Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Netboot

netboot.xyz

Post reply on HN
Print view View original

11–20 of 48 posts

Re: Netboot

#11

Post by viraptor »

bodyfour wrote: post #9
akerro wrote: post #6

Earlier quoted context omitted.

Run: sh | wget http://www...something.com/install.sh to install something automatically! Way too many projects do it, from my head: rvm and oh-my-zsh.

No worse than "./configure && make && sudo make install"

It's a bit different though. autoconf/automake is mostly autogenerated and will prevent silly issues like accidental wiping of your drive (https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/issue...). Released packages will often have hashes either on the website or as additional download. With git you can verify tags (provided they're signed). You can compile&test package inside chroot before installing. Etc. etc.

In theory, yes, `curl | sh` is the same as configure&make is the same as downloading your initial iso image and installing the system from it. In practice they have different risks associated with them.

Re: Netboot

#12

Post by gravypod »

1ris wrote: post #5
gravypod wrote: post #3

Running unsigned code from the internet? Have I woken up in crazy land today? When did things like this become acceptable.

People are running untrused code all the time. How uses a 100% open source, repoducably build, 100% audited os?

The problem is that this is going over the intenet. If you haven't seen what kind of problems this can cause, you should look at moxie sslstrip talk from defcon. The problem arises when other people want root access to your system and they can now get it from a VERY simple man in the middle.

Running untrusted code is one thing, running it after pulling it from the internet is an ENTIRELY different subject.

Re: Netboot

#13

Post by gravypod »

p4bl0 wrote: post #4
gravypod wrote: post #3

Running unsigned code from the internet? Have I woken up in crazy land today? When did things like this become acceptable.

I had the exact same reaction (and friends over IRC too), but I still find the idea quite cool: it could be implemented correctly (with signature verification or something alike). Also, if it is just to try out a new OS in a virtual machine, I guess it is okay to use such a service :).

Yes, but you would probably want to have a local copy of all public keys for the OSs for verification, it would have to go over HTTPS, and You would likely need some signature validation.

The idea is really cool, specifically I'd use this for the raspberry pi. I hope someone does some major security maintenance on this

Re: Netboot

#15

Post by akerro »

viraptor wrote: post #11
bodyfour wrote: post #9

Earlier quoted context omitted.

No worse than "./configure && make && sudo make install"

It's a bit different though. autoconf/automake is mostly autogenerated and will prevent silly issues like accidental wiping of your drive ( https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/issue... ). Released packages will often have hashes either on the website or as additional download. With git you can verify tags (provided they're signed). You can compile&test package inside chroot before installing. Etc.…

What about AUR from ArchLinux? It's similar, but it also has different risks, Vidalia/Tor-git maintainers change quite often, users are forced to add new GPG keys, but it downloads src from git (quite often).

What about `cd /usr/ports/www/firefox && make clean install`?

Re: Netboot

#16

Post by joosters »

akerro wrote: post #6
gravypod wrote: post #3

Running unsigned code from the internet? Have I woken up in crazy land today? When did things like this become acceptable.

Run: sh | wget http://www...something.com/install.sh to install something automatically! Way too many projects do it, from my head: rvm and oh-my-zsh.

The problem with this is that the bootloader downloads and runs the code without giving any chance to inspect it.

If you download the code manually, how are you to know that the server sent you the exact same code? They could be checking HTTP headers for a bootloader device, or might only be infecting 1 in 100 downloads. You'd never spot it.

Re: Netboot

#17

Post by bodyfour »

viraptor wrote: post #11
bodyfour wrote: post #9

Earlier quoted context omitted.

No worse than "./configure && make && sudo make install"

It's a bit different though. autoconf/automake is mostly autogenerated and will prevent silly issues like accidental wiping of your drive ( https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/issue... ). Released packages will often have hashes either on the website or as additional download. With git you can verify tags (provided they're signed). You can compile&test package inside chroot before installing. Etc.…

Sure, autoconf is generated, but often develops have to add custom rules.. and do it with arcane m4 macros to boot. I think they're similarly prone to mistakes.

For nefarious purposes I actually think it's worse than the much-maligned "curl|sh" scenario. I bet a reasonable number of people will end up trying to download the script, out of curiosity if nothing else. If it's doing anything not straightforward, it would get attention. In contrast, who would notice a line added to the middle of a 8000 line auto-generated configure script?

Re: Netboot

#18

Post by alfiedotwtf »

jamescun wrote: post #2

NetBooting from the internet AND over HTTP? Sign me up! Sarcasm aside, at the very least it would have been nice to see it use iPXE's `imgtrust` and `imgverify` functionality, which I could then audit and load on to a boot medium for netboot use.

For any naysayers, there's no difference between this project and say Hashicorps' images. You're either using upstream, or you're not. But yeah, you probably want a cert.

To be honest, this looks like a cool project. I've always wanted a way to PXE without having to need another host on the LAN.

Re: Netboot

#19

Post by viraptor »

bodyfour wrote: post #17
viraptor wrote: post #11

Earlier quoted context omitted.

It's a bit different though. autoconf/automake is mostly autogenerated and will prevent silly issues like accidental wiping of your drive ( https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/issue... ). Released packages will often have hashes either on the website or as additional download. With git you can verify tags (provided they're signed). You can compile&test package inside chroot before installing. Etc.…

Sure, autoconf is generated, but often develops have to add custom rules.. and do it with arcane m4 macros to boot. I think they're similarly prone to mistakes. For nefarious purposes I actually think it's worse than the much-maligned "curl|sh" scenario. I bet a reasonable number of people will end up trying to download the script, out of curiosity if nothing else. If it's doing anything not straightforward, it would…

That wasn't my point. configure doesn't prevent malicious behaviour, but it would prevent silly mistakes at install time. (unless you actively break out of macro environment)

The point is, technically there isn't anything different between `curl | sh` and installing a system from either a downloaded .iso or a mailed DVD. Both run code from untrusted sources on your computer. But in practice they're very different because of user behaviour and ability to validate data before running. There's a whole spectrum in between and configure&make is somewhere on it.

Re: Netboot

#20

Post by Mojah »

I'm happy to see the PXE booting scene get a new revival. It's one of those crucial services that's often neglected. It's also not a very "sexy" place to do development in, but boy it's good to see a proper tool emerge.

Fyi, I first heard about Netboot via the cron.weekly newsletter last Sunday, it seems to be a very new project that's only just been released: http://www.cronweekly.com/issue-11/

Post reply on HN