Taskbar Widget Devices: Label devices

[RefinedSoftwareLLC]

Qubes OS version:

R4.0

Affected component(s):

dom0's taskbar widget "devices" (the yellow one)

---

Steps to reproduce the behavior:

Click on dom0's taskbar widget "devices" (the yellow one).
Some devices are easy to read, like "Microphone" or "sys-usb".
Others are not, as I can only tell which one is my DVD player when I recognize the label of the DVD in the drive.

Expected behavior:

Ability to tell which device is which.
This could be solved with the first menu option when you hover over a device, instead of being attach to a VM, is "Change device label" or "Change device note". This would let you change "Microphone" to "Desk Mic".
If this brings up security concerns, then do not remove any of the current info, just add the label in grey font, maybe like "(Note: mylabel)".

[RefinedSoftwareLLC]

In Qubes 4.0, this is accomplished with the Devices Widget located in the tool tray (default top right corner, look for an icon with a yellow square). From the top part of the list, click on the drive you want to attach, then select the qube to attach it to. Although you can also attach the entire USB device to a qube by selecting it from the bottom part of the list, in general this approach should not be used because you are exposing the target qube to unnecessary additional attack surface.

There should be a clear label in plain English of what is a USB drive verses the what is an entire USB device. Maybe "[files]" and "[device]". If you use the Devices Widget try to attach the "[device]", give a security popup:

Attaching the entire USB [device] will expose this qube to an 
unnecessary additional attack surface. It is recommended that you 
attach the USB [files] instead. Are you sure you want to continue?
<USB [device]>
<vm-name>
[Cancel]    [Continue]

@andrewdavidwong Should I open a new issue for this security improvement?

[RefinedSoftwareLLC]

In Qubes 4.0, this is accomplished with the Devices Widget located in the tool tray (default top right corner, look for an icon with a yellow square). From the top part of the list, click on the drive you want to attach, then select the qube to attach it to. Although you can also attach the entire USB device to a qube by selecting it from the bottom part of the list, in general this approach should not be used because you are exposing the target qube to unnecessary additional attack surface.

There should be a clear label in plain English of what is a USB drive verses the what is an entire USB device. Maybe "[files]" and "[device]". If you use the Devices Widget try to attach the "[device]", give a security popup:

Attaching the entire USB [device] will expose this qube to an 
unnecessary additional attack surface. It is recommended that you 
attach the USB [files] instead. Are you sure you want to continue?
<USB [device]>
<vm-name>
[Cancel]    [Continue]

@andrewdavidwong Should I open a new issue for this security improvement?

[andrewdavidwong]

Should I open a new issue for this security improvement?

Yes, but I don't understand the distinction. Is it between a USB controller and a USB device? To me, "USB files" just means files residing in the filesystem of a USB mass storage device, but those aren't the sorts of things that can be attached to a qube.

[andrewdavidwong]

Should I open a new issue for this security improvement?

Yes, but I don't understand the distinction. Is it between a USB controller and a USB device? To me, "USB files" just means files residing in the filesystem of a USB mass storage device, but those aren't the sorts of things that can be attached to a qube.

[marmarta]

Well, I'm really not convinced about that - in most cases, devices are labeled (if you connect a storage device, you get its label in parentheses, which is pretty much the industry standard for drives - if I connect a USB device to windows, it will just show me as [my label] [some letter], pretty much the same is true (I believe, although I don't use it that much) of OSX), and with regards to the microphone, there's only one, actually - the one that's connected to audio-out, as configured by PulseAudio in dom0.

[marmarta]

Well, I'm really not convinced about that - in most cases, devices are labeled (if you connect a storage device, you get its label in parentheses, which is pretty much the industry standard for drives - if I connect a USB device to windows, it will just show me as [my label] [some letter], pretty much the same is true (I believe, although I don't use it that much) of OSX), and with regards to the microphone, there's only one, actually - the one that's connected to audio-out, as configured by PulseAudio in dom0.