Re: Comparison to Qubes OS

[Michael Raskin <7c6f434c@mail.ru>]

>> >   - "GUI applications are buggy, command line tools
>> > are mostly
>> >    undocumented": I assume that the reason for this is the lack of
>> >    resources the Qubes project has. However, I don't see how this will be
>> >    be better in the case of Spectrum which is a new project with one
>> >    developer. 
>> My understanding is that a lot of the instability I've encountered with
>> Qubes's tools comes down to some severe technical debt with their
>> inter-VM communication system.  This is likely something that is very
>> difficult to fix, but easy to learn from.  Being a new project allows
>> Spectrum to learn from Qubes' mistakes.
>I agree, but I'm still not convinced this will be different in the case of Spectrum, having even more limited dev resources than Qubes'. I mean, if the Qubes folks could fix these issues without a
>huge effort, even if it
>meant rewriting all the inter-VM communication tools, they probably would. If they didn't, I assume this is because this is just a huge undertaking (as is the whole project), and they're busy with other work which has higher priority. I would assume that you will end up in exactly the same situation.

Note that SpectrumOS is going to make tradeoffs that are complete non-starters for Qubes. A wl_roots based tooling is seriously considered for the first full release, after all??? A lot of problems for Qubes is that things are hard to do without making security slightly worse than what Qubes has now. Spectrum is definitely not going to achieve this level of security anytime soon for various reasons, and the goal is more to find the best trade-off between security and usability. 

There is quite a bit of design space in the gap between ??quite a bit more secure than Firejail, with the ease of use around plain NixOS plus Firejail?? and ??less secure than Qubes, but easier to manage??.