0.3 qubes-os-summit-2022 2022-09-09 2022-09-11 3 00:05 https://cfp.3mdeb.com Europe/Berlin Main Room Speaker at location 2022-09-09T10:00:00+02:00 10:00 00:25 Let's say hi to each other and talk about: * Qubes Summit history * What changed since the last event * Event schedule and organization announcements * Shout out to sponsors qubes-os-summit-2022-17-welcome-to-qubes-os-summit-2022-day-1 Piotr Król en false https://cfp.3mdeb.com/qubes-os-summit-2022/talk/GQHEES/ https://cfp.3mdeb.com/qubes-os-summit-2022/talk/GQHEES/feedback/ Main Room Speaker at location 2022-09-09T10:30:00+02:00 10:30 00:30 This talk is a summary of projects Qubes team currently works on, and a rough roadmap for Qubes OS 4.2. qubes-os-summit-2022-5-qubes-os-development-status-update Marek Marczykowski-Górecki en false https://cfp.3mdeb.com/qubes-os-summit-2022/talk/ELU3FR/ https://cfp.3mdeb.com/qubes-os-summit-2022/talk/ELU3FR/feedback/ Main Room Speaker at location 2022-09-09T11:10:00+02:00 11:10 00:40 SecureDrop Workstation is a new and improved front-end for journalists using SecureDrop. It was built on top of Qubes OS and relies heavily on its features and security properties. In this talk, we'll introduce the system and discuss some lessons learned by treating Qubes OS as a framework for secure multi-VM applications. qubes-os-summit-2022-13-building-secure-applications-with-qubes-os Michael Z en false Slides https://cfp.3mdeb.com/qubes-os-summit-2022/talk/WFVXPP/ https://cfp.3mdeb.com/qubes-os-summit-2022/talk/WFVXPP/feedback/ Main Room Speaker at location 2022-09-09T12:00:00+02:00 12:00 00:20 In this talk, we will present the second generation of the Qubes OS builder. This new builder leverages container or disposable qube isolation to perform every stage of the build and release process. From fetching sources to building them, everything is executed inside a "cage" (either a disposable or a container) with the help of what we call an "executor." For every command that needs to perform an action on sources, like cloning and verifying Git repos, rendering a SPEC file, generating SRPM or Debian source packages, a new cage is used. The global architecture will be presented and demonstrations on how to use this new build system will be made. qubes-os-summit-2022-4-next-generation-of-qubes-os-builder Frédéric Pierret en false https://cfp.3mdeb.com/qubes-os-summit-2022/talk/GV3J3E/ https://cfp.3mdeb.com/qubes-os-summit-2022/talk/GV3J3E/feedback/ Main Room Speaker at location 2022-09-09T12:30:00+02:00 12:30 00:30 Enterprises are usually a domain of Windows-only systems and users. We will present how Qubes could be tailored to meet requirements of enterprises which rely on Windows but at the same time provide a "reasonable secure system" based on Qubes. A key requirement is to achieve a system which is usable for users with ordinary Windows experience. Therefore key is the integration of a Windows VM within Qubes OS. qubes-os-summit-2022-27-tailoring-qubes-for-enterprises Jan Suhr en false https://cfp.3mdeb.com/qubes-os-summit-2022/talk/XD7NL7/ https://cfp.3mdeb.com/qubes-os-summit-2022/talk/XD7NL7/feedback/ Main Room Speaker at location 2022-09-09T13:10:00+02:00 13:10 00:50 Lunch break qubes-os-summit-2022-29-lunch-break Break en false https://cfp.3mdeb.com/qubes-os-summit-2022/talk/NXBR97/ https://cfp.3mdeb.com/qubes-os-summit-2022/talk/NXBR97/feedback/ Main Room Speaker at location 2022-09-09T14:00:00+02:00 14:00 00:30 A brief overview of the current state of Qubes OS policy tools, the in-development graphical policy editor / configuration editor, the process of simplifying the complexities of policy configuration and design and implementation challenges. qubes-os-summit-2022-8-qubes-os-policy-adventures-in-ux-ui-design Marta "marmarta" Marczykowska-Górecka en As a continuation of last year's redesign of Application Menu, I have been working on making Qubes more accessible for non-expert users and on creating GUI tools