Qubes OS 4.3.2 has been released(www.qubes-os.org)
19 pointsby andrewdavidwong5 hours ago1 comment
  • SwellJoe3 hours ago
    Cool idea, but Xen seems like an odd choice? I mean, KVM gets so much more attention from a broader set of developers, doesn't it? What makes Xen a better fit for this?
    • wps2 hours ago
      From the architecture spec doc:

      > We believe that the Xen hypervisor architecture better suits the needs of our project. Xen hypervisor is very small comparing to Linux kernel, which makes it substantially easier to audit for security problems. Xen al- lows to move most of the “world-facing” code out of Dom0, including the I/O emulator, networking code and many drivers, leaving very slim interface between other VMs and Dom0. Xenʼs support for driver domain is crucial in Qubes OS architecture. KVM relies on the Linux kernel to provide isolation, e.g. for the I/O emulator process, which we believe is not as secure as Xenʼs isolation based on virtualization enforced by thin hypervisor. KVM also doesnʼt support driver domains.

      • SwellJoe2 hours ago
        Ah, thanks, that clarifies things, and it makes sense. Though I imagine there's pain with hardware support vs. Linux which runs on everything and can pass through access to KVM VMs. I mean, it seems like GPU support would be challenging, in particular.