the most secure OS in the world.....I hate it

NetworkChuck Technology Careers Career & Money

About this video

An installation walkthrough and tour of Qubes OS, which he calls the most secure operating system while also finding it painful to use. Its premise, as he explains it, is that compromise is inevitable and all software has exploitable flaws, so the system confines and contains damage: everything runs in isolated virtual-machine compartments called qubes, built on Xen-based type-one virtualization. Separate app qubes — for work, personal use, or Tor browsing via Whonix, each color-coded so you know which one you are in — are spawned from template qubes based on systems like Fedora and Debian 11, so updating a template updates every qube built on it while a compromised app qube cannot alter its template. Even hardware and networking are compartmentalized into service qubes for USB, networking, and firewall duties, and everything is administered by Dom0, the most trusted qube, which has no internet access and should only run the desktop. Disposable qubes that erase everything on shutdown are also covered. He installs the 4.1.2 release both in VMware Workstation Player (VirtualBox did not work for him, and Qubes does not officially support running inside a VM at all) and on bare metal via a USB stick written in DD image mode, with virtualization enabled and Secure Boot disabled in BIOS. He notes the steep requirements — a minimum of 6 GB of RAM with 16 GB recommended, and 32 GB of storage minimum with 128 GB recommended — and the long install time. His verdict: impressive and genuinely secure, but slow and cumbersome enough that he prefers running separate virtual machines himself and sticking with his usual systems.

Key takeaways

Qubes OS assumes you will be hacked: it isolates apps, networking, and USB into separate virtual machines so one compromise cannot spread to the rest
App qubes derive from template qubes — maintain and update apps once in the template, and every dependent qube inherits the change while remaining unable to modify the template
Dom0, the administrative qube, has no network access and should run nothing but the desktop environment; if it falls, the whole system falls
Hardware demands are high: 64-bit CPU with hardware virtualization and IOMMU, 16 GB of RAM recommended, and 128 GB of storage recommended — and nested virtualization inside a VM is officially unsupported
Disposable qubes offer a middle ground for risky tasks: anything created or browsed in them vanishes when the qube is stopped

Episode details: published December 23, 2023 · 20:26 long. Summary written by Self Growth Videos from the episode itself. Business results and any income figures mentioned are NetworkChuck’s own claims, shared for education — they are not typical or guaranteed.

← Previous: Google is forcing you to use their proxy (build your own instead) · Next: you need to learn tmux RIGHT NOW!! →

All NetworkChuck videos · NetworkChuck profile · NetworkChuck on YouTube