for system configuration that would be friendlier and easier-to-use than existing tools. This time, I took on the challenge of creating a graphical editor for various policy files. This talk will cover the results of user research, the challenges encountered during design and implementation, and show off the tools created as a result of this research. false https://cfp.3mdeb.com/qubes-os-summit-2022/talk/38K7H7/ https://cfp.3mdeb.com/qubes-os-summit-2022/talk/38K7H7/feedback/ Main Room Speaker at location 2022-09-09T14:40:00+02:00 14:40 00:30 GVM is a GPU Virtual Machine built by the OpenMdev Project for IOMMU-capable computers such as x86 and ARM. qubes-os-summit-2022-12-gpu-virtual-machine-gvm /media/qubes-os-summit-2022/submissions/QBU3JN/GVM_docs_white_irlC7Fu.png Arthur Rasmusson en In this talk OpenMdev developers Arthur Rasmusson and Michael Buchel plan to give an overview of GPU Virtual Machine (GVM) and how it works to allow virtual machine guests to run unmodified GPU drivers (non-paravirtual) on ordinary GPUs such as those in laptops, desktops, embedded devices, and servers. We’d also like to take some time to talk about ongoing efforts to improve support for devices and areas of collaboration where we might best provide support to QubesOS for integrating OpenMdev tools like GVM for enhanced GPU virtualization. false https://cfp.3mdeb.com/qubes-os-summit-2022/talk/QBU3JN/ https://cfp.3mdeb.com/qubes-os-summit-2022/talk/QBU3JN/feedback/ Main Room Speaker at location 2022-09-09T15:20:00+02:00 15:20 00:30 Could Qubes OS replace its custom GUI isolation protocol with Wayland while staying as performant and secure? With the advent of Wayland, many strides have been made in the desktop Linux space, limiting the effects a malicious application can have. Gone are the days of every application being able to snoop every keypress! This presentation will dive into the differences between X and Wayland, and why it makes for a great fit in isolating operating systems like Qubes OS and Spectrum. qubes-os-summit-2022-22-isolating-guis-with-the-power-of-wayland Puck Meerburg en false https://cfp.3mdeb.com/qubes-os-summit-2022/talk/ZY8KHW/ https://cfp.3mdeb.com/qubes-os-summit-2022/talk/ZY8KHW/feedback/ Main Room Speaker at location 2022-09-09T16:00:00+02:00 16:00 00:30 Qubes OS currently has poor support for audio and video capture. Audio capture works if used properly, but is easy to misuse and its latency is excessive. Video capture is not supported except via device pass-through, which raises serious security concerns. This talk is about replacing the legacy PulseAudio-based solution with a modern PipeWire-based one, and replacing camera pass-through with Qubes Video Companion. qubes-os-summit-2022-15-pipewire-and-qubes-video-companion Demi Marie Obenour en Audio capture and playback in Qubes OS has several limitations. It is very easy to forget to attach a microphone to a qube, or to forget to detach it later. Furthermore, the latency is high, and both recording and playback require a module using the unstable PulseCore API. I am currently replacing the audio agent with a solution based on PipeWire, which will offer better performance and be easier to maintain. In the future, I plan on enhancing the user interface to avoid the user experience pitfalls. Video capture has significant limitations as well. The only currently-supported solution is webcam pass-through, which has both security and reliability concerns. Cross-VM screensharing is not supported at all. Elliot Killick created Qubes Video Companion in April 2021, and I have been working to integrate it into Qubes OS. It will ship with R4.2 and I hope to backport it to R4.1. false https://cfp.3mdeb.com/qubes-os-summit-2022/talk/JKWNGD/ https://cfp.3mdeb.com/qubes-os-summit-2022/talk/JKWNGD/feedback/ Main Room Speaker at location 2022-09-09T16:40:00+02:00 16:40 01:00 ... qubes-os-summit-2022-24-design-session-graphical-subsystem-gpu-wayland Marek Marczykowski-Górecki en false https://cfp.3mdeb.com/qubes-os-summit-2022/talk/9XR3K3/ https://cfp.3mdeb.com/qubes-os-summit-2022/talk/9XR3K3/feedback/ Main Room Speaker at location 2022-09-09T17:50:00+02:00 17:50 00:10 Closing notes qubes-os-summit-2022-26-qubes-os-summit-2022-day-1-closing-notes Piotr Król en false https://cfp.3mdeb.com/qubes-os-summit-2022/talk/XGMQYH/ https://cfp.3mdeb.com/qubes-os-summit-2022/talk/XGMQYH/feedback/ Main Room Speaker at location 2022-09-09T19:30:00+02:00 19:30 04:00 Afterparty at Südblock (Admiralstr. 