-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 On 2017-03-11 19:41, Unman wrote: > On Sat, Mar 11, 2017 at 08:47:05PM -0500, Chris Laprise wrote: >> On 03/11/2017 11:56 AM, Unman wrote: >>> On Sat, Mar 11, 2017 at 04:43:41PM +0000, sm8ax1 wrote: >>>> 7v5w7go9ub0o: >> >>>>> >>>>> Yep! And ISTM this is an argument for using dispvms to >>>>> handle mail (or any other WAN-exposed client/server): >>>>> start a dispvm; copy mail client and mail "file" into it; >>>>> do your mail; copy out and save the updated mail file >>>>> (which is text); flush away the dispvm - all handled by a >>>>> script(s). >>>> >>>> How do you figure that's less of a pain in the ass than >>>> typing a sudo password? >>>> >>> >>> You're missing the point - that procedure is trivial to set up >>> in Qubes and addresses real security concerns. Just putting a >>> password on root access, or requiring some dom0 interaction >>> doesn't. >>> >>> This is important - security IS a pain in the ass. Qubes can >>> make it less so. >>> >> >> Yes, sm8ax1 got you there. :) >> >> DispVMs are nice to have when we think that certain operations >> carry threats. But its ridiculous to expect a typical user to do >> a majority of their tasks in them. >> > > No, it isn't ridiculous to expect a typical user to work in > disposableVMs. I've set up a number of users with a range of > experience, and they are very comfortable with this. If the > implementation is kept hidden generally speaking everything goes > fine. Some scripting to make things easier, and support is > probably no greater than usual ,except for "that funny copy thing". > I've said this before. > > Set up right I don't think that Qubes is outrageously difficult to > use, even with disposableVMs doing most of the heavy lifting. But > that's a separate issue. >
I'd be interested in hearing more about this (in a separate thread, perhaps). In particular, no one has, to my knowledge, attempted to rebut the arguments I advanced against the "doing everything in DispVMs" approach here: https://groups.google.com/d/msg/qubes-users/nDrOM7dzLNE/Kr5W3BUkcG4J Granted, that was almost two years ago, and some of the things I wrote there no longer apply. However, I still haven't seen a strong case made *in favor* of this approach to begin with. I would like to see one. - -- Andrew David Wong (Axon) Community Manager, Qubes OS https://www.qubes-os.org -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJYxUL0AAoJENtN07w5UDAwhCUQAMFb7DXeC/hp2j9jtTFKJHWR vgcFSGa9TJK5aTdieKEuNfyaAgBfdmSlMNuDlCiWPe/Hk0Sx+/4t4pxthB59y0YS NgGMwzOek1oBrdTaUOHhJluICo8Hg2I4w4AmhngBJ+osxRuT2keQyIije9nqV1Ya ojbVbql49hRCa67GY9sYchUe3vi6L378WtE7wbT8AGoUIktvWQBb3dkdiOBb+yWI OxDX8p52spOB3jnDd4ZrZe0GNmLFaISenJq1ygKSNRByh+qg1igwGT+WGRJSA+su UxdqLB19WQgKyZux2uM0J1k7sy5n+ghK5wFm+wwmdx9tupw1uos4O5lKvNPcp+Ym QyBM/u3drQpBmXmCxVARG39nuOZRrc0Ui7rJJ6F+yttcv1gmE3OciPtrNktvm3f2 5EZ/4a/Wa7V8Rv4wlhZBoDffmwwklTJvZeoVmtwieFgbiL8fe3IHisa1vBQlnOSR 2QIbpdW+nUs1y4TxLxzAegT6bOk22+2ziVBv4BWg+Z5qbJxU4jAHzPZWb0iSg0qv w1NjlL59FMeSyDO5/uNxbQ9cgHn3FPvkk1hhqFMzWQq4hyUVBYEE6pAlsge5w7TC F5Q+ufkcWojDsv21ivwyP91wdU2i4sjnEXl1w4eAt2ZqlwIKZIh6qk3khN2hom+U TXU/T0QNYo5WY7SbEu8n =5DPd -----END PGP SIGNATURE----- -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/aa477d20-14c9-4c82-b84b-a93f3b801b54%40qubes-os.org. For more options, visit https://groups.google.com/d/optout.
