Update README.md, add screenshot

README.md

@@ -1,6 +1,7 @@
 # vmsilo
 
-A NixOS VM compartmentalization system inspired by Qubes OS. Runs programs in isolated VMs using crosvm (Chrome OS VMM), displaying their windows natively on the host desktop.
+A NixOS VM compartmentalization system inspired by Qubes OS. Runs programs in isolated VMs using crosvm (Chrome OS VMM), displaying their windows natively on the host desktop:
+![vmsilo screenshot](/screenshot.png)
 
 Thanks to Thomas Leonard (@talex5), who wrote the wayland proxy and made qubes-lite, which made this project possible.
 https://gitlab.com/talex5/qubes-lite
@@ -9,11 +10,13 @@ https://gitlab.com/talex5/qubes-lite
 
 The built VMs are full-fat NixOS systems, so they're ~5GB each. You can reuse the same image for multiple VMs by using the same NixOS config and package set for them. The configuration under `programs.vmsilo.nixosVms` is all passed through kernel command line so doesn't affect image reuse.
 
+
 ## Features
 
 - Qubes-style colored window decorations enforced by patched kwin
+- Two-level clipboard like qubes, each VM gets independent clipboard and primary selection buffers
 - Fast graphics
-- Supports many wayland protocols for things like HDR, fractional scaling and smooth video playback
+- Supports wayland protocols for things like HDR, fractional scaling and smooth video playback
 - Each VM gets a folder in the host menu, automatically populated with its programs
 - Sound playback (no sound input yet)
 - VMs can be configured fully disposable with no state kept between restarts
@@ -22,6 +25,7 @@ The built VMs are full-fat NixOS systems, so they're ~5GB each. You can reuse th
 - System tray integration (VM tray applets appear in host system tray, with VM color border)
 - Auto shutdown idle VMs
 
+
 ## Comparison to Qubes
 
 The main benefits compared to Qubes are:
@@ -32,10 +36,9 @@ The main benefits compared to Qubes are:
 The cost for that is security. Qubes is laser-focused on security and hard compartmentalisation. This makes it by far the most secure general-purpose operating system there is.
 
 Ways in which we are less secure than Qubes (list is not even remotely exhaustive):
-- The host system is not isolated from the network at all. The user needs to use discipline to not access untrusted network resources from the host. Even if they do, handling VM network traffic makes the host attack surface much larger.
-- There is no attempt to isolate the host system from hardware peripherals. Qubes segregates USB and network into VMs.
-- Currently clipboard is shared between host and all VMs. This will be fixed at some point, the plan is to implement a two-level clipboard like Qubes.
-- Proxying wayland calls means the attack surface from VM to host is way larger than Qubes' raw framebuffer copy approach.
+- The host system is not isolated from the network or USB at all by default. The user needs to explicitly configure a netvm/usbvm if desired.
+- VM network connections go through host tap interfaces, so the host kernel needs to handle VM packets. If setting up VM networking, use `tap.bridge` to reduce attack surface by limiting host involvement to bridging layer 2 packets.
+- Proxying wayland calls means the attack surface from VM to host is way larger than Qubes' raw framebuffer copy approach. We use a whitelist of allowed wayland protocols to mitigate this somewhat.
 - Probably a million other things.
 
 If you are trying to defend against a determined, well-resourced attacker targeting you specifically then you should be running Qubes.
@@ -74,7 +77,7 @@ Import the module and configure VMs in your NixOS configuration:
         cpus = 4;
         autoShutdown = { enable = true; after = 120; };
         network = {
-          nameservers = [ "1.1.1.1" ];
+          nameservers = [ "9.9.9.9" ];
           interfaces.wan = {
             type = "tap";
             tap.hostAddress = "10.0.0.254/24";
@@ -90,7 +93,7 @@ Import the module and configure VMs in your NixOS configuration:
         cpus = 2;
         autoShutdown.enable = true;
         network = {
-          nameservers = [ "1.1.1.1" ];
+          nameservers = [ "9.9.9.9" ];
           interfaces.wan = {
             type = "tap";
             tap.hostAddress = "10.0.1.254/24";
@@ -114,6 +117,15 @@ Import the module and configure VMs in your NixOS configuration:
 
 ## Usage
 
+### Copy/paste
+
+Like Qubes, each VM has its own independent clipboard (and primary selection) buffer. Copying in a VM window only copies to the VM buffer. To copy between VMs, two new shortcuts are defined:
+
+- Copy VM Clipboard to Host (default ctrl+shift+c): Copies the VM clipboard buffer to the host clipboard buffer
+- Paste Host Clipboard to VM (default ctrl+shift+v): Copies the host clipboard buffer to the VM clipboard buffer
+
+These can be reassigned under Settings -> Shortcuts -> Window Management
+
 ### Video playback
 
 Video playback in VMs works very well. We support the fifo-v1 and presentation-time wayland protocols, so frame timing should be accurate.