1-2, https://www.suedblock.org/) qubes-os-summit-2022-33-afterparty Break en false https://cfp.3mdeb.com/qubes-os-summit-2022/talk/3FUFUS/ https://cfp.3mdeb.com/qubes-os-summit-2022/talk/3FUFUS/feedback/ Main Room Speaker at location 2022-09-10T10:00:00+02:00 10:00 00:10 * Day 2 event schedule and organization announcements * Shout out to sponsors qubes-os-summit-2022-18-welcome-to-qubes-os-summit-2022-day-2 Piotr Król en false https://cfp.3mdeb.com/qubes-os-summit-2022/talk/D3XFP9/ https://cfp.3mdeb.com/qubes-os-summit-2022/talk/D3XFP9/feedback/ Main Room Speaker at location 2022-09-10T10:20:00+02:00 10:20 00:15 NovaCustom has previously experienced a number of problems related to the proprietary firmware of the laptop. In this talk, we will present three cases in which Dasharo open source coreboot based firmware has played an important role. - The first case is about the desire for a modified fan curve. - The second case study concerns an application where the customer asked whether it is possible to disable certain CPU options, which turned out to be necessary for audio production. - The third case is about the implementation of an own startup logo in the firmware. In addition, there will be an explanation of the security aspects of the Dasharo firmware that NovaCustom has recently started using. Thanks to the growing active Dasharo community, the firmware can be increasingly optimised to the needs of our users. Although Qubes OS already has a number of certified laptop models, their hardware is often quite old. The need for newer hardware that is fully compatible with Qubes OS is there, and this is where NovaCustom could play a role with certified hardware and firmware that is fully adapted with the Qubes OS operating system. qubes-os-summit-2022-1-how-dasharo-coreboot-based-firmware-helps-novacustom-s-customers Wessel klein Snakenborg en false https://cfp.3mdeb.com/qubes-os-summit-2022/talk/VD3VCE/ https://cfp.3mdeb.com/qubes-os-summit-2022/talk/VD3VCE/feedback/ Main Room Speaker at location 2022-09-10T10:45:00+02:00 10:45 00:30 Talk about the Experince of User Support for Qubes at Nitrokey. qubes-os-summit-2022-23-qubes-user-support-stories nestire en Qubes is the most common operation system we preinstall on our products. Based on that, we have a lot of support questions. We want to share our experience with that. What are the most common problems? Where lying the biggest security traps for users? What needs to be done to enable user who really should use Qubes. false https://cfp.3mdeb.com/qubes-os-summit-2022/talk/TUHNPU/ https://cfp.3mdeb.com/qubes-os-summit-2022/talk/TUHNPU/feedback/ Main Room Speaker at location 2022-09-10T11:30:00+02:00 11:30 00:30 Let us attend to the past, present & future development of localizing the official Qubes OS Documentation. qubes-os-summit-2022-16-qubes-os-documentation-localization mTobias Killer en The topic of this talk is the localization of the official Qubes OS documentation (Github [repo](https://github.com/QubesOS/qubes-doc)) and will cover the steps already taken, the current status and the future tasks. We will take a look at the tech stack and the tools used to build the proposed localization workflow and will wrap up with outlook, next steps and call for participation :) The ultimate goal of the endeavour is continuous localization and thus delivering quality translations quickly and reliably. false