Prohl\u00ed\u017ee\u010de s mno\u017estv\u00edm roz\u0161\u00ed\u0159en\u00ed za\u010d\u00ednaj\u00ed b\u00fdt nejslo\u017eit\u011bj\u0161\u00ed internetov\u00e9 aplikace v po\u010d\u00edta\u010di. P\u0159i sou\u010dasn\u00e9 architektu\u0159e a pou\u017eit\u00fdch programovac\u00edch jazyc\u00edch je prakticky nemo\u017en\u00e9 eliminovat jejich skryt\u00e9 a neobjeven\u00e9 zranitelnosti. Kritick\u00e9 bezpe\u010dnostn\u00ed zranitelnosti se t\u00fdkaj\u00ed i nejbezpe\u010dn\u011bj\u0161\u00edch hardwarov\u00fdch pen\u011b\u017eenek.<\/p>\n
\u0160ifrov\u00e1n\u00ed disk\u016f, antivirov\u00e9 \u010di anti-malware \u0159e\u0161en\u00ed p\u0159i kompromitovan\u00fdch hardwaru nebo softwaru jsou ne\u00fa\u010dinn\u00e9.<\/p>\n
V n\u00e1sleduj\u00edc\u00edm \u010dl\u00e1nku se pokus\u00edm vysv\u011btlit jako v t\u00e9to divo\u010din\u011b zranitelnost\u00ed p\u0159e\u017e\u00edt a vyu\u017e\u00edt sou\u010dasn\u011b modern\u00ed technologie na minimalizaci jejich zneu\u017eit\u00ed.<\/p>\n
<\/p>\n
1 Pro\u010d Librem<\/h2>\n
Laptop, kter\u00fd by byl open-hardware (tedy snadno zauditovate\u013en\u00fd) a sou\u010dasn\u011b dostate\u010dn\u011b v\u00fdkonn\u00fd, v sou\u010dasn\u00e9 dob\u011b z\u0159ejm\u011b neexistuje. Existuj\u00ed r\u016fzn\u00e9 pokusy o vytvo\u0159en\u00ed otev\u0159en\u00e9ho laptopu na ARM procesorech (za zm\u00ednku stoj\u00ed Pine64<\/a>, p\u0159\u00edpadn\u011b Novena<\/a>), jejich v\u00fdkon je ale se sou\u010dasn\u00fdmi procesory Intel \/ AMD bohu\u017eel nesrovnateln\u00fd. Chcete-li m\u00edt v dne\u0161n\u00ed dob\u011b nejv\u00fdkonn\u011bj\u0161\u00ed laptop, pou\u017eit\u00ed Intel \/ AMD procesoru se nevyhnete.<\/p>\n N\u00ed\u017ee uv\u00e1d\u00edm d\u016fvody, pro\u010d jsem se rozhodl investovat do laptopu Purism Librem 13<\/a>, kter\u00fd nen\u00ed jen vysoce bezpe\u010dn\u00fd, ale m\u00e1 tak\u00e9 dostate\u010dn\u00fd v\u00fdkon, kter\u00fd se od sou\u010dasn\u00fdch laptop\u016f o\u010dek\u00e1v\u00e1.<\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n Librem se ofici\u00e1ln\u011b dod\u00e1v\u00e1 s opera\u010dn\u00edm PureOS<\/a>, co\u017e je m\u00edrn\u011b zabezpe\u010den\u00e1 verze Debianu (s integrovan\u00fdm Tor-em, nativn\u00edm prohl\u00ed\u017ee\u010dem PureBrowser podporuj\u00edc\u00edm EFF Privacy Badger, HTTPS Everywhere \u010di DuckDuckGo plugin). P\u00ed\u0161u „m\u00edrn\u00e9“, proto\u017ee jinak jsem si tam nev\u0161iml \u017e\u00e1dn\u00e9 v\u00fdrazn\u00e9 nav\u00fd\u0161en\u00ed bezpe\u010dnosti oproti dob\u0159e konfigurov\u00e1n desktop\u016fm na Debian \/ Ubuntu \/ Mint.<\/p>\n Vzhledem k tomu, \u017ee p\u0159ed p\u00e1r t\u00fddny vy\u0161la pro <\/span>Librem nov\u00e1 verze Coreboot 4.7<\/a>, kter\u00e1 podporuje Iommi (umo\u017e\u0148uj\u00edc fyzickou segregaci pam\u011bti mezi virtu\u00e1ln\u00edmi Masini (d\u00e1le jen VM) chr\u00e1n\u00ed jejich v\u016f\u010di \u00fatok\u016fm na \u00farovni DMA) jako\u017e i podporu TPM (kter\u00fd posledn\u00ed Librem ji\u017e obsahuje ), rozhodl jsem se nev\u00e1hat a rozb\u011bhl jsem si posledn\u00ed verzi (4.0rc5) vysoce bezpe\u010dn\u00e9ho <\/span>Qubes OS<\/a>.<\/span><\/p>\n Qubes OS se rozhodl pro bezpe\u010dnostn\u00ed model „security by compartmentalization“, co\u017e v tomto p\u0159\u00edpad\u011b znamen\u00e1 „roz\u0161katulkovan\u00fd“ cel\u00e9ho syst\u00e9mu na mno\u017estv\u00ed segregovan\u00fdch VM, kde v ka\u017ed\u00e9 dok\u00e1\u017ee b\u011b\u017eet samostatn\u00e1 aplikace.<\/p>\n V\u0161echny ty, kte\u0159\u00ed si mysl\u00ed, \u017ee to cel\u00e9 kv\u016fli chyb\u00e1m v Intelu (Meltdown & Spectre) nebude fungovat, bych r\u00e1d ujistil, \u017ee uveden\u00e9 zranitelnosti jsou d\u00edky bezpe\u010dnostn\u00ed aktualizaci <\/span>v posledn\u00edm Qubes<\/a> ji\u017e opraven\u00e9.<\/span><\/p>\n V Qubes 4 jsou p\u0159edinstalov\u00e1ny t\u0159i souborov\u00e9 syst\u00e9my – Fedora 26, Debian 9 a Whonix 13. Z nich je mo\u017en\u00e9 n\u00e1sledn\u011b vytv\u00e1\u0159et aplika\u010dn\u00ed VM.<\/p>\n Aplika\u010dn\u00ed VM jsou velmi efektivn\u00ed, co se t\u00fd\u010de \u00falo\u017en\u00e9ho prostoru. P\u0159i vytvo\u0159en\u00ed tohoto VM se recyklov\u00e1no kompletn\u011b cel\u00fd souborov\u00fd syst\u00e9m dan\u00e9ho OS. Do \u00falo\u017ei\u0161t\u011b takov\u00e9ho VM se ukl\u00e1daj\u00ed pouze u\u017eivatelsk\u00e1 data (crontab, lok\u00e1ln\u00ed firewall pravidla rc.local, domovsk\u00e9 adres\u00e1\u0159e \/ home, a cel\u00fd \/ usr \/ local). Ka\u017ed\u00e1 aplikace v samostatn\u00e9m aplika\u010dn\u00edm VM je proto dobr\u00fd n\u00e1pad a nemus\u00edte se ob\u00e1vat rychle zapln\u011bn\u00e9ho disku.<\/p>\n Dal\u0161\u00ed velk\u00e1 v\u00fdhoda aplika\u010dn\u00edch VM je jednoduch\u00e1 aktualizace – sta\u010d\u00ed aktualizovat jeden centr\u00e1ln\u00ed souborov\u00fd syst\u00e9m a po restartu m\u00e1te aktualizovan\u00e9 v\u0161echny VM, kter\u00e9 jsou z n\u011bj derivovan\u00e9.<\/p>\n Toto ale neplat\u00ed, pokud p\u0159i vytv\u00e1\u0159en\u00ed VM zvol\u00edte mo\u017enost „Standalone Qube“ – v tomto p\u0159\u00edpad\u011b se v\u00e1m do nov\u00e9ho VM kompletn\u011b zkop\u00edruje existuj\u00edc\u00ed souborov\u00fd syst\u00e9m (Fedora, Debian, Whonix). P\u0159\u00edpadn\u011b m\u016f\u017eete definovat vlastn\u00ed. Osobn\u011b jsem tuto mo\u017enost zat\u00edm nikdy nepot\u0159eboval, nebo\u0165 s Debianem se kamar\u00e1d\u00edm a dok\u00e1zal jsem si tam zat\u00edm rozjet \u00fapln\u011b v\u0161echno.<\/p>\n Virtualizace v Qubes je implementov\u00e1na p\u0159es XEN, kter\u00fd podporuje 3 typy virtualizace:<\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n Srovn\u00e1n\u00ed (origin\u00e1l https:\/\/wiki.xen.org\/wiki\/File:XenModes.png<\/a> )<\/p>\n Qubes podporuje n\u011bkolik syst\u00e9mov\u00fdch \u0161ablon ( „templates“) kter\u00e9 je mo\u017en\u00e9 prov\u00e1zat s va\u0161imi VM a zajistit jim individu\u00e1ln\u00ed p\u0159\u00edstup k internetu \u010di k USB za\u0159\u00edzen\u00edm. Tyto \u0161ablony p\u0159edstavuj\u00ed samostatn\u00e9 VM, kter\u00e9 jsou vytvo\u0159eny ze souborov\u00fdch \u0161ablon (Debian 9, Fedora 26, Whonix 13). Spou\u0161t\u011bj\u00ed se hned po nastartov\u00e1n\u00ed Qubes a slou\u017e\u00ed jako VM, kde je sm\u011b\u0159ov\u00e1na s\u00ed\u0165ov\u00fd provoz ostatn\u00edch VM.