Qubes OS alternative ยท comparison
Qubes OS is the gold standard. Here's what we took from it.
Qubes OS isolates everything in Xen domains. That's the strongest desktop security model in production. scroll-secure isn't that, and won't pretend to be. It takes the Qubes ideas that work on a normal Linux desktop and makes them the default on hardened Fedora Atomic.
Borrowed from Qubes OS
| Qubes OS idea | In scroll-secure | How close |
|---|---|---|
| Anti Evil Maid: a TPM-sealed secret proves the boot wasn't tampered with | The disk key is sealed to PCR 7 plus a signed PCR 11 policy, and released only with the TPM2 PIN and a FIDO2 key. It's sealed again after boot. | Same goal, built in |
| Hardware tokens, split secrets | FIDO2 PIN + touch for both the disk and the lock screen. The TPM and the FIDO2 key each hold half. | Close |
| Compartmentalization: one domain per risk | KVM/libvirt VMs with a virtual TPM and Secure Boot, for risky browsing, untrusted files and client work | Workflow only. The host is trusted. |
USB isolation (sys-usb) | usbguard allowlisting, from secureblue | Partial |
| Disposable VMs, a separate network VM, a GUI domain with no network | Not provided | No |
Side by side
| Qubes OS | scroll-secure | |
|---|---|---|
| Isolation | Xen hypervisor with separate domains for network, USB and apps | One hardened Linux host, with KVM VMs on demand |
| Boot tamper detection | Anti Evil Maid, an optional add-on that depends on the hardware | Always on: TPM2 + FIDO2 sealed unlock |
| Secure Boot | Not officially supported | Required, with your own keys, no Microsoft CA |
| Disk unlock | Passphrase | TPM2 PIN + FIDO2 PIN + touch, passphrase as recovery |
| OS integrity | dom0 packages and templates | Signed, read-only composefs image with atomic updates and rollback |
| Graphics | No GPU acceleration in qubes | Native amdgpu or Intel, a scrollable tiling Wayland desktop |
| Hardware needs | VT-x/AMD-V and VT-d/IOMMU, a narrow compatibility list | TPM 2.0, UEFI with custom keys, a FIDO2 key with hmac-secret |
| Maturity | Over a decade in production, a large community and a public security track record | New and unaudited. Help us change that. |
Who should pick which
Pick Qubes OS if a compromised browser must not be able to reach your password manager, or if you face targeted attackers who will chain exploits. Compartmentalization at the hypervisor level is the only real answer to that, and Qubes does it best.
Pick scroll-secure if you want a fast daily driver with a real GPU, and the threat you care most about is physical: a stolen or seized machine, or someone with ten minutes alone with it. Your boot chain, your keys and your disk unlock stay under your control.
And if you run Qubes OS today: the two-token unlock design may still be worth a read.