https://cfp.3mdeb.com/qubes-os-summit-2022/talk/EZ37TZ/ https://cfp.3mdeb.com/qubes-os-summit-2022/talk/EZ37TZ/feedback/ Main Room Speaker at location 2022-09-10T12:10:00+02:00 12:10 00:30 There are very few desktop platforms that are user-controllable through open-source firmware. Moreover, they haven't necessarily been tested with Qubes OS. However, the recent initiative to port a modern Alder Lake desktop to coreboot opened a new door for privacy and security respecting machine capable of running Qubes OS. In this presentation, a demo of Dasharo[1] distribution compatible with Alder Lake-S desktop MSI PRO Z690-A WIFI DDR4 running Qubes OS will be shown. The presenter will also describe new updates to Dasharo firmware and challenges awaiting in future development. Also it will be discussed how Dasharo plans to meet the future Qubes certification requirements[2] and approaches the openness of the firmware based on Dasharo Openness Score of various supported platforms. [1] https://dasharo.com/ [2] https://groups.google.com/g/qubes-devel/c/08uSf2i-FTo/m/ii9DpjQ-AgAJ qubes-os-summit-2022-9-qubes-os-on-modern-alder-lake-desktop /media/qubes-os-summit-2022/submissions/QXZBDZ/dasharo_qubes_5ev4eoK.png Michał Żygowski en false Slides https://cfp.3mdeb.com/qubes-os-summit-2022/talk/QXZBDZ/ https://cfp.3mdeb.com/qubes-os-summit-2022/talk/QXZBDZ/feedback/ Main Room Speaker at location 2022-09-10T12:50:00+02:00 12:50 01:10 Lunch break qubes-os-summit-2022-30-lunch-break Break en false https://cfp.3mdeb.com/qubes-os-summit-2022/talk/FKADXK/ https://cfp.3mdeb.com/qubes-os-summit-2022/talk/FKADXK/feedback/ Main Room Speaker at location 2022-09-10T14:00:00+02:00 14:00 00:30 Following up on last year's presentation, deeplow presents the final work for his contribution proposal for an integrated onboarding tutorial for Qubes OS. qubes-os-summit-2022-2-qubes-os-towards-being-a-reasonably-learnable-system /media/qubes-os-summit-2022/submissions/PCXEHT/step_1_Dep014f.png Deeplow en true https://cfp.3mdeb.com/qubes-os-summit-2022/talk/PCXEHT/ https://cfp.3mdeb.com/qubes-os-summit-2022/talk/PCXEHT/feedback/ Main Room Speaker at location 2022-09-10T14:40:00+02:00 14:40 00:30 Qubes OS Anti Evil Maid (AEM)[1] heavily depends on the availability of the Dynamic Root of Trust for Measurement (D-RTM) technologies to prevent the Evil Maid attacks[2]. However, the project hasn't evolved much since the beginning of 2018 and froze on the support of TPM 1.2 with Intel TXT in legacy boot mode (BIOS). Because of that, the usage of this security software is effectively limited to older Intel machines only. Some attempts were already made to support AMD and TPM 2.0 by 3mdeb[3], however the work suffered from lack of business justification and stopped at porting AEM scripts to use TPM 2.0. But a successfull demo of AMD D-RTM with Qubes OS has been shown on Qubes OS minisummit 2020[4]. This year the efforts are traditionally continued. The presentation will describe the project plan of improving and extending the Qubes OS AEM with TrenchBoot[5] covering both Intel and AMD hardware, TPM 1.2 and 2.0. The goal is to unify the D-RTM early launch and Anti Evil Maid software to secure the Qubes OS boot process for basically any hardware device (as long as it supports the required technologies). The presenter will give detailed overview of project phases and tasks to be fulfilled as well as the cost outline. At the end a short demo of Qubes OS AEM with TrenchBoot on Dell OptiPlex 7010/9010 with Intel TXT and TPM1.2 will be shown. [1] https://blog.invisiblethings.org/2011/09/07/anti-evil-maid.html [2] https://theinvisiblethings.blogspot.com/2009/10/evil-maid-goes-after-truecrypt.html [3] https://github.com/3mdeb/qubes-antievilmaid-amd/pull/1/files [4] https://www.youtube.com/watch?v=rM0vRi6qABE [5] https://trenchboot.org/ qubes-os-summit-2022-10-trenchboot-the-only-aem-way-to-boot-qubes-os /media/qubes-os-summit-2022/submissions/3PTQJU/dasharo_trenchboot_29LoeDU.png