Comment by JCattheATM

> Not only they are much more frequent, including possibly kernel privilege escalations,

No, that's simply not the case.

> not affecting Qubes,

Maybe, qubese would still be vulnerable to kernel vulnerabilities even if they didn't allow VM escape - anything in the disposable VM would be at risk.

> the bubblewrap repository itself says that you have to be really careful to stay secure with it, even in the lack of vulnerabilities.

Source? I assume they are referring to misconfigurations.

> There is no comparably secure OS in the world.

You've said before you don't have a lot of security knowledge and it continues to show. Qubes is one specific approach to a problem not suitable for all goals, it's useful for hobbyists who use browsers and such. Anything in the disposable VM is still at risk.

SEL4, ASOS and CuBit are all more secure than Qubes. Qubes doesn't offer any more security than having a bunch of different machines to do different tasks on. Not even airgapped. If the machines have a vulnerability, then whatever is on the machine is fair game.

> I don't understand your unsubstantiated attack on Qubes.

There is no attack, I'm just refuting your preposterous zealotry for it. It's fine for what it is, but you make it much more than what it is. The developers of Qubes would absolutely disagree with your claims.

> Even if a VM becomes hostile and starts reading the RAM, it will not get any privileges in any other VM.

That depends entirely on the vulnerability.