111–120 of 123 posts
Earlier quoted context omitted.
It seems to be grabbing the MacOS system recovery images straight off of Apple's servers.
Which, without some form of certificate pinning, could still be MITM'd. At least if there's a catalogue of hashes for everything it downloads (hard-coded or configurable by the user, latter preferred) then at least it can verify the right files are being downloaded regardless of source.
https://support.apple.com/guide/security/recoveryos-and-diag...
> When the internet recovery and diagnostic modes were added to Mac computers in 2011, it was decided that it would be better to use the simpler HTTP transport, and handle content authentication using the chunklist mechanism, rather than implement the more complicated HTTPS functionality in the UEFI firmware, and thus increase the firmwareʼs attack surface.
¹https://github.com/acidanthera/OpenCorePkg/blob/4a740c3f256e...
[edit] Added macrecovery.py info
Earlier quoted context omitted.
As with all information, society as a whole "owns" macOS - Apple only has been granted a temporary monopoly of this information in order to encourage them to create more.
Practically, what’s the difference until their copyright expires?
That is not to say that numerous judges have not, on their own initiative, elected to grant holders many such powers. Judges can be just as confused as anyone, and more than some, and so exceed their statutory authority. Congress, moreso. But there is still a difference.
While I appreciate the effort, and the code is very readable. I just want to give a friendly warning that these shell scripts just download random stuff from the internet and run this random stuff without checking any integrity/signature. Apart from that, I will definitely use that project as a documentation for "how to run MacOS/Windows in KVM". Cool project :) .
It does check SHA256 for Ubuntu images, but nothing else I could see. https://github.com/wimpysworld/quickemu/blob/af26f41440d63a0...
Earlier quoted context omitted.
I think that the illegal (ish) part comes from Apple making macOS free if you're installing it on Apple hardware. They don't publicly license it for use on non-Apple hardware, although, I would guess that VMWare if not others has a license to run it on random x64 servers to test ESXi with because setting up a different testing environment of Mac Minis to test every change to their hypervisor on instead of using their…
> I think that the illegal (ish) part comes from Apple making macOS free if you're installing it on Apple hardware. I don't think it's true since the phrase in question was present also in Mac OS X when we had to purchase each version. Apart from that, this part of the license is not valid in several European countries. When you think of it, it's quite reasonable: how could anyone dictate how you are using something…
Do you have a link maybe? My quick search found nothing...
Why? I’m happy with Vagrant (libvirt/VirtualBox), Multipass and LXD (also provides secreboot + UEFI VMs + USB redirection). No need for another tool.
Can multipass launch an accelerated virgl desktop? Vagrant depends on premade boxes normally built with packer. This tool is much more convenient
I’m using several packer templates and prebuilt vagrant boxes and vagrant’s workflow is much better than this strange NIH tool.
I want to run many old windows [95 - XP] applications and games. If there is a way to have minimal os emulator (at least with all dependencies of that app/game) it would be great to have it as a container for that app. I tried setting up qemu once by downloading many images. Almost none worked with apps I wanted to run. Also I had a very hard time finding a sane qemu documentation in one place. It's wiki is very mess…
Best I've found so far is dosbox-x at https://dosbox-x.com/
I have tried to use it a few times but got overwhelmed by all the options. From the screenshot it looks exactly what I want (only for windows 98 though).
I want to run many old windows [95 - XP] applications and games. If there is a way to have minimal os emulator (at least with all dependencies of that app/game) it would be great to have it as a container for that app. I tried setting up qemu once by downloading many images. Almost none worked with apps I wanted to run. Also I had a very hard time finding a sane qemu documentation in one place. It's wiki is very mess…
I haven't tested it yet, but I recently came across boxedwine[0] which is basically wine + an emulation of the linux syscalls + graphical api forwarded to the host. All that wrapped in SDL. [0] http://www.boxedwine.org/
Earlier quoted context omitted.
It seems to be grabbing the MacOS system recovery images straight off of Apple's servers.
Which, without some form of certificate pinning, could still be MITM'd. At least if there's a catalogue of hashes for everything it downloads (hard-coded or configurable by the user, latter preferred) then at least it can verify the right files are being downloaded regardless of source.
Now, apparently this uses plain http - but if tls/https is an option - any client (like curl/wget) should by definition come with a ssl trust root (os or bundled). If this is mitm'ed, you've got big problems. Certificate pinning doesn't really help that much in this case.