Qubes OS Security in the Public Record
Summary
arXiv preprint analyzing Qubes OS security through a longitudinal study of 109 public Qubes Security Bulletins and the Xen Security Advisory tracker. The paper methodically measures the public advisory record rather than actual incidents, revealing upstream dependencies and patterns in disclosure, including a dominant break in 2015Q1 and a plateau in disclosures after 2018. The work emphasizes a rigorous, protocol-driven approach to vulnerability data and its implications for security assessment and transparency.