Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Netboot

netboot.xyz

Post reply on HN
Print view View original

21–30 of 48 posts

Re: Netboot

#21

Post by organsnyder »

bodyfour wrote: post #9
akerro wrote: post #6

Earlier quoted context omitted.

Run: sh | wget http://www...something.com/install.sh to install something automatically! Way too many projects do it, from my head: rvm and oh-my-zsh.

No worse than "./configure && make && sudo make install"

If that's being run for code you've downloaded from an untrusted location, then I'd agree with you. However, almost every project that has those instructions starts with "download it from this trusted location, verify its integrity using this GPG key...".

Of course, you have to start trusting at some point. But with HTTP, you have to also trust the wifi AP, its owner, all of the routers between you and the server, DNS... At least https takes a lot of those (but not all) out of the equation, while GPG goes even further.

Re: Netboot

#23

Post by mercora »

After boot.kernel.org and netboot.me seem dead now i like to see this kind of thing available again. I acknowledge the threat of downloading these boot images over the internet but think it is actually not that much different from downloading the iso... from the internet. Sure, i could verify the image more easily but i barely did this in the past. However the ability to verify the the images would be nice though.

Re: Netboot

#24

Post by theantonym »

mercora wrote: post #23

After boot.kernel.org and netboot.me seem dead now i like to see this kind of thing available again. I acknowledge the threat of downloading these boot images over the internet but think it is actually not that much different from downloading the iso... from the internet. Sure, i could verify the image more easily but i barely did this in the past. However the ability to verify the the images would be nice though.

Dev here. The project is just a bunch of iPXE scripts that understands how each distro works and routes you to their hosted bits or a trusted mirror once you select the image. I've tried to keep all of the code on Github and the Travis CI deployment out in the open for that very reason. A project like this needs to be highly visible in order to be trusted to a degree. I also have things like image verification and https support on the list of things to do.

Re: Netboot

#26

Post by mavdi »

joosters wrote: post #16
akerro wrote: post #6

Earlier quoted context omitted.

Run: sh | wget http://www...something.com/install.sh to install something automatically! Way too many projects do it, from my head: rvm and oh-my-zsh.

The problem with this is that the bootloader downloads and runs the code without giving any chance to inspect it. If you download the code manually, how are you to know that the server sent you the exact same code? They could be checking HTTP headers for a bootloader device, or might only be infecting 1 in 100 downloads. You'd never spot it.

You can always examine the code right? https://github.com/antonym/netboot.xyz/blob/master/src/coreo... Uses official images as far as I can see

Re: Netboot

#27

Post by joosters »

mavdi wrote: post #26
joosters wrote: post #16

Earlier quoted context omitted.

The problem with this is that the bootloader downloads and runs the code without giving any chance to inspect it. If you download the code manually, how are you to know that the server sent you the exact same code? They could be checking HTTP headers for a bootloader device, or might only be infecting 1 in 100 downloads. You'd never spot it.

You can always examine the code right? https://github.com/antonym/netboot.xyz/blob/master/src/coreo... Uses official images as far as I can see

Sure, you could compile it yourself, then host it yourself. Relying on the remote server is the problematic part.

Re: Netboot

#28

Post by matt_wulfeck »

This is a really neat idea security concerns aside. I have about 5 minutes USB drives laying around with various OS versions. Sometimes I just want to you with something (such as mint Linux) and this kind of thing is ideal! Thanks dev, great work!

Re: Netboot

#29

Post by mavdi »

joosters wrote: post #27
mavdi wrote: post #26

Earlier quoted context omitted.

You can always examine the code right? https://github.com/antonym/netboot.xyz/blob/master/src/coreo... Uses official images as far as I can see

Sure, you could compile it yourself, then host it yourself. Relying on the remote server is the problematic part.

I see. Correct.

Re: Netboot

#30

Post by mawalu »

A short idea after seeing some people complaining about the security. Wouldn't it be possible to host the IPXE scripts itself on gh-pages? That way the hosting would be complete transparent and the .github.io domain would work over SSL
Post reply on HN