<\/p>\n V Qubes jsou p\u0159edinstalov\u00e1ny n\u00e1sleduj\u00edc\u00ed syst\u00e9mov\u00e9 \u0161ablony:<\/p>\n <\/p>\n Jedn\u00edm kliknut\u00edm dok\u00e1\u017eete nastavit nebo zm\u011bnit, aby va\u0161e vytvo\u0159en\u00e1 VM m\u011bla p\u0159\u00edstup k Internetu, do anonymn\u00ed Tor s\u00edt\u011b nebo k USB za\u0159\u00edzen\u00edm, p\u0159\u00edpadn\u011b nic z toho. Pro ka\u017edou virtu\u00e1ln\u00ed ma\u0161inu lze zkonfigurovat i lok\u00e1ln\u00ed s\u00ed\u0165ov\u00fd firewall (p\u0159ipojen\u00ed na kter\u00e9 porty je dovoleno z dan\u00e9 VM, zbytek je zak\u00e1z\u00e1n).<\/p>\n <\/p>\n Pro inspiraci uv\u00e1d\u00edm nastaven\u00ed p\u00e1r m\u00fdch osobn\u00edch VM:<\/p>\n <\/p>\n Jak jste si v\u0161imli, p\u0159\u00edstup k USB je u v\u0161ech VM plo\u0161n\u011b zak\u00e1z\u00e1n a mus\u00edm ho explicitn\u011b pro danou VM povolit, kdy\u017e pot\u0159ebuji (nap\u0159\u00edklad, kdy\u017e chci d\u011blat backup na USB nebo importovat Monero blockchain).<\/p>\n Kombinaci Librem + Qubes speci\u00e1ln\u011b ocen\u00ed v\u0161ichni ti, kte\u0159\u00ed cht\u011bj\u00ed v maxim\u00e1ln\u00ed mo\u017en\u00e9 m\u00ed\u0159e zajistit sv\u00e9 desktop pen\u011b\u017eenky (v p\u0159\u00edpad\u011b Monera, pro kter\u00fd st\u00e1le neexistuj\u00ed HW pen\u011b\u017eenky, je to pal\u010div\u00fd probl\u00e9m).<\/p>\n Z\u0159ejm\u011b nejlep\u0161\u00ed zp\u016fsob jak toto doc\u00edlit v p\u0159\u00edpad\u011b <\/span>Qubes a Monera<\/a> je pops\u00e1n zde<\/a>.<\/span><\/p>\n Ve zkratce – priv\u00e1tn\u00ed kl\u00ed\u010de Monera jsou v zabezpe\u010den\u00e9 VM, kter\u00e1 je kompletn\u011b odpojena od Internetu (nen\u00ed tam spu\u0161t\u011bn ani wifi \/ethernet interface!). Jedin\u00fd povolen\u00fd port (kter\u00fd mus\u00ed b\u00fdt explicitn\u011b schv\u00e1len z dom0) je monerod port 18081, kter\u00fd je p\u0159esm\u011brov\u00e1n na localhost: 18081. P\u0159es ten Monero wallet komunikuje s monerod, kter\u00fd b\u011b\u017e\u00ed na samostatn\u00e9 VM. Ta m\u00e1 p\u0159\u00edstup do Internetu pouze p\u0159es Tor (sys-whonix), p\u0159es kter\u00fd se aktualizuje blockchain a prov\u00e1d\u011bj\u00ed v\u0161echny Monero transakce.<\/p>\n Podobn\u00fdm zp\u016fsobem lze konfigurovat (segregovat do samostatn\u00e9 VM) desktop pen\u011b\u017eenky jak\u00fdchkoli jin\u00fdch kryptomien, pro kter\u00e9 dosud neexistuje hardwarov\u00e1 pen\u011b\u017eenka.<\/p>\n Nejv\u011bt\u0161\u00ed probl\u00e9m ze v\u0161ech n\u00ed\u017ee uveden\u00fdch byla samoz\u0159ejm\u011b Slovensk\u00e1 celnice. Purism Librem je nutn\u00e9 objednat z USA. P\u0159esto, \u017ee doru\u010den\u00ed trv\u00e1 jen p\u00e1r dn\u00ed, na celnici obvykle zbo\u017e\u00ed tr\u010d\u00ed n\u011bkolik t\u00fddn\u016f.<\/p>\n Pokud m\u016f\u017eete, tak si dan\u00fd laptop kupte v USA,a zcela se vyhn\u011bte celn\u00edmu \u0159\u00edzen\u00ed. Vyhnete se i jeho „potenci\u00e1ln\u00edmu“ zabackdoorovaniu ze strany st\u00e1tn\u00edch \u00fa\u0159ad\u016f.<\/p>\n Pokud se rozhodnete si ho objednat z USA, tak mno\u017estv\u00ed byrokracie dok\u00e1\u017eete sn\u00ed\u017eit, kdy\u017e si laptop nech\u00e1te doru\u010dit na sebe jako fyzickou osobu. Je mo\u017en\u00e9 se zcela vyhnout konfrontaci se st\u00e1tn\u00edmi \u00fa\u0159edn\u00edky, se kter\u00fdmi lze podobn\u011b jako j\u00e1 nesd\u00edl\u00edte spole\u010dn\u00fd komunika\u010dn\u00ed protokol. Na Slovensku sta\u010d\u00ed, kdy\u017e na emailovou adresu cloba@slposta.sk za\u0161lete va\u0161e nascanovan\u00e9 po\u0161tovn\u00ed ozn\u00e1men\u00ed s podac\u00edm a skladov\u00fdm \u010d\u00edslem a p\u0159ilo\u017e\u00edte p\u0159\u00edslu\u0161nou fakturu od Purism jako\u017e i potvrzen\u00ed o platb\u011b (Purism jde zaplatit i Monerem – kdy\u017e se tak rozhodnete ud\u011blat, tak dejte v\u011bd\u011bt, co na to celn\u00edci \ud83d\ude42 Sou\u010dasn\u011b v mailov\u00e9 komunikaci celn\u00ed spr\u00e1vu vyzv\u011bte na samotn\u00e9 celn\u00ed proclen\u00ed va\u0161eho zbo\u017e\u00ed a vym\u011b\u0159ov\u00e1n\u00ed 20% DPH a po\u017e\u00e1dejte je, aby v\u00e1m samotn\u00fd zbo\u017e\u00ed poslali na va\u0161i adresu dob\u00edrkou. Dva probl\u00e9my s nimi\u017e byste ale m\u011bli v tomto p\u0159\u00edpad\u011b po\u010d\u00edtat – nev\u00edte si ode\u010d\u00edst DPH (pokud objedn\u00e1v\u00e1te na firmu, tak je to mo\u017en\u00e9) a riskujete, \u017ee v\u00e1m to po\u0161ta cestou z celnice rozbije.<\/p>\n Druh\u00e1 a podstatn\u011b v\u00edce byrokratick\u00e1 mo\u017enost je objednat si laptop z USA na firmu. V tomto p\u0159\u00edpad\u011b si m\u016f\u017eete ode\u010d\u00edst na konci m\u011bs\u00edce DPH. Cel\u00fd tento proces je ultra byrokratick\u00fd, tak\u017ee se na to asi rovnou vyka\u0161lete a za 30-35 EUR si objednejte „st\u00e1tem sp\u0159\u00edzn\u011bnou“ firmu, kter\u00e1 celou byrokracii s t\u00edm spojenou vy\u0159\u00edd\u00ed za v\u00e1s.<\/p>\n Aby se v\u00e1m Qubes4 na Librem v\u016fbec nainstaloval, tak pot\u0159ebujete realizovat upgrade va\u0161eho Corebootu na posledn\u00ed verzi (4.7). Tento proces je <\/span>zde d\u016fkladn\u011b pops\u00e1n<\/a>.