It's nearly worth it for avoiding Google's terrible account switching UX alone :)

I've been using QubesOS as my daily dev machine for a couple of years now. No regrets. I really like that I've set up each of my clients' work in their own VMs, so there's no way one can pollute the other.

Switching back to macOS is a relief for some tasks, but it feels dirty smudging all my different types of task into the one OS again.

That's right.

> but the idea that it easy to get inside vm keeps me from doing it

No! Of course the host is the ultimate dictator. Just don't do untrusted operations in the host context. Have low-trust, low-connectivity, low resource level VM for untrusted work.

Most VM escapes happen through buggy virtual-devices written in C/C++/.. code. Virtual-device bugs that are exploitable by attackers with root access in the VM are found frequently.

This makes me wonder how many security holes CPUs have which have been buried into secrecy by the manufacturers.

An attacker would need to do some quite invasive hardware tampering to get a third party hypervisor to work on a system secured like that.

Furthermore, preventing hypervisor detection requires constant updates if the OS itself is configured to check for the presence of a hypervisor. There's a constant arms race going on between security researchers and cybercriminals who don't want their malware to trigger on analysts' machines, many of which use virtualization to easily reset the system back to a known, secure state. Every time malware comes up with a new method of detection your evil hypervisor needs to be patched to fake that stuff too or you risk detection next time the OS updates its detection algorithms.

See also: https://forum.qubes-os.org/t/verified-boot-on-qubes-a-lofty-...