All valid points.
If they really cared about security, they'd have built the Subgraph OS template for Qubes already, since the technical obstacles don't seem that large (can be run in a HVM; subgraph OS is based on Debian etc).
Well, at least according to the maestro marmarek:
I think the steps include:
- getting SGOS kernel (especially GrSec) running in Qubes VM - IIUC this requires running it as HVM
- checking SGOS compatibility with Qubes GUI agent (if SGOS uses standard Xorg server as the final chain in GUI, it shouldn't be a problem, at least in theory)
- building actual template (build scripts etc)
- minor adjustments, like ensuring application menu points to the right executables
Is it possible to (easily) convert standard Debian testing installation into SGOS? In that case, building the template can be just an addon to building standard Debian template (the same way as Whonix template is built). Links:
As for testing GUI agent - all the relevant packages are available in http://deb.qubes-os.org/r3.1/ (signing key) installing qubes-core-agent and qubes-gui-agent should take care of most of the things. But keep in mind those packages are quite intrusive - modifies many system configs for Qubes VM use case.
One problem is HVM usage - in Qubes 3.x PV and HVM diifers much (for example you can't switch between those modes for a VM without recreating it). It will be much better in Qubes 4.0 (HVM/PV is just a VM changeable property there), but we're still at least few months away from having stable enough version for testing SGOS there.
Also above mentioned packages currently assume PV case. It shouldn't be hard to get them working in HVM (maybe already does), but we haven't checked that.
Basically I gather there is a bit of a dick-swinging contest going on in the privacy field. Otherwise they'd all come together and we could already be running layer after layer of security, which is required in today's insane world e.g. ->
grsec kernels, piled on top of virtualization, on top of containers, on top of apparmor, on top of disposable VMs, on top of sand-boxed Tor Browsers etc etc. And that shit would "just work" TM, without an advanced degree in computer science or 1,000 steps and cryptic error messages to contend with.
From the layman's perspective, I don't think there is much argument that Qubes is a superior model, particularly when you look at what is on their roadmap.
Crossing your fingers and hoping that one container sandbox in Subgraph is gonna hold everything together to prevent full system infection doesn't hold water in 2017.
PS I realized you meant add subgraph OS to that huge comparison table. I might hold off on that one for a while, since I've other editing priorities right now. But I'll get there eventually, unless someone else does first.