<\/span><\/p>\n Po nainstalov\u00e1n\u00ed Qubes na Librem v\u00e1m nebude fungovat kl\u00e1vesa \\ (resp |). Toto oprav\u00edte velmi rychle, sta\u010d\u00ed v dom0 vytvo\u0159it soubor <\/span>\/etc\/udev\/hwdb.d\/90-purism-pipe-symbol-fi.hwdb<\/span> s obsahem:<\/span><\/p>\n evdev:atkbd:dmi:bvn*:bvr*:bd*:svnPurism:pnLibrem13v2*<\/span> KEYBOARD_KEY_56=backslash<\/span><\/p>\n A n\u00e1sledn\u011b spustit p\u0159\u00edkazy:<\/p>\n sudo systemd-hwdb update<\/p>\n sudo udevadm trigger<\/span><\/p>\n <\/p>\n Dostat na horn\u00ed li\u0161tu Window managera ikonku va\u0161\u00ed obl\u00edben\u00e9 aplikace, tak aby \u0161la kdykoliv spustit v dan\u00e9m VM nen\u00ed \u00fapln\u011b jednoduch\u00e9. Ud\u011bl\u00e1te to ale takto:<\/p>\n [Desktop Entry]<\/p>\n Name = Signal<\/p>\n Comment = Private messaging from your desktop<\/p>\n Exec = „\/ opt \/ Signal \/ signal-desktop“% U<\/p>\n Terminal = false<\/p>\n Type = Application<\/p>\n Icon = signal-desktop<\/p>\n StartupWMClass = Signal<\/p>\n Categories = Network;<\/p>\n <\/p>\n V\u011bt\u0161ina uveden\u00fdch nev\u00fdhod je da\u0148 za v\u00fdrazn\u011b zv\u00fd\u0161enou bezpe\u010dnost, kter\u00e1 je v\u00fdkonov\u011b a energeticky n\u00e1ro\u010dn\u00e1.<\/p>\n Podle v\u00fdrobce ofici\u00e1ln\u00ed v\u00fddr\u017e baterky Librem 13 je 7 a\u017e 9 hodin. Pokud se rozhodnete j\u00edt do Qubes a v\u0161e provozovat ve VM, co\u017e je n\u00e1ro\u010dn\u011b na CPU, po\u010d\u00edtejte s t\u00edm, \u017ee v\u00fddr\u017e bude mo\u017en\u00e1 3x ni\u017e\u0161\u00ed.<\/p>\n Asi 2x se mi stalo, \u017ee se mi Librem neo\u010dek\u00e1van\u011b vypnul, i p\u0159esto, \u017ee jeho baterie nebyla zcela vybit\u00e1. \u0160lo o situace, kdy byl extr\u00e9mn\u011b p\u0159et\u00ed\u017een\u00fd (mnoho spu\u0161t\u011bn\u00fdch VM, nap\u0159\u00edklad mi b\u011b\u017eel backup) a sou\u010dasn\u011b nebyl v elektrick\u00e9m nap\u00e1jen\u00ed. Vypnut\u00ed bylo okam\u017eit\u00e9, bez jak\u00e9koliv ozn\u00e1men\u00ed, \u017ee baterie je ji\u017e vybit\u00e1. Nev\u00edm vylou\u010dit zda nejde jen o n\u011bjakou hardwarovou chybu m\u00e9ho konkr\u00e9tn\u00edho modelu. Kdy\u017e byl laptop zapojen v elektrick\u00e9 s\u00edti, tak se mi to nikdy nestalo.<\/p>\n Ka\u017ed\u00e9 spu\u0161t\u011bn\u00ed aplikace znamen\u00e1, \u017ee se v\u00e1m mus\u00ed spustit samostatn\u00e1 VM, kter\u00e1 mus\u00ed nabootovat a n\u00e1sledn\u011b se v n\u00ed mus\u00ed spustit po\u017eadovan\u00e1 aplikace. Co\u017e m\u016f\u017ee trvat \u0159\u00e1dov\u011b o p\u00e1r vte\u0159in v\u00edce ne\u017e jste norm\u00e1ln\u011b zvykl\u00ed. D\u00e1 se to vy\u0159e\u0161it tak, \u017ee VM pou\u017e\u00edvan\u00fdch aplikac\u00ed spust\u00edte rovnou p\u0159i startu (je to jednoduch\u00e9 nastavit). V tomto p\u0159\u00edpad\u011b se ale o to prodlou\u017e\u00ed samotn\u00e9 bootov\u00e1n\u00ed.<\/p>\n B\u011bh samotn\u00fdch aplikac\u00ed je ale rychl\u00fd, tak\u017ee se d\u00e1 na to zvyknout a mn\u011b osobn\u011b toto u\u017e nevad\u00ed.<\/p>\n Kv\u016fli tomu, \u017ee ka\u017ed\u00e1 aplikace m\u016f\u017ee v Qubes b\u011b\u017eet v samostatn\u00e9 VM, kter\u00e9 jsou navz\u00e1jem odd\u011bleny,m\u016f\u017ee komunikace mezi spu\u0161t\u011bn\u00fdmi aplikacemi v r\u016fzn\u00fdch VM sp\u016fsoobovat usability probl\u00e9m. Nap\u0159\u00edklad, kdy\u017e chcete zkop\u00edrovat jednoduch\u00fd text, tak to mus\u00edte ud\u011blat v n\u00e1sleduj\u00edc\u00edch kroc\u00edch:<\/p>\n 1. Kop\u00edrov\u00e1n\u00ed textu do schr\u00e1nky v dan\u00e9 VM (obvykle Ctrl + C)<\/p>\n 2. Zkop\u00edrov\u00e1n\u00ed do Qubes clipboardu v dom0 (Shift + Ctrl + C)<\/p>\n 3. Vlo\u017een\u00ed do Qubes clipboardu v dan\u00e9 VM (Shift + Ctrl + V)<\/p>\n 4. Vlo\u017een\u00ed textu v dan\u00e9 VM (Ctrl + V)<\/p>\n Tak\u017ee 2 kroky nav\u00edc ne\u017e b\u011b\u017en\u011b, ale d\u00e1 se na to rychle zvyknout.<\/p>\n Pokud kop\u00edrujete text mezi okny aplikac\u00ed, kter\u00e9 b\u011b\u017e\u00ed v t\u00e9\u017ee VM, tak samoz\u0159ejm\u011b tento probl\u00e9m nem\u00e1te.<\/p>\n Podobn\u011b kop\u00edrov\u00e1n\u00ed soubor\u016f mezi VM se realizuje trochu speci\u00e1ln\u011b – pomoc\u00ed p\u0159\u00edkaz\u016f qvm-copy nebo qvm-move vy\u017e\u00e1duj\u00edc\u00ed v\u00fdslovn\u00fd souhlas, kter\u00fd se zobraz\u00ed v dom0. Na toto se d\u00e1 tak\u00e9 velmi rychle zvyknout.<\/p>\n
Na rozd\u00edl od jin\u00fdch b\u011b\u017en\u00fdch laptop\u016f, Librem toti\u017e disponuje:<\/p>\n\n
<\/p>\n
<\/h2>\n
\n
2 Pro\u010d Qubes<\/h2>\n
2.1 Typy VM<\/h3>\n
2.2 Typy virtualizace<\/h3>\n
\n
<\/p>\n
2.3 Segregace virtualizac\u00ed jako cesta k vy\u0161\u0161\u00ed bezpe\u010dnosti<\/h3>\n
\n
\n
2.4 Paranoidn\u00ed nastaven\u00ed Monera desktop pen\u011b\u017eenky<\/h3>\n
3 Probl\u00e9my, kter\u00e9 v\u00e1s \u010dekaj\u00ed v\u010detn\u011b jejich \u0159e\u0161en\u00ed<\/h2>\n
3.1 Slovensk\u00e1 celnice<\/h3>\n
3.2 Upgrade Corebootu na posledn\u00ed verzi<\/h3>\n
3.3 Nefunk\u010dn\u00ed kl\u00e1vesa \\ (resp |)<\/h3>\n
3.4 P\u0159id\u00e1n\u00ed ikonky aplikace na horn\u00ed li\u0161t\u011b<\/h3>\n
\n
\n
4 Nev\u00fdhody<\/h2>\n
4.1 Slab\u0161\u00ed v\u00fddr\u017e baterie<\/h3>\n
4.2 Neo\u010dek\u00e1van\u00e9 vypnut\u00ed laptopu je\u0161t\u011b p\u0159ed jeho vybit\u00edm<\/h3>\n
4.3 Pomalej\u0161\u00ed startov\u00e1n\u00ed aplikac\u00ed a bootov\u00e1n\u00ed<\/h3>\n
4.4 M\u00edrn\u011b sn\u00ed\u017eena usability<\/h3>\n
4.5 Nep\u0159\u00edtomn\u00e1 podpora Windows 10<\/h3>\n
![https:\/\/wiki.xen.org\/wiki\/File:XenModes.png<\/a> )<\/p>\n2.3 Segregace virtualizac\u00ed jako cesta k vy\u0161\u0161\u00ed bezpe\u010dnosti<\/h3>\nQubes podporuje n\u011bkolik syst\u00e9mov\u00fdch \u0161ablon ( „templates“) kter\u00e9 je mo\u017en\u00e9 prov\u00e1zat s va\u0161imi VM a zajistit jim individu\u00e1ln\u00ed p\u0159\u00edstup k internetu \u010di k USB za\u0159\u00edzen\u00edm. Tyto \u0161ablony p\u0159edstavuj\u00ed samostatn\u00e9 VM, kter\u00e9 jsou vytvo\u0159eny ze souborov\u00fdch \u0161ablon (Debian 9, Fedora 26, Whonix 13). Spou\u0161t\u011bj\u00ed se hned po nastartov\u00e1n\u00ed Qubes a slou\u017e\u00ed jako VM, kde je sm\u011b\u0159ov\u00e1na s\u00ed\u0165ov\u00fd provoz ostatn\u00edch VM.