Michał Żygowski en The firmware is the heart of the security of a given system and should always be up-to-date to maintain the computer's security. However, being up to date does not prevent the firmware vulnerabilities from appearing. The Static Root of Trust (SRT) like Unified Extensible Firmware Interface (UEFI) Secure Boot and measured boot provided by the firmware is not always sufficient to establish a secure environment for an operating system. If the firmware is compromised, it could inject malicious software into operating system components and prevent the machine owner from detecting it. Silicon vendors implement alternative technologies to establish a Dynamic Root of Trust (DRT) to provide a secure environment for operating system launch and integrity measurements. Either from SRT or DRT, these integrity measurements can be used for operating system attestation. However, DRT technologies are designed to provide the ability to establish a secure environment for integrity measurements at any arbitrary point of time instead of relying on the firmware, which requires machine reset to establish the aforementioned secure environment. The usage of Dynamic Root of Trust technologies like Intel Trusted Execution Technology (TXT) or AMD Secure Startup becomes more and more significant, for example, Dynamic Root of Trust for Measurement (D-RTM) requirements of Microsoft Secured Core PCs[6]. D-RTM hasn't found its place in open-source projects yet, but that gradually changes. The demand on having firmware independent Roots of Trust is increasing, and projects that satisfy this demand are growing, for instance, TrenchBoot. TrenchBoot is a framework that allows individuals and projects to build security engines to perform launch integrity actions for their systems. The framework builds upon Boot Integrity Technologies (BITs) that establish one or more Roots of Trust (RoT) from which a degree of confidence that integrity actions were not subverted. The project has grown a lot thanks to the previous NLnet NGI0 PET[7] grant and now it looks for further expansion into extensive use of the DRT technologies in open-source and security-oriented operating systems like Qubes OS. Qubes OS Anti Evil Maid (AEM) software heavily depends on the availability of the D-RTM technologies to prevent the Evil Maid attacks. However, the project hasn't evolved much since the beginning of 2018 and froze on the support of TPM 1.2 with Intel TXT in legacy boot mode (BIOS). Because of that, the usage of this security software is effectively limited to older Intel machines only. TPM 1.2 implemented SHA1 hashing algorithm, which is nowadays considered weak in the era of forever-increasing computer performance and quantum computing. The solution to this problem comes with a newer TPM 2.0 with more agile cryptographic algorithms and SHA256 implementation by default. The initial AEM implementation relied on the Trusted Boot[8], Intel's reference implementation of Intel TXT. It never had any plans to support AMD processors. TrenchBoot is filling this gap, supporting both Intel and AMD hardware which makes it an ideal target to replace Trusted Boot in Qubes OS AEM implementation. Furthermore, the project grant would be used to implement the missing pieces in the Qubes OS AEM software to cover the AMD and Intel support for both TPM 1.2 and TPM 2.0. [6] https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure#what-makes-a-secured-core-pc [7] https://nlnet.nl/project/OpenDRTM/ [8] https://sourceforge.net/p/tboot/wiki/Home/ false Slides https://cfp.3mdeb.com/qubes-os-summit-2022/talk/3PTQJU/ https://cfp.3mdeb.com/qubes-os-summit-2022/talk/3PTQJU/feedback/ Main Room Speaker at location 2022-09-10T15:20:00+02:00 15:20 00:30 As the world is evermore consumed by detecting and preventing ransomware and other financially damaging attacks on systems and organizations, far too little attention has been paid to an attack