Oh yeah, they did build a running system. It was in similar status to the others (eg Dresden&#x27;s TUDOS) when I made my recommendations. All needed work with QubesOS getting plenty from its dedicated team. Put enough work into something and it will certainly run: see Windows 3.1 on MS-DOS. ;) QubesOS is way better naturally but shows the point that &quot;it runs&quot; doesn&#x27;t invalidate any design or security claim made about it. Nor is it an excuse for using a bad approach or failing to adapt. Reminds me of programmers with defective code that argue, &quot;But mine ran faster!&quot;<p>That said, it&#x27;s usable enough that even I recommend it as an option when strong attackers aren&#x27;t the opponents. If the attackers are, then it&#x27;s unlikely to save you and work should be put into the inherently stronger options to get them in better shape. Plus, there&#x27;s some commercial separation kernels that already run on desktops&#x2F;laptops etc. one can use. They all use security-focused kernels, user-mode drivers, user-mode networking stacks w&#x2F; hardening, trusted boot, I&#x2F;O MMU, and so on. Not cheap, though, plus a risk of subversion or someone cutting corners. Decisions, decisions. ;)<p>Truth be told, the whole market (proprietary + FOSS) sucks one way or another. Enemies are probably going to get in if it&#x27;s a desktop due need to be compatible with much risky garbage. Only the console approaches can be made strong enough with FOSS components right now. Tough trade-offs in ease-of-use, too.<p>My current recommendation for defending against strong attackers is my old approach: several cheap, hardened machines for physical separation with KVM switch; a guard for sharing between them; sharing done over non-DMA, simple interfaces with simple, easy-to-parse protocols. Additionally, no wireless functionality (even disabled) in them at all. Worked before and still works for less than $1,000 but it ain&#x27;t pretty or easy to setup.<p>&quot;Genode provides a &quot;framework&quot; - and basically runs complete systems in separate windows.&quot;<p>Actually, it&#x27;s a [barely-]usable system differentiated by a resource-management scheme, pluggable microkernels, minimal-TCB native apps, and&#x2F;or running &quot;complete systems in separate windows.&quot; Splitting between microkernel apps and VM&#x27;s is a proven method that resisted NSA hackers in prior evaluations (eg XTS-400, INTEGRITY-178B). Part that really needs review for risks is their resource-management scheme. However, if proven, it will be advantageous in benefits it offers and especially if microkernel&#x2F;microhypervisor is enhanced with INTEGRITY RTOS-style resource controls. Malicious apps mostly wouldn&#x27;t be able to do shit unless there were hardware flaws or problems in the few, trusted components.<p>Meanwhile, QubesOS runs. So do my Linux LiveCD&#x27;s and KVM boxes. Malware doesn&#x27;t hit any of them because the best aren&#x27;t trying: most targets use Windows or predictable Linux builds. We&#x27;ll keep using such obfuscation until the [FOSS] strong stuff is ready.