<\/p>\nV Qubes jsou p\u0159edinstalov\u00e1ny n\u00e1sleduj\u00edc\u00ed syst\u00e9mov\u00e9 \u0161ablony:<\/p>\n\nsys-whonix – transparentn\u00ed kompletn\u00ed sm\u011brov\u00e1n\u00ed s\u00ed\u0165ov\u00e9ho provozu do Tor anonymizaci s\u00edt\u011b (jako souborov\u00e1 \u0161ablona je pou\u017eit Whonix)<\/li>\nsys-firewall – Standardn\u00ed firewall (INPUT, FORWARD chain nastaven na DROP) (jako \u0161ablona je pou\u017eita sys-net)<\/li>\nsys-net – p\u0159\u00edstup k internetu (jako souborov\u00e1 \u0161ablona je pou\u017eita Fedora)<\/li>\nsys-usb – p\u0159\u00edstup na USB (jako souborov\u00e1 \u0161ablona je pou\u017eita Fedora)<\/li>\n<\/ul>\n <\/p>\nJedn\u00edm kliknut\u00edm dok\u00e1\u017eete nastavit nebo zm\u011bnit, aby va\u0161e vytvo\u0159en\u00e1 VM m\u011bla p\u0159\u00edstup k Internetu, do anonymn\u00ed Tor s\u00edt\u011b nebo k USB za\u0159\u00edzen\u00edm, p\u0159\u00edpadn\u011b nic z toho. Pro ka\u017edou virtu\u00e1ln\u00ed ma\u0161inu lze zkonfigurovat i lok\u00e1ln\u00ed s\u00ed\u0165ov\u00fd firewall (p\u0159ipojen\u00ed na kter\u00e9 porty je dovoleno z dan\u00e9 VM, zbytek je zak\u00e1z\u00e1n).<\/p>\n <\/p>\nPro inspiraci uv\u00e1d\u00edm nastaven\u00ed p\u00e1r m\u00fdch osobn\u00edch VM:<\/p>\n\nfedora-26-dvm (p\u0159\u00edstup k internetu p\u0159es firewall) – jednor\u00e1zov\u00e1 instance VM, kter\u00e1 spust\u00ed „prohl\u00ed\u017een\u00ed“ bez jak\u00fdchkoliv stop<\/li>\nwhonix-dvm (p\u0159\u00edstup k internetu p\u0159es Tor) – jednor\u00e1zov\u00e1 instance VM, kter\u00e1 spust\u00ed „prohl\u00ed\u017een\u00ed“ p\u0159es Tor bez jak\u00fdchkoliv stop<\/li>\nTrustedCommunication (p\u0159\u00edstup k internetu p\u0159es firewall) – VM, kde m\u00e1m um\u00edst\u011bny moje priv\u00e1tn\u00ed SSH a Signal kl\u00ed\u010de (b\u011b\u017e\u00ed mi tam Signal a SSH klient)<\/li>\nTrezor (bez jak\u00e9hokoli p\u0159\u00edstupu na s\u00ed\u0165) – b\u011b\u017e\u00ed mi tam password manager (B-Folders + KeePassX)<\/li>\npersonal (p\u0159\u00edstup k internetu p\u0159es firewall) – b\u011b\u017e\u00ed mi tam Spotify, Emacs, LibreOffice …<\/li>\nmonero-wallet-ws (bez jak\u00e9hokoli p\u0159\u00edstupu na s\u00ed\u0165) – VM, kde m\u00e1m ulo\u017een\u00e9 priv\u00e1tn\u00ed kl\u00ed\u010de k Monero pen\u011b\u017eence<\/li>\nmonerod-ws (p\u0159\u00edstup k internetu pouze p\u0159es Tor) – synchronizovan\u00fd Monero blockchain p\u0159es Tor, podobn\u011b v\u0161echny Monero transakce jsou broadcastovan\u00e9 p\u0159es Tor<\/li>\n<\/ul>\n <\/p>\nJak jste si v\u0161imli, p\u0159\u00edstup k USB je u v\u0161ech VM plo\u0161n\u011b zak\u00e1z\u00e1n a mus\u00edm ho explicitn\u011b pro danou VM povolit, kdy\u017e pot\u0159ebuji (nap\u0159\u00edklad, kdy\u017e chci d\u011blat backup na USB nebo importovat Monero blockchain).<\/p>\n2.4 Paranoidn\u00ed nastaven\u00ed Monera desktop pen\u011b\u017eenky<\/h3>\nKombinaci Librem + Qubes speci\u00e1ln\u011b ocen\u00ed v\u0161ichni ti, kte\u0159\u00ed cht\u011bj\u00ed v maxim\u00e1ln\u00ed mo\u017en\u00e9 m\u00ed\u0159e zajistit sv\u00e9 desktop pen\u011b\u017eenky (v p\u0159\u00edpad\u011b Monera, pro kter\u00fd st\u00e1le neexistuj\u00ed HW pen\u011b\u017eenky, je to pal\u010div\u00fd probl\u00e9m).<\/p>\nZ\u0159ejm\u011b nejlep\u0161\u00ed zp\u016fsob jak toto doc\u00edlit v p\u0159\u00edpad\u011b <\/span>Qubes a Monera<\/a> je pops\u00e1n zde<\/a>.<\/span><\/p>\nVe zkratce – priv\u00e1tn\u00ed kl\u00ed\u010de Monera jsou v zabezpe\u010den\u00e9 VM, kter\u00e1 je kompletn\u011b odpojena od Internetu (nen\u00ed tam spu\u0161t\u011bn ani wifi \/ethernet interface!). Jedin\u00fd povolen\u00fd port (kter\u00fd mus\u00ed b\u00fdt explicitn\u011b schv\u00e1len z dom0) je monerod port 18081, kter\u00fd je p\u0159esm\u011brov\u00e1n na localhost: 18081. P\u0159es ten Monero wallet komunikuje s monerod, kter\u00fd b\u011b\u017e\u00ed na samostatn\u00e9 VM. Ta m\u00e1 p\u0159\u00edstup do Internetu pouze p\u0159es Tor (sys-whonix), p\u0159es kter\u00fd se aktualizuje blockchain a prov\u00e1d\u011bj\u00ed v\u0161echny Monero transakce.<\/p>\nPodobn\u00fdm zp\u016fsobem lze konfigurovat (segregovat do samostatn\u00e9 VM) desktop pen\u011b\u017eenky jak\u00fdchkoli jin\u00fdch kryptomien, pro kter\u00e9 dosud neexistuje hardwarov\u00e1 pen\u011b\u017eenka.<\/p>\n3 Probl\u00e9my, kter\u00e9 v\u00e1s \u010dekaj\u00ed v\u010detn\u011b jejich \u0159e\u0161en\u00ed<\/h2>\n3.1 Slovensk\u00e1 celnice<\/h3>\nNejv\u011bt\u0161\u00ed probl\u00e9m ze v\u0161ech n\u00ed\u017ee uveden\u00fdch byla samoz\u0159ejm\u011b Slovensk\u00e1 celnice. Purism Librem je nutn\u00e9 objednat z USA. P\u0159esto, \u017ee doru\u010den\u00ed trv\u00e1 jen p\u00e1r dn\u00ed, na celnici obvykle zbo\u017e\u00ed tr\u010d\u00ed n\u011bkolik t\u00fddn\u016f.<\/p>\nPokud m\u016f\u017eete, tak si dan\u00fd laptop kupte v USA,a zcela se vyhn\u011bte celn\u00edmu \u0159\u00edzen\u00ed. Vyhnete se i jeho „potenci\u00e1ln\u00edmu“ zabackdoorovaniu ze strany st\u00e1tn\u00edch \u00fa\u0159ad\u016f.<\/p>\nPokud se rozhodnete si ho objednat z USA, tak mno\u017estv\u00ed byrokracie dok\u00e1\u017eete sn\u00ed\u017eit, kdy\u017e si laptop nech\u00e1te doru\u010dit na sebe jako fyzickou osobu. Je mo\u017en\u00e9 se zcela vyhnout konfrontaci se st\u00e1tn\u00edmi \u00fa\u0159edn\u00edky, se kter\u00fdmi lze podobn\u011b jako j\u00e1 nesd\u00edl\u00edte spole\u010dn\u00fd komunika\u010dn\u00ed protokol. Na Slovensku sta\u010d\u00ed, kdy\u017e na emailovou adresu cloba@slposta.sk za\u0161lete va\u0161e nascanovan\u00e9 po\u0161tovn\u00ed ozn\u00e1men\u00ed s podac\u00edm a skladov\u00fdm \u010d\u00edslem a p\u0159ilo\u017e\u00edte p\u0159\u00edslu\u0161nou fakturu od Purism jako\u017e i potvrzen\u00ed o platb\u011b (Purism jde zaplatit i Monerem – kdy\u017e se tak rozhodnete ud\u011blat, tak dejte v\u011bd\u011bt, co na to celn\u00edci \ud83d\ude42 Sou\u010dasn\u011b v mailov\u00e9 komunikaci celn\u00ed spr\u00e1vu vyzv\u011bte na samotn\u00e9 celn\u00ed proclen\u00ed va\u0161eho zbo\u017e\u00ed a vym\u011b\u0159ov\u00e1n\u00ed 20% DPH a po\u017e\u00e1dejte je, aby v\u00e1m samotn\u00fd zbo\u017e\u00ed poslali na va\u0161i adresu dob\u00edrkou. Dva probl\u00e9my s nimi\u017e byste ale m\u011bli v tomto p\u0159\u00edpad\u011b po\u010d\u00edtat – nev\u00edte si ode\u010d\u00edst DPH (pokud objedn\u00e1v\u00e1te na firmu, tak je to mo\u017en\u00e9) a riskujete, \u017ee v\u00e1m to po\u0161ta cestou z celnice rozbije.