<story><title>Introducing Qubes 1.0 (&quot;a stable and reasonably secure desktop OS&quot;)</title><url>http://theinvisiblethings.blogspot.com.br/2012/09/introducing-qubes-10.html</url><text></text></story><parent_chain><item><author>ChuckMcM</author><text>Actually folks on HN &lt;i&gt;are&lt;/i&gt; interested in secure operating systems but they recognize that creating such is a Hard Problem (tm) which someone who is an unknown [1] in the field is unlikely to have achieved.&lt;p&gt;Now you can read up on Mark Miller&apos;s published papers [2] on Joule (actually pretty secure) and some of the issues associated with making things secure and get a much better feeling of solidity (for example).&lt;p&gt;So when the press release comes out that its passed the Defense department&apos;s B1/B2 review, then I suspect it will get a lot of interest here and else where.&lt;p&gt;[1] &lt;a href=&quot;http://www.linkedin.com/profile/view?id=10279027&quot; rel=&quot;nofollow&quot;&gt;http://www.linkedin.com/profile/view?id=10279027&lt;/a&gt; LinkedIn profile, one job CEO of this thing? A blog full of black hat sort of exploits but I didn&apos;t see any peer reviewed work.&lt;p&gt;[2] &lt;a href=&quot;http://research.google.com/pubs/author35958.html&quot; rel=&quot;nofollow&quot;&gt;http://research.google.com/pubs/author35958.html&lt;/a&gt;&lt;p&gt;[3] &lt;a href=&quot;http://en.wikipedia.org/wiki/Trusted_Computer_System_Evaluation_Criteria&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Trusted_Computer_System_Evaluat...&lt;/a&gt;</text></item><item><author>sbierwagen</author><text>Previously:&lt;p&gt;&lt;a href=&quot;http://news.ycombinator.com/item?id=1246990&quot; rel=&quot;nofollow&quot;&gt;http://news.ycombinator.com/item?id=1246990&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;http://news.ycombinator.com/item?id=2645170&quot; rel=&quot;nofollow&quot;&gt;http://news.ycombinator.com/item?id=2645170&lt;/a&gt;&lt;p&gt;This story won&apos;t see much traction on HN. The cult of Mac is too strong, and HN users generally aren&apos;t interested in secure operating systems.</text></item></parent_chain><comment><author>tptacek</author><text>Joanna Rutkowska is famous in computer security circles and highly credible on this particular topic.&lt;p&gt;The &quot;black hat sorts of exploits&quot; attributed to her tend to be things like, &quot;abusing odd, barely-documented corners of x86 chipsets to bypass hardware-encrypted trusted boot roots&quot;. Thinking less of a professional in my field for having exploits attributed to them tends to be a bad idea, but it&apos;s a &lt;i&gt;uniquely&lt;/i&gt; bad idea in Rutkowska&apos;s case.&lt;p&gt;Outside of conference presentations, Rutkowska doesn&apos;t have much peer-reviewed work in the literature. That&apos;s because Rutkowska is originally from the malware/rootkit/virus part of the industry. For obvious reasons, antivirus doesn&apos;t generate a lot of peer-reviewed academic research. One of those obvious reasons is that they&apos;re too busy printing money hats to bother. (This to my chagrin; I am very much &lt;i&gt;not&lt;/i&gt; from the AV/malware part of the field).&lt;p&gt;I&apos;m not vouching for Qubes or even saying that I think the approach (of semi-transparently allocating secure VMs for each application or trust domain on the system) is viable. But Rutkowska is worth taking seriously.</text></comment>
<story><title>Introducing Qubes 1.0 (&quot;a stable and reasonably secure desktop OS&quot;)</title><url>http://theinvisiblethings.blogspot.com.br/2012/09/introducing-qubes-10.html</url><text></text></story><parent_chain><item><author>ChuckMcM</author><text>Actually folks on HN &lt;i&gt;are&lt;/i&gt; interested in secure operating systems but they recognize that creating such is a Hard Problem (tm) which someone who is an unknown [1] in the field is unlikely to have achieved.&lt;p&gt;Now you can read up on Mark Miller&apos;s published papers [2] on Joule (actually pretty secure) and some of the issues associated with making things secure and get a much better feeling of solidity (for example).&lt;p&gt;So when the press release comes out that its passed the Defense department&apos;s B1/B2 review, then I suspect it will get a lot of interest here and else where.&lt;p&gt;[1] &lt;a href=&quot;http://www.linkedin.com/profile/view?id=10279027&quot; rel=&quot;nofollow&quot;&gt;http://www.linkedin.com/profile/view?id=10279027&lt;/a&gt; LinkedIn profile, one job CEO of this thing? A blog full of black hat sort of exploits but I didn&apos;t see any peer reviewed work.&lt;p&gt;[2] &lt;a href=&quot;http://research.google.com/pubs/author35958.html&quot; rel=&quot;nofollow&quot;&gt;http://research.google.com/pubs/author35958.html&lt;/a&gt;&lt;p&gt;[3] &lt;a href=&quot;http://en.wikipedia.org/wiki/Trusted_Computer_System_Evaluation_Criteria&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Trusted_Computer_System_Evaluat...&lt;/a&gt;</text></item><item><author>sbierwagen</author><text>Previously:&lt;p&gt;&lt;a href=&quot;http://news.ycombinator.com/item?id=1246990&quot; rel=&quot;nofollow&quot;&gt;http://news.ycombinator.com/item?id=1246990&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;http://news.ycombinator.com/item?id=2645170&quot; rel=&quot;nofollow&quot;&gt;http://news.ycombinator.com/item?id=2645170&lt;/a&gt;&lt;p&gt;This story won&apos;t see much traction on HN. The cult of Mac is too strong, and HN users generally aren&apos;t interested in secure operating systems.</text></item></parent_chain><comment><author>rdl</author><text>Invisible Things is pretty well respected in the trusted computing space (at least among the hacker world, not the DoD certification world)&lt;p&gt;SKPP pretty much sucked off all the &quot;paper-writing industry&quot; folks a few years ago into a kind of boring niche.  Mark Miller is a big exception to that, but it&apos;s not a really vibrant research area compared to other parts of security now.</text></comment>