Skip to content

SECURITY_QA.md

Latest commit

 

History

History
190 lines (122 loc) · 7.39 KB

SECURITY_QA.md

File metadata and controls

190 lines (122 loc) · 7.39 KB

GuardOS Security & Architecture Q&A

Last Updated: 2025-04-05
Compiled from expert security review session
Related: THREAT_MODEL.md, GENESIS.md, CRITIQUE_RESPONSE.md

“If you’re not being critiqued, you’re not being taken seriously.”
— GuardOS Principle #8

❓ TABLE OF CONTENTS

  1. Is GuardOS just an AI-generated fantasy?
  2. Why use Heads/Coreboot over Libreboot?
  3. Is Flatpak sandboxing enough? Why not GrapheneOS-style isolation?
  4. Can Android ever be truly secure? What about firmware backdoors?
  5. Will GuardOS work under digital ID regimes or censored networks?
  6. Shouldn’t we focus on mesh networks like Qortal instead?
  7. What are GuardOS’s admitted blind spots?
  8. What do critics underestimate about GuardOS?
  9. How does GuardOS handle human error and social engineering?
  10. Can I run GuardOS on my laptop? What hardware is supported?

❓ Is GuardOS just an AI-generated fantasy?

✅ Short answer: No — but early docs were AI-assisted. Humans own the build, test, and audit.

GuardOS’s architecture was prototyped using LLMs to rapidly explore layered defense models — similar to how engineers use CAD software to draft bridges. The output was then stress-tested by security experts (like this Q&A).

We now:

  • Inject handwritten commentary and debates into docs (HUMAN_NOTE.md).
  • Publish build failures and rejected PRs.
  • Encourage community audits and critiques.

🔄 AI drafted the blueprint. Humans pour the concrete.

❓ Why use Heads/Coreboot over Libreboot?

✅ Heads + Coreboot is chosen for MVP because it provides:

  • Measured boot (TPM verifies firmware → kernel chain).
  • Tamper-evident UI (shows hash mismatches at boot).
  • Recovery mode (reflash from USB if compromised).

⛔ Libreboot is philosophically purer (100% blob-free) but lacks:

  • Measured boot.
  • Runtime tamper detection.
  • Broad hardware support.

🎯 Strategy: Start with Heads for verifiable security → Offer Libreboot profile later for purists.

🔐 Security without verification is faith. GuardOS chooses evidence over ideology — for now.

❓ Is Flatpak sandboxing enough? Why not GrapheneOS-style isolation?

✅ Flatpak + Landlock + eBPF + micro-VM fallback is the strongest practical Linux desktop sandbox today.

GrapheneOS’s per-app SELinux + hypervisor isolation is superior — but Android-only and not portable to x86 desktops.

🛡️ GuardOS “Flatpak++” stack:

  • Filesystem: Flatpak + Landlock
  • Syscalls: seccomp-bpf
  • Network: eBPF firewall per-app
  • Fallback: QEMU/Kata micro-VM for PDFs, Office, untrusted binaries

💡 We don’t chase Android’s model — we build the best possible equivalent for Linux desktops.

❓ Can Android ever be truly secure? What about firmware backdoors?

✅ No — not with current hardware.

Even GrapheneOS/CalyxOS run on top of:

  • Closed SBL (Qualcomm Secondary Bootloader)
  • Closed TrustZone (QSEE/TEEGRIS)
  • Closed modem/baseband firmware

These components:

  • Have full memory access.
  • Can bypass the OS.
  • Are unauditable and unreplaceable.

✅ Only exceptions: PinePhone / Librem 5 (Linux phones with U-Boot + isolatable modem).

🚫 GuardOS avoids Android for v1 — firmware opacity violates our Layer 0 trust principle.

❓ Will GuardOS work under digital ID regimes or censored networks?

✅ Yes — but not alone.

GuardOS hardens the device. You must bring the network.

Under ID-gated ISPs or DPI censorship:

  • GuardOS cannot hide your IP or spoof national ID.
  • But it CAN:
    • Work fully offline (local AI, USB file transfer).
    • Resist forensic extraction (Heads + rollback + encrypted vault).
    • Isolate credentials (TPM-sealed passkeys).

🔌 v2 Plan: Integrate “Network Profiles” — Tor, Snowflake, Qortal, Briar, Meshtastic.

🛡️ GuardOS is the bulletproof vest. You choose the escape route.

❓ Shouldn’t we focus on mesh networks like Qortal instead?

✅ Mesh networks solve different problems — and we’ll integrate them.

System Layer Role
GuardOS Device (0–6) Hardened OS, local AI, vault
Qortal/Briar Network (7) Censorship-resistant comms

🎯 Future: “Mesh Mode” in GuardPanel — auto-configures Bluetooth LE, disables Wi-Fi, routes through Qortal node.

🔄 Not competition — synergy. Secure device + resilient network = survivable system.

❓ What are GuardOS’s admitted blind spots?

We acknowledge and are fixing:

  1. Network Isolation ≠ Freedom → Adding pluggable transports (Tor, Snowflake).
  2. Hardware Fingerprints → Publishing “Hardware OPSEC Guide” (Faraday, RF silence).
  3. Local AI Poisoning Risk → Input sanitization + “AI Confidence Score.”
  4. Physical Coercion → “Plausible Deniability Mode” (decoy OS + hidden vault).
  5. Nix Supply Chain → Enforcing --no-substitutes for high-risk builds.

🧩 Transparency is our patch notes.

❓ What do critics underestimate about GuardOS?

Three key things:

  1. Offline Resilience → Most tools assume internet. GuardOS assumes none — and still functions.
  2. Cost Imposition → Forces attackers to spend $1M per device instead of $10 per phishing email.
  3. Survivability > Perfection → You don’t need to be unhackable. You need to be not worth hacking.

💥 In digital authoritarianism, inconvenience is resistance.

❓ How does GuardOS handle human error and social engineering?

✅ Via Layer 6: Human Behavior — the Aegis Local LLM Advisor.

It:

  • Explains risks in plain English: “This PDF came from a new domain and has macros — open in SafeView?”
  • Classifies phishing, DGA domains, beaconing behavior.
  • Learns from user decisions (locally) to reduce alert fatigue.

Also:

  • Credential vault (no passwords stored).
  • USB quarantine (new devices blocked by default).
  • “Panic Lockdown” button in GuardPanel.

🧠 We treat the user as part of the TCB — and give them superpowers.

❓ Can I run GuardOS on my laptop? What hardware is supported?

✅ Best Supported: ThinkPad X230 (Coreboot/Heads, TPM 1.2, ME removable).

⚠️ Partial Support: T480, Framework Laptop, Librem 14 (TPM2, ME present but manageable).

🧪 Experimental: Pinebook Pro (ARM64).

❌ Not Recommended: MacBooks, Chromebooks, locked-down OEM Windows machines.

📌 See full matrix: HARDWARE.md

🖥️ Start with an X230. It’s the reference device for a reason.

This document is a living record of GuardOS’s security evolution. Critiques welcome — they make us stronger.
Generated from expert review session. Preserved verbatim for transparency.