Network is a single point of failure

[v6ak]

Imagine a vulnerability in Linux kernel networking stack that allows remote code execution. Qubes is in many setups almost unprotected against such vulnerability, as attacks might be cascaded from sys-net to all other VMs.

Although this is non-trivial, I suggest running some BSD OS in NetVM, that would diversify the ecosystem and thus make such attacks harder.

[marmarek]

Take a look at #806

[marmarek]

Take a look at #806

[marmarek]

Also it applies only to networked VMs. You can have offline VMs - for example gpg backend.

[marmarek]

Also it applies only to networked VMs. You can have offline VMs - for example gpg backend.

[v6ak]

I must have overlooked the issue you are referencing :-(

Yes, it applies only for network connected VMs, but this still includes sys-firewall and subsequently also any TemplateVM, so it also consequently affects all non-standalone VMs, even if they have no network connection.

[v6ak]

I must have overlooked the issue you are referencing :-(

Yes, it applies only for network connected VMs, but this still includes sys-firewall and subsequently also any TemplateVM, so it also consequently affects all non-standalone VMs, even if they have no network connection.