On @Subgraph vs. @QubesOS: Both projects matter, but most face user-auth'd "click me pls" vectors, not NSA. PaX can't block the "OK" button.

the whole point of PaX is that you *can* click any OK button without getting owned. not there yet but close :).

Can you please point to some URLs describing why this is (will be) so? Thanks.