Can you breakdown your arguments?
Conversation
What do you want broken down? The claim you're repeating about cellular basebands is untrue. Many hardware components typically have DMA access, including off-die components like Wi-Fi, and it doesn't mean they aren't isolated. It depends on the IOMMU and driver implementations.
1
Did you have this discussion with ? I would love to hear their response. It's interesting topic and opinions are polarizing.
1
It's not my opinion that the statement you're making about basebands is untrue. A component being on the SoC doesn't mean it isn't isolated. A component being on a separate chip doesn't mean it is isolated. Those are objective reality is that it depends on the implementation.
2
1
SoC components tend to be among the most well isolated. Components like Wi-Fi that are rarely part of the SoC and yet often have DMA access tend to be those that are the most poorly isolated. Drivers also need to treat components as untrusted which Linux drivers often don't do.
1
It's wrong to portray mobile as a different situation than desktops and similarly to portray mobile basebands as an extremely special case. A desktop CPU is already a vastly complex system of hardware, microcode and firmware, and there are many other components in a system.
2
A laptop or desktop will often have dozens of different processors effectively running their own operating systems. The main difference with phones is that more of this is provided by a unified SoC from one company with shared security work, rather than many different companies.
1
There was discussion while back about librem to provide security by isolation like qubes os. Arguments against were cpu hog and bad ux. Not sure was it for laptop or phone...
1
Virtualization is only one possible option for implementing isolation. I'm also not even talking about providing a substantially more secure OS but rather just not substantially rolling back privacy and security from the existing mainstream mobile OS options.
2
There are announced projects aiming to provide products with better security than existing options such as trustless.ai but skepticism about potential products like those that do not yet exist for public use are probably a good idea. That example is also not a phone.
1
Shoving an OS based on the Linux kernel into a virtual machine can't eliminate the security issues from the insecure Linux kernel design. It's still a massively complex monolith written in a memory unsafe language with a poor type system exposing lots of attack surface.
QubesOS doesn't make isolated compartments more resistant to compromise on their own. It still depends on those to secure themselves against attacks. What it does is give you a far more convenient and cheaper alternative to air gapped systems, but relying on a hypervisor and CPU.