Qubes OS summit 2022

To see our schedule with full functionality, like timezone conversion and personal scheduling, please enable JavaScript and go here.
10:00
10:00
25min
Welcome to Qubes OS Summit 2022 Day 1
Piotr Król

Let's say hi to each other and talk about:

  • Qubes Summit history
  • What changed since the last event
  • Event schedule and organization announcements
  • Shout out to sponsors
Main Room
10:30
10:30
30min
Qubes OS development status update
Marek Marczykowski-Górecki

This talk is a summary of projects Qubes team currently works on, and a rough roadmap for Qubes OS 4.2.

Main Room
11:10
11:10
40min
Building secure applications with Qubes OS
Michael Z

SecureDrop Workstation is a new and improved front-end for journalists using SecureDrop. It was built on top of Qubes OS and relies heavily on its features and security properties. In this talk, we'll introduce the system and discuss some lessons learned by treating Qubes OS as a framework for secure multi-VM applications.

Main Room
12:00
12:00
20min
Next generation of Qubes OS builder
Frédéric Pierret

In this talk, we will present the second generation of the Qubes OS builder.
This new builder leverages container or disposable qube isolation to perform every
stage of the build and release process. From fetching sources to building them,
everything is executed inside a "cage" (either a disposable or a container) with the
help of what we call an "executor." For every command that needs to perform an action
on sources, like cloning and verifying Git repos, rendering a SPEC file, generating
SRPM or Debian source packages, a new cage is used. The global architecture will
be presented and demonstrations on how to use this new build system will be made.

Main Room
12:30
12:30
30min
Tailoring Qubes for Enterprises
Jan Suhr

Enterprises are usually a domain of Windows-only systems and users. We will present how Qubes could be tailored to meet requirements of enterprises which rely on Windows but at the same time provide a "reasonable secure system" based on Qubes. A key requirement is to achieve a system which is usable for users with ordinary Windows experience. Therefore key is the integration of a Windows VM within Qubes OS.

Main Room
13:10
13:10
50min
Lunch break

Lunch break

Break
Main Room
14:00
14:00
30min
Qubes OS Policy: Adventures in UX/UI Design
Marta "marmarta" Marczykowska-Górecka

A brief overview of the current state of Qubes OS policy tools, the in-development graphical policy editor / configuration editor, the process of simplifying the complexities of policy configuration and design and implementation challenges.

Main Room
14:40
14:40
30min
GPU Virtual Machine (GVM)
Arthur Rasmusson

GVM is a GPU Virtual Machine built by the OpenMdev Project for IOMMU-capable computers such as x86 and ARM.

Main Room
15:20
15:20
30min
Isolating GUIs with the power of Wayland
Puck Meerburg

Could Qubes OS replace its custom GUI isolation protocol with Wayland while
staying as performant and secure? With the advent of Wayland, many strides
have been made in the desktop Linux space, limiting the effects a malicious
application can have. Gone are the days of every application being able to
snoop every keypress! This presentation will dive into the differences
between X and Wayland, and why it makes for a great fit in isolating
operating systems like Qubes OS and Spectrum.

Main Room
16:00
16:00
30min
PipeWire and Qubes Video Companion
Demi Marie Obenour

Qubes OS currently has poor support for audio and video capture. Audio capture works if used properly, but is easy to misuse and its latency is excessive. Video capture is not supported except via device pass-through, which raises serious security concerns. This talk is about replacing the legacy PulseAudio-based solution with a modern PipeWire-based one, and replacing camera pass-through with Qubes Video Companion.

Main Room
16:40
16:40
60min
Design session: graphical subsystem (GPU, Wayland)
Marek Marczykowski-Górecki

...

Main Room
17:50
17:50
10min
Qubes OS Summit 2022 - Day 1 closing notes
Piotr Król

Closing notes

Main Room
19:30
19:30
240min
Afterparty

Afterparty at Südblock (Admiralstr. 1-2, https://www.suedblock.org/)

Break
Main Room
10:00
10:00
10min
Welcome to Qubes OS Summit 2022 Day 2
Piotr Król
  • Day 2 event schedule and organization announcements
  • Shout out to sponsors
Main Room
10:20
10:20
15min
How Dasharo coreboot based firmware helps NovaCustom's customers
Wessel klein Snakenborg

NovaCustom has previously experienced a number of problems related to the proprietary firmware of the laptop. In this talk, we will present three cases in which Dasharo open source coreboot based firmware has played an important role.

  • The first case is about the desire for a modified fan curve.
  • The second case study concerns an application where the customer asked whether it is possible to disable certain CPU options, which turned out to be necessary for audio production.
  • The third case is about the implementation of an own startup logo in the firmware.

In addition, there will be an explanation of the security aspects of the Dasharo firmware that NovaCustom has recently started using. Thanks to the growing active Dasharo community, the firmware can be increasingly optimised to the needs of our users.