<\/p>\nDruh\u00e1 a podstatn\u011b v\u00edce byrokratick\u00e1 mo\u017enost je objednat si laptop z USA na firmu. V tomto p\u0159\u00edpad\u011b si m\u016f\u017eete ode\u010d\u00edst na konci m\u011bs\u00edce DPH. Cel\u00fd tento proces je ultra byrokratick\u00fd, tak\u017ee se na to asi rovnou vyka\u0161lete a za 30-35 EUR si objednejte „st\u00e1tem sp\u0159\u00edzn\u011bnou“ firmu, kter\u00e1 celou byrokracii s t\u00edm spojenou vy\u0159\u00edd\u00ed za v\u00e1s.<\/p>\n3.2 Upgrade Corebootu na posledn\u00ed verzi<\/h3>\nAby se v\u00e1m Qubes4 na Librem v\u016fbec nainstaloval, tak pot\u0159ebujete realizovat upgrade va\u0161eho Corebootu na posledn\u00ed verzi (4.7). Tento proces je <\/span>zde d\u016fkladn\u011b pops\u00e1n<\/a>.<\/span><\/p>\n3.3 Nefunk\u010dn\u00ed kl\u00e1vesa \\ (resp |)<\/h3>\nPo nainstalov\u00e1n\u00ed Qubes na Librem v\u00e1m nebude fungovat kl\u00e1vesa \\ (resp |). Toto oprav\u00edte velmi rychle, sta\u010d\u00ed v dom0 vytvo\u0159it soubor <\/span>\/etc\/udev\/hwdb.d\/90-purism-pipe-symbol-fi.hwdb<\/span> s obsahem:<\/span><\/p>\nevdev:atkbd:dmi:bvn*:bvr*:bd*:svnPurism:pnLibrem13v2*<\/span> KEYBOARD_KEY_56=backslash<\/span><\/p>\nA n\u00e1sledn\u011b spustit p\u0159\u00edkazy:<\/p>\nsudo systemd-hwdb update<\/p>\nsudo udevadm trigger<\/span><\/p>\n <\/p>\n3.4 P\u0159id\u00e1n\u00ed ikonky aplikace na horn\u00ed li\u0161t\u011b<\/h3>\nDostat na horn\u00ed li\u0161tu Window managera ikonku va\u0161\u00ed obl\u00edben\u00e9 aplikace, tak aby \u0161la kdykoliv spustit v dan\u00e9m VM nen\u00ed \u00fapln\u011b jednoduch\u00e9. Ud\u011bl\u00e1te to ale takto:<\/p>\n\nNastartujte VM se souborov\u00fdm syst\u00e9mem, kter\u00fd pou\u017e\u00edv\u00e1te (Debian 9 nebo Fedora 26).<\/li>\nNainstalujte va\u0161i aplikaci, kterou chcete spou\u0161t\u011bt.<\/li>\nP\u0159ihlaste se jako root a do \/ usr \/ share \/ applications \/ nakop\u00edrujte popis p\u0159\u00edslu\u0161n\u00e9 aplikace, kterou jste nainstalovali v kroku 2, nap\u0159\u00edklad signal-desktop.desktop:<\/li>\n<\/ol>\n[Desktop Entry]<\/p>\nName = Signal<\/p>\nComment = Private messaging from your desktop<\/p>\nExec = „\/ opt \/ Signal \/ signal-desktop“% U<\/p>\nTerminal = false<\/p>\nType = Application<\/p>\nIcon = signal-desktop<\/p>\nStartupWMClass = Signal<\/p>\nCategories = Network;<\/p>\n\nVypn\u011bte dan\u00fd VM.<\/li>\nOtev\u0159ete konfiguraci aplika\u010dn\u00edho VM, kter\u00fd m\u00e1te z n\u011bj derivovan\u00fd. V nastaven\u00edch dan\u00e9ho VM zobrazte seznam aplikac\u00ed, kter\u00e9 tam m\u00e1te nainstalovan\u00e9 a stiskn\u011bte „Refresh applications“ – zobraz\u00ed se v\u00e1m va\u0161e aplikace.<\/li>\nKlikn\u011bte na horn\u00ed li\u0161tu a zvolte volbu „Panel“ \/ „Add New Items“ \/ „Launcher“<\/li>\nKlepn\u011bte na „Properties“ nov\u00e9 aplikace a vyberte va\u0161i zvolenou aplikaci.<\/li>\nKdy\u017e chcete k n\u00ed nakop\u00edrovat vlastn\u00ed ikonku do dom0, tak to ud\u011bl\u00e1te <\/span>n\u00e1sledovn\u011b<\/a>.<\/span><\/li>\n<\/ol>\n <\/p>\n4 Nev\u00fdhody<\/h2>\nV\u011bt\u0161ina uveden\u00fdch nev\u00fdhod je da\u0148 za v\u00fdrazn\u011b zv\u00fd\u0161enou bezpe\u010dnost, kter\u00e1 je v\u00fdkonov\u011b a energeticky n\u00e1ro\u010dn\u00e1.<\/p>\n4.1 Slab\u0161\u00ed v\u00fddr\u017e baterie<\/h3>\nPodle v\u00fdrobce ofici\u00e1ln\u00ed v\u00fddr\u017e baterky Librem 13 je 7 a\u017e 9 hodin. Pokud se rozhodnete j\u00edt do Qubes a v\u0161e provozovat ve VM, co\u017e je n\u00e1ro\u010dn\u011b na CPU, po\u010d\u00edtejte s t\u00edm, \u017ee v\u00fddr\u017e bude mo\u017en\u00e1 3x ni\u017e\u0161\u00ed.<\/p>\n4.2 Neo\u010dek\u00e1van\u00e9 vypnut\u00ed laptopu je\u0161t\u011b p\u0159ed jeho vybit\u00edm<\/h3>\nAsi 2x se mi stalo, \u017ee se mi Librem neo\u010dek\u00e1van\u011b vypnul, i p\u0159esto, \u017ee jeho baterie nebyla zcela vybit\u00e1. \u0160lo o situace, kdy byl extr\u00e9mn\u011b p\u0159et\u00ed\u017een\u00fd (mnoho spu\u0161t\u011bn\u00fdch VM, nap\u0159\u00edklad mi b\u011b\u017eel backup) a sou\u010dasn\u011b nebyl v elektrick\u00e9m nap\u00e1jen\u00ed. Vypnut\u00ed bylo okam\u017eit\u00e9, bez jak\u00e9koliv ozn\u00e1men\u00ed, \u017ee baterie je ji\u017e vybit\u00e1. Nev\u00edm vylou\u010dit zda nejde jen o n\u011bjakou hardwarovou chybu m\u00e9ho konkr\u00e9tn\u00edho modelu. Kdy\u017e byl laptop zapojen v elektrick\u00e9 s\u00edti, tak se mi to nikdy nestalo.<\/p>\n4.3 Pomalej\u0161\u00ed startov\u00e1n\u00ed aplikac\u00ed a bootov\u00e1n\u00ed<\/h3>\nKa\u017ed\u00e9 spu\u0161t\u011bn\u00ed aplikace znamen\u00e1, \u017ee se v\u00e1m mus\u00ed spustit samostatn\u00e1 VM, kter\u00e1 mus\u00ed nabootovat a n\u00e1sledn\u011b se v n\u00ed mus\u00ed spustit po\u017eadovan\u00e1 aplikace. Co\u017e m\u016f\u017ee trvat \u0159\u00e1dov\u011b o p\u00e1r vte\u0159in v\u00edce ne\u017e jste norm\u00e1ln\u011b zvykl\u00ed. D\u00e1 se to vy\u0159e\u0161it tak, \u017ee VM pou\u017e\u00edvan\u00fdch aplikac\u00ed spust\u00edte rovnou p\u0159i startu (je to jednoduch\u00e9 nastavit). V tomto p\u0159\u00edpad\u011b se ale o to prodlou\u017e\u00ed samotn\u00e9 bootov\u00e1n\u00ed.<\/p>\nB\u011bh samotn\u00fdch aplikac\u00ed je ale rychl\u00fd, tak\u017ee se d\u00e1 na to zvyknout a mn\u011b osobn\u011b toto u\u017e nevad\u00ed.<\/p>\n4.4 M\u00edrn\u011b sn\u00ed\u017eena usability<\/h3>\nKv\u016fli tomu, \u017ee ka\u017ed\u00e1 aplikace m\u016f\u017ee v Qubes b\u011b\u017eet v samostatn\u00e9 VM, kter\u00e9 jsou navz\u00e1jem odd\u011bleny,m\u016f\u017ee komunikace mezi spu\u0161t\u011bn\u00fdmi aplikacemi v r\u016fzn\u00fdch VM sp\u016fsoobovat usability probl\u00e9m. Nap\u0159\u00edklad, kdy\u017e chcete zkop\u00edrovat jednoduch\u00fd text, tak to mus\u00edte ud\u011blat v n\u00e1sleduj\u00edc\u00edch kroc\u00edch:<\/p>\n1. Kop\u00edrov\u00e1n\u00ed textu do schr\u00e1nky v dan\u00e9 VM (obvykle Ctrl + C)<\/p>\n2. Zkop\u00edrov\u00e1n\u00ed do Qubes clipboardu v dom0 (Shift + Ctrl + C)<\/p>\n3. Vlo\u017een\u00ed do Qubes clipboardu v dan\u00e9 VM (Shift + Ctrl + V)<\/p>\n4. Vlo\u017een\u00ed textu v dan\u00e9 VM (Ctrl + V)<\/p>\nTak\u017ee 2 kroky nav\u00edc ne\u017e b\u011b\u017en\u011b, ale d\u00e1 se na to rychle zvyknout.