Erste deutsche Rezension von Qubes OS auf Youtube

[Knut von Walter]

Liebe Freunde von Qubes OS,

Es gibt gute Neuigkeiten, denn auf Youtube gibt es die erste Rezension von Qubes OS in deutscher Sprache. Auch wenn der Autor erst einmal nur einen Einstieg in die Thematik bietet, finde ich das Video trotzdem interessant. Link: https://www.youtube.com/watch?v=ugEKW4Bdv2U .

Best Knut von Walter

 

[GWeck]

A rather good first introduction to the basic concepts of Qubes OS! I hope this helps spreading the word about Qubes in the DACH countries.

In Germany, we desparately need  a secure basis for IT in many areas where government and firms currently are using Windows - contrary to privacy protection laws, and contrary to common sense - see Emotet.

[Ulrich Windl]

>>> GWeck <gerhard...@gmail.com> schrieb am 04.05.2020 um 14:04 in Nachricht
<22855_1588593848_5EB004B7_22855_343_1_8c98f91b-eec7-465e-8b1d-381ad2ea9717@goog
egroups.com>:

Sorry, the problem with Windows is that it was designed for stupid people, just to sell more copies. I severely doubt you can convince the typical Windows user to use QubesOS for daily work. "Security" is not a product you can buy, and "security" is the " is the opposite of "comfort". People want comfort not security. Why else would they use Alexa or Google assistant or Siri, dubious password managers, etc.?

>
> --
> You received this message because you are subscribed to the Google Groups
> "qubes-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to qubes-users...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/qubes-users/8c98f91b-eec7-465e-8b1d-381ad2e
> a9717%40googlegroups.com.

[Sven Semmler]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On Mon, May 04, 2020 at 09:50:31PM +0200, Ulrich Windl wrote:
> Sorry, the problem with Windows is that it was designed for stupid people, just to sell more copies.

I'll simply assume this is more a statement of frustration then a
serious attempt to explain anything.

> I severely doubt you can convince the typical Windows user to use QubesOS for daily work. "Security" is not a product you can buy, and "security" is the "is the opposite of "comfort".

Security and comfort are more like two opposing poles of a continuum.
Personally I do think Qubes does a rather excellent job of
demonstrating "reasonable security".

It is rather unrealistic (at this point) to expect the average user to
install and configure Qubes correctly - agreed. However I can imagine it
being used by average users in a government/business context with a
normal amount of training (they would received for any other newly
introduced solution too).

Actually once installed and configured correctly there isn't much
difference at all. You'd have to teach them to

- pay attention to the color of the window frame
- how to use copy/paste
- how to move files between domains
- how to attach USB devices and when that's OK and when not*

*e.g. webcam/mic for conferencing = OK, USB stick to
confidential domain = Not OK etc.

> People want comfort not security. Why else would they use Alexa or Google assistant or Siri, dubious password managers, etc.?

Sure. This is all about context. Qubes for private use without the user
recognizing the need is unrealistic. And even with the ones recognizing
the need Qubes in it's current from might not be there quite yet.
However, efforts like the preconfigured Privacy Beast are a very
encouraging step in that direction.

/Sven

- --
public key: https://www.svensemmler.org/0x8F541FB6.asc
fingerprint: D7CA F2DB 658D 89BC 08D6 A7AA DA6E 167B 8F54 1FB6

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE18ry22WNibwI1qeq2m4We49UH7YFAl6wpyMACgkQ2m4We49U
H7ZTuw//d9HRr3in3+O6qPaFCu9peYftsx1eFGDc2WpYoabfuYJwk/lOyUk1hCgN
NkjYZ1ggHTqQbh7OZjD4lkm/0AcUYjMKwTNT3UhHs9dxvBTBiLjt8O/tRkdteBKm
bf2yT4T0h7OgaHvEU8eYClH6sRgNIF+fiVk3pgLsAvM2JRF1VHaRak1/6Df3mD8i
mlmpekTnfn/fmOfgjG2+ciXx/s0D0GRtidOwm3sgSBOhaD6GLQmlBURaRSMNoqR0
6U6S31ax51cIBTaGXYMLh0rVvE2ell/YUp+KFNgaFeGvWrTLkP/NoI2adwc49U+w
hwo5Wp1Mwheh7td2QJMijFIV9xNeoP+WgKeYGddUf8E/uMzDKCIiKBKfbOypZ7ED
bkZiDGmzzKHZb1/X81pFk+docmSBJqbB6cMSWCwvc38qj0Gsjz/4tHESzoQ5N+Xz
pofk8k9GR/u832wnWE/b0n139ZWJOAmDDukwojrDyIA2nu9V4+NTXwWMoap30xhb
DNb7/dIdXnk9GV2h/9HZvVcSpQEhQo8vzdw76GoUfSNilJ/QApqUflKNmrShhgeK
xjLYXgInuhog2MsW5DotVZ+fhz9XXc6936oWJk+lKALoGuJUjA83ypD++4xBJEti
5zoIfwm36Ec1szMM1ak2H+DBAy1ouzPLq/JdQDA3ObMAcpYXnFw=
=uv1a
-----END PGP SIGNATURE-----

[Mark Fernandes]

Quoted quoted reply: Ulrich Windl (on Mon, May 04, 2020 at 09:50:31PM +0200)
Quoted reply: Sven Semmler (on May 04 06:37PM -0500)

... 

