Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fun with Red Star OS

sizeof.cat

Post reply on HN
Print view View original

51–60 of 179 posts

Re: Fun with Red Star OS

#51

Post by imwillofficial »

LeanderK wrote: post #22
dheera wrote: post #16

Earlier quoted context omitted.

Why are VMs so bad at virtualizing? An ideal VM should be indistinguishable from a real machine. For example a virtualized system running Android should generate fake IMU data, not sit at 0 linear acceleration all the time. And have a real-looking fake IMEI, not a string of 0s.

I talked to a security researcher about it a few years ago and as I understood it it's a cat and mouse game. They are trying to mimic real phones but the malware authors always find a new way to tell whether it's fake.

I’m not aware of any steps security researches take to obscure the fact they are running in a VM from malware.

Re: Fun with Red Star OS

#52

Post by imwillofficial »

emteycz wrote: post #43
steviedotboston wrote: post #36

this always looked surprisingly well polished to me.

Why is it surprising that the top 1% programmers of an entire country (many of them probably with western education) can produce quality software when put under deadly threat?

The assumes that’s how they are motivated. We also know quality suffers with a gun to your head.

They are far more likely to produce quality work by patriotism or material rewards.

Re: Fun with Red Star OS

#53

Post by emteycz »

thriftwy wrote: post #49
emteycz wrote: post #43

Earlier quoted context omitted.

Why is it surprising that the top 1% programmers of an entire country (many of them probably with western education) can produce quality software when put under deadly threat?

I don't think that any programmers in the DPRK will have access to western education. People who do are many, many tiers up.

At the very least, western educators are coming to them - there were articles about that on HN.

https://www.vice.com/en/article/z4m8qx/how-to-teach-computer...

Re: Fun with Red Star OS

#54

Post by BuildTheRobots »

simonebrunozzi wrote: post #41
jeroenhd wrote: post #34

> Spoiler, he doesn’t give a fuck about your hentai porn. These operating systems do actually contain code that add a signature belonging to your install of the machine to pictures and video files, so be wary if spreading your hentai porn in Kim's country because it can be traced back to you. That said, there's a lot of panic about fears of having it reach out across the internet and infect your entire network withou…

> add a signature belonging to your install of the machine to pictures and video files But why?

The KGB used to require all typewriters to be registered, so they could identify the authors of anything they found objectionable.

Being able to track who produced an image that's doing the rounds spreading "propaganda" seems like it adds a lot of value (from an authoritarian point of view, at least).

Re: Fun with Red Star OS

#55

Post by efficax »

dheera wrote: post #16
_adamb wrote: post #9

Earlier quoted context omitted.

This could be true, or it could recognize that it is running in a VM and change its behavior. This is a somewhat common trait of malware meant to throw off security researchers.

Why are VMs so bad at virtualizing? An ideal VM should be indistinguishable from a real machine. For example a virtualized system running Android should generate fake IMU data, not sit at 0 linear acceleration all the time. And have a real-looking fake IMEI, not a string of 0s.

VM detection and escape (breaking through the VM to access the host machine) is an active area of research and a very hard nut to crack. It's trench warfare!

Re: Fun with Red Star OS

#56

Post by emteycz »

imwillofficial wrote: post #52
emteycz wrote: post #43

Earlier quoted context omitted.

Why is it surprising that the top 1% programmers of an entire country (many of them probably with western education) can produce quality software when put under deadly threat?

The assumes that’s how they are motivated. We also know quality suffers with a gun to your head. They are far more likely to produce quality work by patriotism or material rewards.

I don't think they had a gun to their head literally, or that the threat was voiced - but IMHO not many of them would defy the order and definitely would not try to make the project slow down or fail, due to the implied threat of "disappearance".

> They are far more likely to produce quality work by patriotism or material rewards.

Is that really what you feel as a programmer that has to take free and open software and make it closed and spying while pretending it was your country that made the entire OS and apps and it's not just a rebrand?

I can agree with the material rewards. DPRK can probably make the best offers - maybe they're not paying in USD but most probably still enough to have a house/skyscraper apartment, servants, personal chef and driver, etc.

Re: Fun with Red Star OS

#57

Post by fs111 »

BuildTheRobots wrote: post #54
simonebrunozzi wrote: post #41

Earlier quoted context omitted.

> add a signature belonging to your install of the machine to pictures and video files But why?

The KGB used to require all typewriters to be registered, so they could identify the authors of anything they found objectionable. Being able to track who produced an image that's doing the rounds spreading "propaganda" seems like it adds a lot of value (from an authoritarian point of view, at least).

printers do that too with yellow dots

Re: Fun with Red Star OS

#59

Post by Someone1234 »

BuildTheRobots wrote: post #54
simonebrunozzi wrote: post #41

Earlier quoted context omitted.

> add a signature belonging to your install of the machine to pictures and video files But why?

The KGB used to require all typewriters to be registered, so they could identify the authors of anything they found objectionable. Being able to track who produced an image that's doing the rounds spreading "propaganda" seems like it adds a lot of value (from an authoritarian point of view, at least).

The US still does this today via the MIC:

https://en.wikipedia.org/wiki/Machine_Identification_Code

That's why your color printer cannot print in B&W when you're out of color ink (or at least one reason).

Re: Fun with Red Star OS

#60

Post by ethbr0 »

johnsoft wrote: post #25
dheera wrote: post #16

Earlier quoted context omitted.

Why are VMs so bad at virtualizing? An ideal VM should be indistinguishable from a real machine. For example a virtualized system running Android should generate fake IMU data, not sit at 0 linear acceleration all the time. And have a real-looking fake IMEI, not a string of 0s.

Real hardware is finicky and complex. It would be very slow to virtualize every hardware device in a system to a level not distinguishable to software. If you do shoot for complete accuracy (e.g. projects like 86Box), you take at least a ~100x performance hit, and also lose out on useful features like dragging files into/out of the VM.

For anyone interested in this, read through the Dolphin emulator reports [0].

Specifically, look for examples of bugs they've fixed, and why they were triggered.

At this point, they're essentially all of the "X software depended on a quirk of Y feature, to do (whatever), because the developers chose to do it that way." For that one specific piece of software, and nowhere else.

And that's for a game console with highly standardized hardware and libraries. The general purpose computer has a bit larger mutation surface. :-)

Or, to crib from another sibling poster,

"You have a million places to make sure your virtualization looks like the actual artifact. Of those, 100 are used by everything, 1,000 are used by many things, and 10,000 are used by a few things. The remainder may be used by some piece of software out there, somewhere."

"You have a year to build a working product. Are you going to implement and equally test all million things?"

[0] https://dolphin-emu.org/blog/

Post reply on HN