<\/p>\nPokud kop\u00edrujete text mezi okny aplikac\u00ed, kter\u00e9 b\u011b\u017e\u00ed v t\u00e9\u017ee VM, tak samoz\u0159ejm\u011b tento probl\u00e9m nem\u00e1te.<\/p>\nPodobn\u011b kop\u00edrov\u00e1n\u00ed soubor\u016f mezi VM se realizuje trochu speci\u00e1ln\u011b – pomoc\u00ed p\u0159\u00edkaz\u016f qvm-copy nebo qvm-move vy\u017e\u00e1duj\u00edc\u00ed v\u00fdslovn\u00fd souhlas, kter\u00fd se zobraz\u00ed v dom0. Na toto se d\u00e1 tak\u00e9 velmi rychle zvyknout.<\/p>\n4.5 Nep\u0159\u00edtomn\u00e1 podpora Windows 10<\/h3>\nWindows 10 na Qubes 4 zat\u00edm neb\u011b\u017e\u00ed (nevypad\u00e1, \u017ee by toto byla pro v\u00fdvoj\u00e1\u0159e priorita). Experiment\u00e1ln\u011b to lze vyhackova\u0165 <\/span>n\u00e1sledovn\u011b<\/a>.<\/span><\/p>\n4.6 Touchpad nam\u00edsto trackpoint<\/h3>\nToto je z\u0159ejm\u011b jenom m\u016fj subjektivn\u00ed pocit jako odchovance na IBM ThinkPad. Jsem zvykl\u00fd na trackpoint nam\u00edsto touchpadu, kter\u00fd mi p\u0159ijde v\u00fdrazn\u011b pou\u017eiteln\u011bj\u0161\u00ed. Bohu\u017eel Librem disponuje pouze touchpadem (samoz\u0159ejm\u011b je mo\u017en\u00e9 p\u0159ipojit extern\u00ed USB my\u0161)<\/p>\n <\/p>\n5 V\u00fdhody Qubes<\/h2>\n <\/p>\nKrom\u011b obrovsk\u00fdch bezpe\u010dnostn\u00edch v\u00fdhod, kter\u00e9 Qubes nab\u00edz\u00ed, r\u00e1d bych pouk\u00e1zal na p\u00e1r dal\u0161\u00edch v\u00fdhod, kter\u00e9 s bezpe\u010dnost\u00ed p\u0159\u00edmo nesouvis\u00ed.<\/p>\n5.1 \u0160et\u0159en\u00ed diskov\u00e9ho prostoru<\/h3>\nP\u0159i pou\u017eit\u00ed aplika\u010dn\u00edch VM dok\u00e1\u017eete skute\u010dn\u011b u\u0161et\u0159it spoustu diskov\u00e9ho prostoru. Kompletn\u011b virtualizovan\u00e9 prost\u0159ed\u00ed bere jen o trochu v\u00edce diskov\u00e9ho prostoru ne\u017e nevirtualizovan\u00e9.<\/p>\n5.2 Jednoduch\u00e9 zv\u011bt\u0161ov\u00e1n\u00ed diskov\u00e9ho prostoru VM<\/h3>\nZv\u011bt\u0161ov\u00e1n\u00ed syst\u00e9mov\u00e9ho diskov\u00e9ho prostoru (root) nebo soukrom\u00e9ho souborov\u00e9ho syst\u00e9mu (private) v jak\u00e9mkoliv VM je d\u00edky LVM extr\u00e9mn\u011b jednoduch\u00e9. A dok\u00e1\u017eete to ud\u011blat pro pr\u00e1v\u011b spu\u0161t\u011bnou VM, kterou nemus\u00edte dokonce u\u017e ani restartovat.<\/p>\n5.3 Jednoduch\u00e9 z\u00e1lohov\u00e1n\u00ed<\/h3>\nZ\u00e1lohov\u00e1n\u00ed VM je tak\u00e9 velmi jednoduch\u00e9 – sta\u010d\u00ed vyklikat, kter\u00e9 VM chcete z\u00e1lohovat, zda je chcete p\u0159i z\u00e1lohov\u00e1n\u00ed komprimovat a \u0161ifrovat a vybrat si cestu a VM, kam to chcete cel\u00e9 ulo\u017eit. J\u00e1 jsem si speci\u00e1ln\u011b pro z\u00e1lohov\u00e1n\u00ed m\u00e9ho laptopu koupil 512 GB USB kl\u00ed\u010d.<\/p>\n <\/p>\nZ\u00e1v\u011br<\/h2>\nVysoce bezpe\u010dn\u00e1 kombinace Purism Librem a Qubes z\u0159ejm\u011b nebude pro ka\u017ed\u00e9ho.<\/p>\nPokud jste exponovan\u00e1 osoba, kter\u00e1 se ob\u00e1v\u00e1 hrozby c\u00edlen\u00fdch \u00fatok\u016f (nap\u0159\u00edklad vyu\u017eit\u00edm 0-day exploit\u016f), p\u0159\u00edpadn\u011b pot\u0159ebujete chr\u00e1nit kryptom\u011bny, ve kter\u00fdch m\u00e1te p\u0159ev\u00e1\u017enou \u010d\u00e1st va\u0161ich \u00faspor, tak Librem + Qubes je „must“ a z\u0159ejm\u011b nic lep\u0161\u00edho nenajdete.<\/p>\nQubes krom\u011b jin\u00fdch pou\u017e\u00edv\u00e1 Snowden, DJ Bernstein, Peter Todd a mno\u017estv\u00ed jin\u00fdch lid\u00ed pro kter\u00e9 je bezpe\u010dnost skute\u010dn\u011b kl\u00ed\u010dov\u00e1.<\/p>\n(Cel\u00fd tento \u010dl\u00e1nek byl naps\u00e1n v Qubes 4 na Purism Librem).<\/p>\n","protected":false},"excerpt":{"rendered":"To, \u017ee nejste paranoidn\u00ed, neznamen\u00e1 \u017ee jsou va\u0161e data v bezpe\u010d\u00ed. S nar\u016fstaj\u00edci\u00ed komplexnost\u00ed hardwaru i softwaru je odhalovat zranitelnosti nebo zadn\u00ed vr\u00e1tka t\u011b\u017e\u0161\u00ed ne\u017e kdykoliv p\u0159edt\u00edm. Kritick\u00e9 zranitelnosti se ned\u00e1vno objevily ve v\u0161ude dostupn\u00fdch procesorech (Meltdown \/ Spectre), podobn\u011b zadn\u00ed vr\u00e1tka (Intel ME). Prohl\u00ed\u017ee\u010de s mno\u017estv\u00edm roz\u0161\u00ed\u0159en\u00ed za\u010d\u00ednaj\u00ed b\u00fdt nejslo\u017eit\u011bj\u0161\u00ed internetov\u00e9 aplikace v po\u010d\u00edta\u010di. […]<\/p>\n","protected":false},"author":2,"featured_media":2610,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[12],"tags":[1147,1144,1145,1129,1129,1130,1130,1131,1131,1148],"class_list":{"0":"post-2741","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","6":"hentry","7":"category-uncategorized-cs","8":"tag-bezpecny-hardware","9":"tag-bezpecny-software","10":"tag-hackovani","11":"tag-librem-cs","13":"tag-monero-cs","15":"tag-qubes-cs","17":"tag-zabezpeceni-laptopu"},"yoast_head":"\nJAK SI MAXIM\u00c1LN\u011a ZABEZPE\u010cIT LAPTOP - Nethemba<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/nethemba.com\/cs\/jak-si-maximalne-zabezpecit-laptop\/\" \/>\n<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"JAK SI MAXIM\u00c1LN\u011a ZABEZPE\u010cIT LAPTOP - Nethemba\" \/>\n<meta property=\"og:description\" content=\"To, \u017ee nejste paranoidn\u00ed, neznamen\u00e1 \u017ee jsou va\u0161e data v bezpe\u010d\u00ed. S nar\u016fstaj\u00edci\u00ed komplexnost\u00ed hardwaru i softwaru je odhalovat zranitelnosti nebo zadn\u00ed vr\u00e1tka t\u011b\u017e\u0161\u00ed ne\u017e kdykoliv p\u0159edt\u00edm. Kritick\u00e9 zranitelnosti se ned\u00e1vno objevily ve v\u0161ude dostupn\u00fdch procesorech (Meltdown \/ Spectre), podobn\u011b zadn\u00ed vr\u00e1tka (Intel ME). Prohl\u00ed\u017ee\u010de s mno\u017estv\u00edm roz\u0161\u00ed\u0159en\u00ed za\u010d\u00ednaj\u00ed b\u00fdt nejslo\u017eit\u011bj\u0161\u00ed internetov\u00e9 aplikace v po\u010d\u00edta\u010di. […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/nethemba.com\/cs\/jak-si-maximalne-zabezpecit-laptop\/\" \/>\n<meta property=\"og:site_name\" content=\"Nethemba\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/nethemba\" \/>\n<meta property=\"article:published_time\" content=\"2018-03-30T07:45:20+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2018-03-30T08:39:31+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/nethemba.com\/wp-content\/uploads\/2018\/01\/2018_Nethemba_IT-bezpecnostny-expert.