> I severely doubt you can convince the typical Windows user to use QubesOS for daily work. "Security" is not a product you can buy, and "security" is the "is the opposite of "comfort".    

Security and comfort are more like two opposing poles of a continuum. 

Personally I do think Qubes does a rather excellent job of
demonstrating "reasonable security". 

...

 

The terms 'security' and 'comfort' (IMHO) are not so closely related as you both imply. You can have high security whilst at the same time maintaining comfort, especially when security runs in the background without the user having much involvement. It should be noted that even Windows (supposedly designed for 'stupid people') does have a certain level of security.

Whilst QubesOS may never be widely adopted, the research artefacts produced in the development of QubesOS may end-up being incorporated in other popular operating systems (including Windows). From this perspective, QubesOS may be a very worthwhile endeavour.

 

> People want comfort not security. Why else would they use Alexa or Google assistant or Siri, dubious password managers, etc.?

...

People also want security. In fact, they want security in respect of real security needs. It just depends on how much security is acceptable.

I think it's important to think about these things in the context of 'threat models'. In my non-business related activities, I often just don't care whether people are spying on me, and also whether they steal intellectual property from me. Sometimes, such illicit activities may even work to my favour (in a round-about way). Matching security to such a threat model, can mean that you only need very low security. On the other hand, for my business activities, especially in respect of legal requirements, security is very important, both for my business, and my clients.

 

... Qubes for private use without the user 

recognizing the need is unrealistic. ...

 

Qubes for private use without the user recognising the need may still be realistic. Users are often completely oblivious to the functionality of OEM software. Manufacturers may choose to pre-install QubesOS regardless of whether users recognise the need for security.

 

Kind regards,

Mark Fernandes

[Anil]

> I think it's important to think about these things in the context of 'threat models'. In my non-business related activities, I often just don't care >whether people are spying on me, and also whether they steal intellectual property from me. Sometimes, such illicit activities may even work to >my favour (in a round-about way). Matching security to such a threat model, can mean that you only need very low security. On the other hand, >for my business activities, especially in respect of legal requirements, security is very important, both for my business, and my clients.

IMHO, there are not two, but three things: security, privacy and
comfort/convenience.

Security is a highly ambiguous term.It can take very different
meanings.Privacy and convenience, however, are much less ambiguous.

In usage, the words security and privacy are often assumed to be
synonymous. This is wrong by a wide margin. They are, in fact, quite
often in direct opposition to each other, depending on what kind of
security you are talking about. Privacy often becomes the victim of
security and it is very easy to justify that when it happens.

Technology affects all three, but perhaps it affects convenience the
most, as in surveillance capitalism.

For security and privacy, technologies has a very mixed bag of effects
to offer, which are not like each other at all.

It may be obvious, but the answers to the questions about these three
lie only partially in technology. Regardless of technology, the
critical parts of the answers lie outside the domain of technology. On
forums like this, we tend to ignore them, because there is little we
can do about them. Here, at least.

Ultimately, the answers are going to depend on such external factors

- Law
- Enforcement of law
- Censorship
- Cultural ideas
- Ethical standards
- Regulations
- Ideas about individuality and solidarity or about freedom and rights/duties
- Political inclinations of the powerful people as well as of the
general population, whether we are living in a state of exception
- Human expectations and aspirations etc.
- Acceptable compromises to the powerful and the majority (fortunately
or unfortunately)

One more thing. Businesses and governments will usually find the
solutions they want because they can afford them, whether they are
right or wrong. It is individuals who need solutions from places likes
this forum and from developers of open software/hardware. But then, as
things stand, the sustainability of solutions depends on use by
businesses and governments, who will then like to get their wishes
enforced on the technological implementation. Or even inhibit certain
kinds of innovations or repurpose them.

Regards,

अनिल एकलव्य
(Anil Eklavya)

[Mark Fernandes]

APOLOGIES FOR GOING OFF TOPIC SOMEWHAT. SHOULD WE MOVE THIS DISCUSSION TO A DIFFERENT THREAD?

