Re:Qubes Air: Generalizing the Qubes Architecture
by robryk on Monday January 29, 2018 @03:22AM
(#16256148)
You can put the untrusted VMs in the cloud, to get better isolation between them and more important stuff. This, e.g., is a way of preventing two colluding VMs from communicating.
[ Parent
| on HN ]
Re:Qubes Air: Generalizing the Qubes Architecture
by masklinn on Monday January 29, 2018 @04:23AM
(#16256384)
That's a very interesting take, you can run local network for trusted qubes and put more risky/untrusted qubes on "cloud" VMs, that way you strongly mitigate colluding VMs (same-machine & same-network) and VM excursion attacks on your hypervisors & physical machines.