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1142\" \/>\n\t<meta property=\"og:image:height\" content=\"857\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Pavol Lupt\u00e1k\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@nethemba\" \/>\n<meta name=\"twitter:site\" content=\"@nethemba\" \/>\n<meta name=\"twitter:label1\" content=\"Napsal(a)\" \/>\n\t<meta name=\"twitter:data1\" content=\"Pavol Lupt\u00e1k\" \/>\n\t<meta name=\"twitter:label2\" content=\"Odhadovan\u00e1 doba \u010dten\u00ed\" \/>\n\t<meta name=\"twitter:data2\" content=\"15 minut\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/nethemba.com\\\/cs\\\/jak-si-maximalne-zabezpecit-laptop\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nethemba.com\\\/cs\\\/jak-si-maximalne-zabezpecit-laptop\\\/\"},\"author\":{\"name\":\"Pavol Lupt\u00e1k\",\"@id\":\"https:\\\/\\\/nethemba.com\\\/de\\\/#\\\/schema\\\/person\\\/5f4ba68c8e1a2013d30e0804245b8234\"},\"headline\":\"JAK SI MAXIM\u00c1LN\u011a ZABEZPE\u010cIT LAPTOP\",\"datePublished\":\"2018-03-30T07:45:20+00:00\",\"dateModified\":\"2018-03-30T08:39:31+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/nethemba.com\\\/cs\\\/jak-si-maximalne-zabezpecit-laptop\\\/\"},\"wordCount\":3102,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/nethemba.com\\\/cs\\\/jak-si-maximalne-zabezpecit-laptop\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/nethemba.com\\\/wp-content\\\/uploads\\\/2018\\\/01\\\/2018_Nethemba_IT-bezpecnostny-expert.png\",\"keywords\":[\"bezpe\u010dn\u00fd hardware\",\"bezpe\u010dn\u00fd software\",\"hackov\u00e1n\u00ed\",\"Librem\",\"Librem\",\"Monero\",\"Monero\",\"Qubes\",\"Qubes\",\"zabezpe\u010den\u00ed laptopu\"],\"articleSection\":[\"Uncategorized @cs\"],\"inLanguage\":\"cs\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/nethemba.com\\\/cs\\\/jak-si-maximalne-zabezpecit-laptop\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/nethemba.com\\\/cs\\\/jak-si-maximalne-zabezpecit-laptop\\\/\",\"url\":\"https:\\\/\\\/nethemba.com\\\/cs\\\/jak-si-maximalne-zabezpecit-laptop\\\/\",\"name\":\"JAK SI MAXIM\u00c1LN\u011a ZABEZPE\u010cIT LAPTOP - Nethemba\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nethemba.com\\\/de\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/nethemba.com\\\/cs\\\/jak-si-maximalne-zabezpecit-laptop\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/nethemba.com\\\/cs\\\/jak-si-maximalne-zabezpecit-laptop\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/nethemba.com\\\/wp-content\\\/uploads\\\/2018\\\/01\\\/2018_Nethemba_IT-bezpecnostny-expert.png\",\"datePublished\":\"2018-03-30T07:45:20+00:00\",\"dateModified\":\"2018-03-30T08:39:31+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/nethemba.com\\\/de\\\/#\\\/schema\\\/person\\\/5f4ba68c8e1a2013d30e0804245b8234\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/nethemba.com\\\/cs\\\/jak-si-maximalne-zabezpecit-laptop\\\/#breadcrumb\"},\"inLanguage\":\"cs\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/nethemba.com\\\/cs\\\/jak-si-maximalne-zabezpecit-laptop\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"cs\",\"@id\":\"https:\\\/\\\/nethemba.com\\\/cs\\\/jak-si-maximalne-zabezpecit-laptop\\\/#primaryimage\",\"url\":\"https:\\\/\\\/nethemba.com\\\/wp-content\\\/uploads\\\/2018\\\/01\\\/2018_Nethemba_IT-bezpecnostny-expert.png\",\"contentUrl\":\"https:\\\/\\\/nethemba.com\\\/wp-content\\\/uploads\\\/2018\\\/01\\\/2018_Nethemba_IT-bezpecnostny-expert.png\",\"width\":1142,\"height\":857},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/nethemba.com\\\/cs\\\/jak-si-maximalne-zabezpecit-laptop\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/nethemba.com\\\/cs\\\/home-new-2025\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"JAK SI MAXIM\u00c1LN\u011a ZABEZPE\u010cIT LAPTOP\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/nethemba.com\\\/de\\\/#website\",\"url\":\"https:\\\/\\\/nethemba.com\\\/de\\\/\",\"name\":\"Nethemba\",\"description\":\"We care about your security\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/nethemba.com\\\/de\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"cs\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/nethemba.com\\\/de\\\/#\\\/schema\\\/person\\\/5f4ba68c8e1a2013d30e0804245b8234\",\"name\":\"Pavol Lupt\u00e1k\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"cs\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/978b23022518d076eaa243b375d2e0272af4f00dd502ce79cc357276d9bc2495?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/978b23022518d076eaa243b375d2e0272af4f00dd502ce79cc357276d9bc2495?