On Tuesday, 5 May 2020 21:12:43 UTC+1, Anil wrote:

....

In usage, the words security and privacy are often assumed to be
synonymous. This is wrong by a wide margin. They are, in fact, quite
often in direct opposition to each other, depending on what kind of

security you are talking about. ....

Totally agree with you that the terms security and privacy are often conflated one with the other. Most of the popular public discourse focuses on privacy. But for me, and probably many others, this rates fairly low in my mind. What is more important, is security: security that your communications have not undergone tampering, security that your money isn't being stolen, security that no-one is fiddling with your online accounts, etc. Privacy is also important, but only as a part of the overall aim of achieving security.

 

...

It may be obvious, but the answers to the questions about these three
lie only partially in technology. Regardless of technology, the
critical parts of the answers lie outside the domain of technology. On
forums like this, we tend to ignore them, because there is little we

can do about them. ....

Very true that security is about much more than simply technology. Non-technology issues are probably mostly ignored in these forums, because these forums are dedicated to a particular piece of technology, and because most subscribers are likely technology specialists. It's good to have lateral experience of different domains, and also to bring-in people who aren't technology specialists, so that their creative input can add extra value to the discussions.

One thought I've had is that changing business models, from closed-source, to open-source, can sometimes be an effective security solution: if you find people are stealing your software, just give it away for free, and charge for customisation and support?

... 

One more thing. Businesses and governments will usually find the
solutions they want because they can afford them, whether they are
right or wrong. It is individuals who need solutions from places likes

this forum and from developers of open software/hardware.  ... 

Here in the UK, we have a pretty effective democracy where different groups (including the general public) can lobby the government. As such, the general public can lobby the government in order to get the government to provide more effective cyber-security resources for the general public. Not sure about America or India (India is perhaps where you are based?). America are strong democracy advocates and India has the largest democracy, but I don't know whether their democracies are in reality broken systems....

 

Kind regards,

Mark Fernandes

[Anil]

> APOLOGIES FOR GOING OFF TOPIC SOMEWHAT. SHOULD WE MOVE THIS DISCUSSION TO A DIFFERENT THREAD?

Perhaps we should, but this seems to be as good a forum as any other.

> privacy. But for me, and probably many others, this rates fairly low in my mind. What is more important, is security: security that your
> communications have not undergone tampering, security that your money isn't being stolen, security that no-one is fiddling with your online
> accounts, etc. Privacy is also important, but only as a part of the overall aim of achieving security.

It depends on the place where you live and the conditions with regard
to surveillance etc. there. If the government/corporation don't see
you as a risk (which you can only guess, because you are not told or
supposed to be told), then security from petty criminals is the major
concern. If they do see as a risk (for whatever reason or some red
flag raised by some algorithm or whatever else that is possible
today), then it's a different matter and privacy is as important as
security, if not more.

In my opinion, privacy by itself is a basic right, like human rights.
Even with human rights, what I said above applies. As long as your
behaviour or profile or record or even credit rating (think of China,
for example) doesn't make the powers that be unhappy, human rights
don't matter. Otherwise they do. One always has the option to make
oneself compatible with what the powers that be want one to be. Then
there isn't much risk, in a way, except from petty criminals, because
the definition of risk has been narrowed down.

> these forums are dedicated to a particular piece of technology, and because most subscribers are likely technology specialists. It's good to have
> lateral experience of different domains, and also to bring-in people who aren't technology specialists, so that their creative input can add extra
> value to the discussions.

I am from the technology domain by education and by profession/job,
just not in the OS or Linux or network security domain.

> One thought I've had is that changing business models, from closed-source, to open-source, can sometimes be an effective security solution: if
> you find people are stealing your software, just give it away for free, and charge for customisation and support?

That seems to be the best way, although as of today it is that
successful. It goes back to politics etc.

> Here in the UK, we have a pretty effective democracy where different groups (including the general public) can lobby the government. As such,
> the general public can lobby the government in order to get the government to provide more effective cyber-security resources for the general
> public. Not sure about America or India (India is perhaps where you are based?). America are strong democracy advocates and India has the
> largest democracy, but I don't know whether their democracies are in reality broken systems....

I don't want to say much on this, but enough information is available
online. All I can say is that, India, like in almost everything, is in
a class by itself. It is also one of the most affected by the repeated
states of exception, some global, some local, in the sense of
Surveillance Capitalism, very closely tied to the state, across the
political spectrum. In theory, privacy has recently been declared a
fundamental right by the courts, but theory is just theory. Sometimes
it furthers in practice the exact opposite of what it says, because
you can always point to the theory and say everything is alright and
the concerns are unwarranted etc.

Now there is another unprecedented state of exception and the signs of
what is to come are already there.