Although Qubes OS already has a number of certified laptop models, their hardware is often quite old. The need for newer hardware that is fully compatible with Qubes OS is there, and this is where NovaCustom could play a role with certified hardware and firmware that is fully adapted with the Qubes OS operating system.

Main Room
10:45
10:45
30min
Qubes User Support Stories
nestire

Talk about the Experince of User Support for Qubes at Nitrokey.

Main Room
11:30
11:30
30min
Qubes OS Documentation Localization
m, Tobias Killer

Let us attend to the past, present & future development of localizing the official Qubes OS Documentation.

Main Room
12:10
12:10
30min
Qubes OS on modern Alder Lake desktop
Michał Żygowski

There are very few desktop platforms that are user-controllable through
open-source firmware. Moreover, they haven't necessarily been tested with Qubes
OS. However, the recent initiative to port a modern Alder Lake desktop to coreboot
opened a new door for privacy and security respecting machine capable of running
Qubes OS.

In this presentation, a demo of Dasharo[1] distribution compatible with Alder
Lake-S desktop MSI PRO Z690-A WIFI DDR4 running Qubes OS will be shown. The
presenter will also describe new updates to Dasharo firmware and challenges
awaiting in future development. Also it will be discussed how Dasharo plans to
meet the future Qubes certification requirements[2] and approaches the openness
of the firmware based on Dasharo Openness Score of various supported platforms.

[1] https://dasharo.com/
[2] https://groups.google.com/g/qubes-devel/c/08uSf2i-FTo/m/ii9DpjQ-AgAJ

Main Room
12:50
12:50
70min
Lunch break

Lunch break

Break
Main Room
14:00
14:00
30min
Qubes OS: Towards Being a Reasonably Learnable System
Deeplow

Following up on last year's presentation, deeplow presents the final work for his contribution proposal for an integrated onboarding tutorial for Qubes OS.

Main Room
14:40
14:40
30min
TrenchBoot - the only AEM-way to boot Qubes OS
Michał Żygowski

Qubes OS Anti Evil Maid (AEM)[1] heavily depends on the availability of the
Dynamic Root of Trust for Measurement (D-RTM) technologies to prevent the Evil
Maid attacks[2]. However, the project hasn't evolved much since the beginning
of 2018 and froze on the support of TPM 1.2 with Intel TXT in legacy boot mode
(BIOS). Because of that, the usage of this security software is effectively
limited to older Intel machines only. Some attempts were already made to
support AMD and TPM 2.0 by 3mdeb[3], however the work suffered from lack of
business justification and stopped at porting AEM scripts to use TPM 2.0. But a
successfull demo of AMD D-RTM with Qubes OS has been shown on Qubes OS
minisummit 2020[4]. This year the efforts are traditionally continued.

The presentation will describe the project plan of improving and extending the
Qubes OS AEM with TrenchBoot[5] covering both Intel and AMD hardware, TPM 1.2
and 2.0. The goal is to unify the D-RTM early launch and Anti Evil Maid
software to secure the Qubes OS boot process for basically any hardware device
(as long as it supports the required technologies). The presenter will give
detailed overview of project phases and tasks to be fulfilled as well as the
cost outline. At the end a short demo of Qubes OS AEM with TrenchBoot on Dell
OptiPlex 7010/9010 with Intel TXT and TPM1.2 will be shown.

[1] https://blog.invisiblethings.org/2011/09/07/anti-evil-maid.html
[2] https://theinvisiblethings.blogspot.com/2009/10/evil-maid-goes-after-truecrypt.html
[3] https://github.com/3mdeb/qubes-antievilmaid-amd/pull/1/files
[4] https://www.youtube.com/watch?v=rM0vRi6qABE
[5] https://trenchboot.org/

Main Room
15:20
15:20
30min
Secure hardware for a secure operating system
Brent Cowing

As the world is evermore consumed by detecting and preventing ransomware and other financially damaging attacks on systems and organizations, far too little attention has been paid to an attack surface common to every single vulnerability - firmware. It’s time for firmware to be open source and secure.

Main Room
16:00
16:00
60min
Design session: hardware requirements, firmware security
Marek Marczykowski-Górecki

...

Main Room
17:10
17:10
30min
Dasharo vs vendor firmware performance on QubesOS - a comparison
Michał Kopeć

The presentation will compare performance between Dasharo and Vendor BIOSes
on Dasharo-supported platforms, in the context of QubesOS usage. I will attempt
to present the most significant differences that an end user user will see when
installing Dasharo over the original proprietary firmware.

Main Room
17:50
17:50
10min
Qubes OS Summit 2022 - Day 2 closing notes
Piotr Król

Let's summarize the event and think about what we can improve in the future.

Main Room