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/978b23022518d076eaa243b375d2e0272af4f00dd502ce79cc357276d9bc2495?s=96&d=mm&r=g\",\"caption\":\"Pavol Lupt\u00e1k\"},\"sameAs\":[\"https:\\\/\\\/www.nethemba.com\\\/\"],\"url\":\"https:\\\/\\\/nethemba.com\\\/cs\\\/author\\\/nethemba-admin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"JAK SI MAXIM\u00c1LN\u011a ZABEZPE\u010cIT LAPTOP - Nethemba","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/nethemba.com\/cs\/jak-si-maximalne-zabezpecit-laptop\/","og_locale":"cs_CZ","og_type":"article","og_title":"JAK SI MAXIM\u00c1LN\u011a ZABEZPE\u010cIT LAPTOP - Nethemba","og_description":"To, \u017ee nejste paranoidn\u00ed, neznamen\u00e1 \u017ee jsou va\u0161e data v bezpe\u010d\u00ed. S nar\u016fstaj\u00edci\u00ed komplexnost\u00ed hardwaru i softwaru je odhalovat zranitelnosti nebo zadn\u00ed vr\u00e1tka t\u011b\u017e\u0161\u00ed ne\u017e kdykoliv p\u0159edt\u00edm. Kritick\u00e9 zranitelnosti se ned\u00e1vno objevily ve v\u0161ude dostupn\u00fdch procesorech (Meltdown \/ Spectre), podobn\u011b zadn\u00ed vr\u00e1tka (Intel ME). Prohl\u00ed\u017ee\u010de s mno\u017estv\u00edm roz\u0161\u00ed\u0159en\u00ed za\u010d\u00ednaj\u00ed b\u00fdt nejslo\u017eit\u011bj\u0161\u00ed internetov\u00e9 aplikace v po\u010d\u00edta\u010di. […]","og_url":"https:\/\/nethemba.com\/cs\/jak-si-maximalne-zabezpecit-laptop\/","og_site_name":"Nethemba","article_publisher":"https:\/\/www.facebook.com\/nethemba","article_published_time":"2018-03-30T07:45:20+00:00","article_modified_time":"2018-03-30T08:39:31+00:00","og_image":[{"width":1142,"height":857,"url":"https:\/\/nethemba.com\/wp-content\/uploads\/2018\/01\/2018_Nethemba_IT-bezpecnostny-expert.png","type":"image\/png"}],"author":"Pavol Lupt\u00e1k","twitter_card":"summary_large_image","twitter_creator":"@nethemba","twitter_site":"@nethemba","twitter_misc":{"Napsal(a)":"Pavol Lupt\u00e1k","Odhadovan\u00e1 doba \u010dten\u00ed":"15 minut"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/nethemba.com\/cs\/jak-si-maximalne-zabezpecit-laptop\/#article","isPartOf":{"@id":"https:\/\/nethemba.com\/cs\/jak-si-maximalne-zabezpecit-laptop\/"},"author":{"name":"Pavol Lupt\u00e1k","@id":"https:\/\/nethemba.com\/de\/#\/schema\/person\/5f4ba68c8e1a2013d30e0804245b8234"},"headline":"JAK SI MAXIM\u00c1LN\u011a ZABEZPE\u010cIT LAPTOP","datePublished":"2018-03-30T07:45:20+00:00","dateModified":"2018-03-30T08:39:31+00:00","mainEntityOfPage":{"@id":"https:\/\/nethemba.com\/cs\/jak-si-maximalne-zabezpecit-laptop\/"},"wordCount":3102,"commentCount":0,"image":{"@id":"https:\/\/nethemba.com\/cs\/jak-si-maximalne-zabezpecit-laptop\/#primaryimage"},"thumbnailUrl":"https:\/\/nethemba.com\/wp-content\/uploads\/2018\/01\/2018_Nethemba_IT-bezpecnostny-expert.png","keywords":["bezpe\u010dn\u00fd hardware","bezpe\u010dn\u00fd software","hackov\u00e1n\u00ed","Librem","Librem","Monero","Monero","Qubes","Qubes","zabezpe\u010den\u00ed laptopu"],"articleSection":["Uncategorized @cs"],"inLanguage":"cs","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/nethemba.com\/cs\/jak-si-maximalne-zabezpecit-laptop\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/nethemba.com\/cs\/jak-si-maximalne-zabezpecit-laptop\/","url":"https:\/\/nethemba.com\/cs\/jak-si-maximalne-zabezpecit-laptop\/","name":"JAK SI MAXIM\u00c1LN\u011a ZABEZPE\u010cIT LAPTOP - Nethemba","isPartOf":{"@id":"https:\/\/nethemba.com\/de\/#website"},"primaryImageOfPage":{"@id":"https:\/\/nethemba.com\/cs\/jak-si-maximalne-zabezpecit-laptop\/#primaryimage"},"image":{"@id":"https:\/\/nethemba.com\/cs\/jak-si-maximalne-zabezpecit-laptop\/#primaryimage"},"thumbnailUrl":"https:\/\/nethemba.com\/wp-content\/uploads\/2018\/01\/2018_Nethemba_IT-bezpecnostny-expert.png","datePublished":"2018-03-30T07:45:20+00:00","dateModified":"2018-03-30T08:39:31+00:00","author":{"@id":"https:\/\/nethemba.com\/de\/#\/schema\/person\/5f4ba68c8e1a2013d30e0804245b8234"},"breadcrumb":{"@id":"https:\/\/nethemba.com\/cs\/jak-si-maximalne-zabezpecit-laptop\/#breadcrumb"},"inLanguage":"cs","potentialAction":[{"@type":"ReadAction","target":["https:\/\/nethemba.com\/cs\/jak-si-maximalne-zabezpecit-laptop\/"]}]},{"@type":"ImageObject","inLanguage":"cs","@id":"https:\/\/nethemba.com\/cs\/jak-si-maximalne-zabezpecit-laptop\/#primaryimage","url":"https:\/\/nethemba.com\/wp-content\/uploads\/2018\/01\/2018_Nethemba_IT-bezpecnostny-expert.png","contentUrl":"https:\/\/nethemba.com\/wp-content\/uploads\/2018\/01\/2018_Nethemba_IT-bezpecnostny-expert.png","width":1142,"height":857},{"@type":"BreadcrumbList","@id":"https:\/\/nethemba.com\/cs\/jak-si-maximalne-zabezpecit-laptop\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/nethemba.com\/cs\/home-new-2025\/"},{"@type":"ListItem","position":2,"name":"JAK SI MAXIM\u00c1LN\u011a ZABEZPE\u010cIT LAPTOP"}]},{"@type":"WebSite","@id":"https:\/\/nethemba.com\/de\/#website","url":"https:\/\/nethemba.com\/de\/","name":"Nethemba","description":"We care about your security","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/nethemba.com\/de\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"cs"},{"@type":"Person","@id":"https:\/\/nethemba.com\/de\/#\/schema\/person\/5f4ba68c8e1a2013d30e0804245b8234","name":"Pavol Lupt\u00e1k","image":{"@type":"ImageObject","inLanguage":"cs","@id":"https:\/\/secure.gravatar.com\/avatar\/978b23022518d076eaa243b375d2e0272af4f00dd502ce79cc357276d9bc2495?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/978b23022518d076eaa243b375d2e0272af4f00dd502ce79cc357276d9bc2495?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/978b23022518d076eaa243b375d2e0272af4f00dd502ce79cc357276d9bc2495?s=96&d=mm&r=g","caption":"Pavol Lupt\u00e1k"},"sameAs":["https:\/\/www.nethemba.com\/"],"url":"https:\/\/nethemba.com\/cs\/author\/nethemba-admin\/"}]}},"_links":{"self":[{"href":"https:\/\/nethemba.com\/cs\/wp-json\/wp\/v2\/posts\/2741","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nethemba.com\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nethemba.com\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nethemba.com\/cs\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/nethemba.com\/cs\/wp-json\/wp\/v2\/comments?post=2741"}],"version-history":[{"count":0,"href":"https:\/\/nethemba.com\/cs\/wp-json\/wp\/v2\/posts\/2741\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nethemba.com\/cs\/wp-json\/wp\/v2\/media\/2610"}],"wp:attachment":[{"href":"https:\/\/nethemba.com\/cs\/wp-json\/wp\/v2\/media?parent=2741"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nethemba.com\/cs\/wp-json\/wp\/v2\/categories?post=2741"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nethemba.com\/cs\/wp-json\/wp\/v2\/tags?post=2741"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}](\"https:\/\/wiki.xen.org\/wiki\/File:XenModes.png\"){kind=link}