{"action":"created","issue":{"url":"https://api.github.com/repos/Qubes-Community/Contents/issues/23","repository_url":"https://api.github.com/repos/Qubes-Community/Contents","labels_url":"https://api.github.com/repos/Qubes-Community/Contents/issues/23/labels{/name}","comments_url":"https://api.github.com/repos/Qubes-Community/Contents/issues/23/comments","events_url":"https://api.github.com/repos/Qubes-Community/Contents/issues/23/events","html_url":"https://github.com/Qubes-Community/Contents/issues/23","id":318856083,"number":23,"title":"Doc suggestion: VM Hardening","user":{"login":"awokd","id":34515595,"avatar_url":"https://avatars2.githubusercontent.com/u/34515595?v=4","gravatar_id":"","url":"https://api.github.com/users/awokd","html_url":"https://github.com/awokd","followers_url":"https://api.github.com/users/awokd/followers","following_url":"https://api.github.com/users/awokd/following{/other_user}","gists_url":"https://api.github.com/users/awokd/gists{/gist_id}","starred_url":"https://api.github.com/users/awokd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/awokd/subscriptions","organizations_url":"https://api.github.com/users/awokd/orgs","repos_url":"https://api.github.com/users/awokd/repos","events_url":"https://api.github.com/users/awokd/events{/privacy}","received_events_url":"https://api.github.com/users/awokd/received_events","type":"User","site_admin":false},"labels":[{"id":879595241,"url":"https://api.github.com/repos/Qubes-Community/Contents/labels/doc-suggestion","name":"doc-suggestion","color":"3890f4","default":false}],"state":"open","locked":false,"assignee":{"login":"awokd","id":34515595,"avatar_url":"https://avatars2.githubusercontent.com/u/34515595?v=4","gravatar_id":"","url":"https://api.github.com/users/awokd","html_url":"https://github.com/awokd","followers_url":"https://api.github.com/users/awokd/followers","following_url":"https://api.github.com/users/awokd/following{/other_user}","gists_url":"https://api.github.com/users/awokd/gists{/gist_id}","starred_url":"https://api.github.com/users/awokd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/awokd/subscriptions","organizations_url":"https://api.github.com/users/awokd/orgs","repos_url":"https://api.github.com/users/awokd/repos","events_url":"https://api.github.com/users/awokd/events{/privacy}","received_events_url":"https://api.github.com/users/awokd/received_events","type":"User","site_admin":false},"assignees":[{"login":"awokd","id":34515595,"avatar_url":"https://avatars2.githubusercontent.com/u/34515595?v=4","gravatar_id":"","url":"https://api.github.com/users/awokd","html_url":"https://github.com/awokd","followers_url":"https://api.github.com/users/awokd/followers","following_url":"https://api.github.com/users/awokd/following{/other_user}","gists_url":"https://api.github.com/users/awokd/gists{/gist_id}","starred_url":"https://api.github.com/users/awokd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/awokd/subscriptions","organizations_url":"https://api.github.com/users/awokd/orgs","repos_url":"https://api.github.com/users/awokd/repos","events_url":"https://api.github.com/users/awokd/events{/privacy}","received_events_url":"https://api.github.com/users/awokd/received_events","type":"User","site_admin":false}],"milestone":null,"comments":6,"created_at":"2018-04-30T11:12:40Z","updated_at":"2018-05-02T23:36:53Z","closed_at":null,"author_association":"OWNER","body":"Document options available to further harden Qubes templates. Inspired by https://www.mail-archive.com/qubes-users@googlegroups.com/msg20660.html. Include items such as:\r\n\r\n- sudo prompt\r\n- Tasket's service(s) https://github.com/tasket/Qubes-VM-hardening\r\n- Apparmor and other RBACs\r\n- other best practices\r\n- any other suggestions not included in the link?\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/Qubes-Community/Contents/issues/comments/386153329","html_url":"https://github.com/Qubes-Community/Contents/issues/23#issuecomment-386153329","issue_url":"https://api.github.com/repos/Qubes-Community/Contents/issues/23","id":386153329,"user":{"login":"tasket","id":14337937,"avatar_url":"https://avatars3.githubusercontent.com/u/14337937?v=4","gravatar_id":"","url":"https://api.github.com/users/tasket","html_url":"https://github.com/tasket","followers_url":"https://api.github.com/users/tasket/followers","following_url":"https://api.github.com/users/tasket/following{/other_user}","gists_url":"https://api.github.com/users/tasket/gists{/gist_id}","starred_url":"https://api.github.com/users/tasket/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tasket/subscriptions","organizations_url":"https://api.github.com/users/tasket/orgs","repos_url":"https://api.github.com/users/tasket/repos","events_url":"https://api.github.com/users/tasket/events{/privacy}","received_events_url":"https://api.github.com/users/tasket/received_events","type":"User","site_admin":false},"created_at":"2018-05-02T23:36:53Z","updated_at":"2018-05-02T23:36:53Z","author_association":"NONE","body":"There is a philosophical aspect to writing a doc for guest hardening, especially for Qubes which has its own somewhat contradictory concept.\r\n\r\nMy own view is that VMs can collect malware, and although the caliber of that malware will vary greatly they all rate at least as _nuisance_... So why not enable native security of the guest OS if it can prevent some of those nuisances and threats and if that doesn't get in the users' way?\r\n\r\nAnd if that guest OS gains some temporary, startup protection from being a Qubes client then why utilize that protected phase to find or disable malware?\r\n\r\nThat's the philosophy behind Qubes-vm-hardening.\r\n\r\nIt would be good if the doc begins from the perspective of merely enabling native OS security similar to how the distro intends it to function, and explaining that it can improve overall security by a matter of degrees. Then present additional options from there.\r\n\r\nWhen you take it beyond that, you are likely repeating advice consisting of special measures that OS vendors/distros don't think are particularly valuable for whatever reasons, which is why they're not included or enabled by default. This is a potential source of confusion and frustration if the doc doesn't strike the right tone; you should avoid giving readers the impression of \"you need to perform these extra steps to make Qubes secure\". It is better to say these are alternative or supplemental ways to increase security, YMMV."}}
{"actor":{"display_login":"tasket"}}