surface common to every single vulnerability - firmware. It’s time for firmware to be open source and secure. qubes-os-summit-2022-3-secure-hardware-for-a-secure-operating-system Brent Cowing en Hacks of one form or another are a dime a dozen these days. It doesn’t take long to find out about the latest local government or hospital system getting ransomwared, the millions of credit card numbers leaked via a hacked retailer’s POS system, or even the less frequent state sponsored APT hacking of a global corporation to facilitate easy access to the corporation’s entire customer base. Usually, the malware is found, neutralized, and companies and governments go back to business as usual (commonly with a higher IT budget). But what if the malware can’t be neutralized so easily? What if that malware is able to persist despite a clean install of the operating system on a new drive? This is the fate of a firmware vulnerability. In this session we are going to discuss why you should care about open source firmware and the ways we can reduce the risk of firmware persistent malware. false https://cfp.3mdeb.com/qubes-os-summit-2022/talk/DJ3MF3/ https://cfp.3mdeb.com/qubes-os-summit-2022/talk/DJ3MF3/feedback/ Main Room Speaker at location 2022-09-10T16:00:00+02:00 16:00 01:00 ... qubes-os-summit-2022-25-design-session-hardware-requirements-firmware-security Marek Marczykowski-Górecki en false https://cfp.3mdeb.com/qubes-os-summit-2022/talk/MTVKMH/ https://cfp.3mdeb.com/qubes-os-summit-2022/talk/MTVKMH/feedback/ Main Room Speaker at location 2022-09-10T17:10:00+02:00 17:10 00:30 The presentation will compare performance between Dasharo and Vendor BIOSes on Dasharo-supported platforms, in the context of QubesOS usage. I will attempt to present the most significant differences that an end user user will see when installing Dasharo over the original proprietary firmware. qubes-os-summit-2022-20-dasharo-vs-vendor-firmware-performance-on-qubesos-a-comparison Michał Kopeć en Users of open firmware often face a reduction in feature set and performance of the platform when migrating from vendor-provided, optimized, proprietary BIOS. Modern platforms feature a multitude of performance, power and thermal knobs that are sometimes not very well documented, and it requires a lot of time and experience to tune them for a specific mainboard. In this presentation I will present actual difference in performance as measured by a set of benchmarks, talk about what causes them and what challenges there are to bring performance to a state that is competitive with the vendor BIOS. We'll also discuss how these differences may impact QubesOS users. false https://cfp.3mdeb.com/qubes-os-summit-2022/talk/YMETHE/ https://cfp.3mdeb.com/qubes-os-summit-2022/talk/YMETHE/feedback/ Main Room Speaker at location 2022-09-10T17:50:00+02:00 17:50 00:10 Let's summarize the event and think about what we can improve in the future. qubes-os-summit-2022-19-qubes-os-summit-2022-day-2-closing-notes Piotr Król en false https://cfp.3mdeb.com/qubes-os-summit-2022/talk/PPJSL7/ https://cfp.3mdeb.com/qubes-os-summit-2022/talk/PPJSL7/feedback/ Main Room Speaker at location 2022-09-11T10:00:00+02:00 10:00 03:00 Time for talking and coding small collaborative projects. qubes-os-summit-2022-28-hackathon en true https://cfp.3mdeb.com/qubes-os-summit-2022/talk/VP9TKU/ https://cfp.3mdeb.com/qubes-os-summit-2022/talk/VP9TKU/feedback/ Main Room Speaker at location 2022-09-11T13:00:00+02:00 13:00 01:00 Lunch break qubes-os-summit-2022-31-lunch-break Break en false https://cfp.3mdeb.com/qubes-os-summit-2022/talk/UQQLAZ/ https://cfp.3mdeb.com/qubes-os-summit-2022/talk/UQQLAZ/feedback/ Main Room Speaker at location 2022-09-11T14:00:00+02:00 14:00 04:00 Time for talking and coding small collaborative projects. qubes-os-summit-2022-32-hackathon en false https://cfp.3mdeb.com/qubes-os-summit-2022/talk/TW7QQG/ https://cfp.3mdeb.com/qubes-os-summit-2022/talk/TW7QQG/feedback/