github.com/QubesOS…ter/fund) directory. We also provide detailed instructions for verifying the digital signatures (www.qubes-os.org/securit…ity/pack). As with all other donations, your donations on Ethereum will directly fund the Qubes OS Project (www.qubes-os.org/donate…e). Since Qubes is free and open-source software, we do not earn any revenue by selling it. Instead, we rely on your financial support. If you rely on Qubes for secure computing in your work or personal life or see the value in our efforts, we would greatly appreciate your donation. Thank you! -
Реклама
-
Qubes OS📢
King Charles Pays Tribute to Queen Elizabeth on a Day Steeped in Tradition Oppressive Blackouts Force Lebanese to Change Rhythm of Life Ukraine Claims More Ground in Northeast and South Source: BBC News - World (https://feeds.bbci.co.uk/news/world/rss.xml) Ukraine war: We retook 6,000 sq km from Russia in September, says Zelensky Ukraine war: What will Russia's losses mean for Putin? Ukraine war: A successful surprise attack - but danger still looms Sweden election: Result could take days as vote too close to call Taoiseach: Queen's death 'reminder to nurture UK-Ireland relations' Source: Blockchain.info 00000000000000000002fb0e59c723277069b5389aa2df4b8ff6dc8d80da6ad4 Footnotes ---------- [1] This file should be signed in two ways: (1) via detached PGP signatures by each of the signers, distributed together with this canary in the qubes-secpack.git repo, and (2) via digital signatures on the corresponding qubes-secpack.git repo tags. [2] [2] Don't just trust the contents of this file blindly! Verify the digital signatures! Instructions for doing so are documented here: https://www.qubes-os.org/security/pack/ [3] www.qubes-os.org/securit…gnatures -- The Qubes Security Team https://www.qubes-os.org/security/ -
Qubes OS📢
Qubes Canary 032 www.qubes-os.org/news/20…nary-032 We have published Qubes Canary 032. The text of this canary is reproduced below. This canary and its accompanying signatures will always be available in the Qubes security pack (qubes-secpack). View Qubes Canary 032 in the qubes-secpack: github.com/QubesOS…2022.txt Learn how to obtain and authenticate the qubes-secpack and all the signatures it contains: https://www.qubes-os.org/security/pack/ View all past canaries: https://www.qubes-os.org/security/canary/ ---===[ Qubes Canary 032 ]===--- Statements ----------- The Qubes security team members who have digitally signed this file [1] state the following: 1. The date of issue of this canary is September 13, 2022. 2. There have been 84 Qubes security bulletins published so far. 3. The Qubes Master Signing Key fingerprint is: 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494 4. No warrants have ever been served to us with regard to the Qubes OS Project (e.g. to hand out the private signing keys or to introduce backdoors). 5. We plan to publish the next of these canary statements in the first fourteen days of December 2022. Special note should be taken if no new canary is published by that time or if the list of statements changes without plausible explanation. Special announcements ---------------------- We plan to create a new Release Signing Key (RSK) [3] for Qubes OS 4.2. Normally, we have only one RSK for each major release. However, for the 4.2 release, we will be using Qubes Builder version 2, which is a complete rewrite of the Qubes Builder. Out of an abundance of caution, we would like to isolate the build processes of the current stable 4.1 release and the upcoming 4.2 release from each other at the cryptographic level in order to minimize the risk of a vulnerability in one affecting the other. We are including this notice as a canary special announcement since introducing a new RSK for a minor release is an exception to our usual RSK management policy. Disclaimers and notes ---------------------- We would like to remind you that Qubes OS has been designed under the assumption that all relevant infrastructure is permanently compromised. This means that we assume NO trust in any of the servers or services which host or provide any Qubes-related data, in particular, software updates, source code repositories, and Qubes ISO downloads. This canary scheme is not infallible. Although signing the declaration makes it very difficult for a third party to produce arbitrary declarations, it does not prevent them from using force or other means, like blackmail or compromising the signers' laptops, to coerce us to produce false declarations. The proof of freshness provided below serves to demonstrate that this canary could not have been created prior to the date stated. It shows that a series of canaries was not created in advance. This declaration is merely a best effort and is provided without any guarantee or warranty. It is not legally binding in any way to anybody. None of the signers should be ever held legally responsible for any of the statements made here. Proof of freshness ------------------- Tue, 13 Sep 2022 02:47:47 +0000 Source: DER SPIEGEL - International (https://www.spiegel.de/international/index.rss) Poland's Prime Minister on Ukraine War and Energy Crisis Habeck's Meltdown: Nuclear Energy Standby Proposal Has Germany's Greens Seeing Red European Commissioner Gentiloni: "The Coming Winter Could Be One of the Worst in History" Russian Meddling in the Balkans: "Over and Over, Putin Says Kosovo, Kosovo, Kosovo!" Laos and the New Silk Road: The Train to Dependence on China Source: NYT > World News (rss.nytimes.com/service…orld.xml) Ukraine’s Sudden Gains Prompt New Questions for Commanders Russian Critics Speak Out, Prompted by Ukraine Losses -
Qubes OS📢
Qubes OS Summit: History from organizer's perspective www.qubes-os.org/news/20…-history Editor’s note: This is a guest article by Michał Żygowski from 3mdeb (https://3mdeb.com/) about the history of Qubes OS Summits. Thanks for sharing with us today, Michał! Introduction The next Qubes OS Summit 2022 (www.qubes-os.org/news/20…mit-2022) edition is upcoming. This year it will be held in Berlin from September 9th to 11th in hybrid format, in person and live-streamed for remote access. More details here (https://qubesos.3mdeb.com/). Don’t miss the event and more importantly how it started. In the article the history and organizer’s perspective of the event will be described. How did all of this start? In May 2019 3mdeb funded Linux training for its employees, having no idea who the instructor will be. At some point, it occurred that the mysterious instructor will be none other than Marek Marczykowski-Górecki, the same person who leads the Qubes OS project. As huge fans of Qubes OS and its approach to security, as also fans of Joanna Rutkowska security research in the area of firmware and computer architecture, we were delighted to meet him in person in our office in Gdańsk, Poland. The time has come when the idea of a short event focused on firmware impact on Qubes OS security has been born. We asked Marek if he has some spare time to discuss firmware impacts on Qubes OS security and he liked the idea. The event has been called humorously a “minisummit”. That is how the first Qubes OS summit started, one day, in a small conference room, with a tiny group of people passionate about firmware and system security, nothing outrageous (in the meaning of scale). One may still read what topics have been discussed here (blog.3mdeb.com/2019/20…nisummit). The main focus was on Qubes OS certification and ecosystem as well as the firmware-related security technologies support like TPM 2.0 and DRTM (Anti Evil Maid). The event helped 3mdeb realize how to get involved in Qubes OS project and help to improve it with our expertise. The past of Qubes OS Summits Everyone enjoyed that one particular day so much, that we decided to repeat the event next year. The environment we created together, bending and crossing the event horizon between firmware and operating system, was something wonderful, both to hear and to speak about. The potential we saw in that kind of event, to bring various companies together and collaborate on the project on every possible layer, has been pushing us forward to enlarge the community and introduce more open-source firmware to the Qubes OS world. Another May has come, the year 2020, the pandemic dominated the world. But it didn’t stop us from holding the event again! It even gave us a better opportunity to attract and gather more people virtually to attend the event. Thanks to our 3mdeb colleagues, who set up the live recording and streaming of the whole Qubes OS 2020 Summit, it is possible to see and listen to the talks given by Qubes OS and 3mdeb experts on Youtube (www.youtube.com/playlis…playlist) over and over again. From 3mdeb side we continued firmware-related topics, for example first time Qubes OS Anti Evil Maid on AMD platform. It was quite a challenge for us because we have organized such a virtual event for the first time. Fortunately, everything went smoothly and finished with success after 4 sessions 2.5 hours long. In August 2021 we held yet another Qubes OS Summit together with the Qubes OS team, still virtually, unfortunately. However, this year brought more speakers from other companies and projects, which we were very happy about. There were 2 sessions almost 4 hours each and one may watch the talks at Youtube (www.youtube.com/playlis…playlist).