Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Easter Egg Hidden in VMWare Fusion and Workstation

misc.name

Post reply on HN
Print view View original

21–30 of 49 posts

Re: Easter Egg Hidden in VMWare Fusion and Workstation

#21

Post by onion2k »

PeterWhittaker wrote: post #18
ayrx wrote: post #2

Am I the only one not amused by easter eggs in software? It's code that I don't know about doing stuff that I don't know about. More code means more chances for bugs, maybe even bugs that results in security vulnerabilities. If the programmer snuck it in without management approval, it may mean code that isn't as thoroughly tested as the rest of the program.

No, you're not the only one. I share your concern for all the reasons you cite. I'm also concerned about the development process itself. Design reviews? Code reviews? Automated testing? CI/CD? What is the impact of an easter egg on these things? Were the eggs noticed and tacitly approved? What does this tell us about the process? Do I want to rely on the product of that process? Or are we saying we don't care? I appr…

Were the eggs noticed and tacitly approved? What does this tell us about the process?

It doesn't tell us anything about the production process at VM because we don't know if they were noticed and approved or not noticed. Don't assume either way.

Imagine an easter egg in your car's navigation system.

No need to imagine it.. http://www.gpsinformation.org/dale/secret.htm

Re: Easter Egg Hidden in VMWare Fusion and Workstation

#22

Post by just_bytecode »

ayrx wrote: post #2

Am I the only one not amused by easter eggs in software? It's code that I don't know about doing stuff that I don't know about. More code means more chances for bugs, maybe even bugs that results in security vulnerabilities. If the programmer snuck it in without management approval, it may mean code that isn't as thoroughly tested as the rest of the program.

In this case the majority of the easter egg code is running inside the VM sandbox. It's very unlikely but not impossible that the small amount of code needed to load the hidden disk image when a key combo is pressed would contain a major bug.

Personally I like it. It's a fun little touch

Re: Easter Egg Hidden in VMWare Fusion and Workstation

#23

Post by rbanffy »

ayrx wrote: post #2

Am I the only one not amused by easter eggs in software? It's code that I don't know about doing stuff that I don't know about. More code means more chances for bugs, maybe even bugs that results in security vulnerabilities. If the programmer snuck it in without management approval, it may mean code that isn't as thoroughly tested as the rest of the program.

Since the software is closed, there is no code you know about and everything in there is doing stuff you don't know about with the exception of the intended consequences of the software. All you have is the publisher's promise it does only what it's intended to do.

Having said that, putting an easter egg in there denotes some kind of love for the product. I like that.

Re: Easter Egg Hidden in VMWare Fusion and Workstation

#24

Post by TeMPOraL »

ayrx wrote: post #20
TeMPOraL wrote: post #19

Earlier quoted context omitted.

Because it's fun . As the industry matures, people seem to lose the sense of humuor - which is sad, because practical jokes and playfullness is what created said industry.

There is a time and place for humor. Important software is not one of them. When I run something on my machine I want it to do exactly what it is supposed to, nothing more and nothing less. You won't be laughing if $RANDOM_EASTER_EGG has a bug that allows for remote code execution.

> There is a time and place for humor. Important software is not one of them.

Thing is, everyone seems to think the place and time is everywhere but not here and now. Companies today tend to have inflated sense of importance and gloominess stemming from what I believe is a mistaken understanding of professionalism.

> You won't be laughing if $RANDOM_EASTER_EGG has a bug that allows for remote code execution.

Hell yes I'll be laughing, I always laugh from remote code execution bugs ;). Anyway, you can argue that for any piece of code. Sure, an easter egg increases the surface of attack... by 0.1% or something.

Re: Easter Egg Hidden in VMWare Fusion and Workstation

#25

Post by officialjunk »

blowski wrote: post #9

This is just an article linking to an article[1], which itself links to a Google translation of an article written in French[2]. [1] http://www.virtuallyghetto.com/2013/09/vmware-nested-easter-... [2] http://www.hypervisor.fr/?p=4063

This is the personal blog post of the author of the easter egg.

Re: Easter Egg Hidden in VMWare Fusion and Workstation

#26

Post by Someone1234 »

psk wrote: post #5

Is easter eggs in VM a good idea? Couldn't malware attempt to locate potential easter eggs in order to determine if they are in a honeypot?

> Couldn't malware attempt to locate potential easter eggs in order to determine if they are in a honeypot?

No. This is a key combination against the UI. If the VM could send key combinations to the UI of the VMC then the software running on the VM could determine if it was in a "honeypot" (VM) with or without this easter-egg (e.g. send CTRL-ALT-INSERT and see if CTRL-ALT-DELETE is triggered within the VM's context, restart the VM, alter connected devices, and so on).

Also, yes, I think Easter Eggs are fine in a VMC. Particularly when they're only UI deep as is this case. The only software I wouldn't put easter eggs into is software which is "life-death critical" (aircraft control systems, industrial equipment, et al). But these kind of systems are sometimes designed to be mathematically proven safe with no possible conflating variables in the execution (so putting in easter eggs would be HUGELY expensive and likely wouldn't happen for that reason).

Re: Easter Egg Hidden in VMWare Fusion and Workstation

#27

Post by Someone1234 »

aaron695 wrote: post #11
ayrx wrote: post #2

Am I the only one not amused by easter eggs in software? It's code that I don't know about doing stuff that I don't know about. More code means more chances for bugs, maybe even bugs that results in security vulnerabilities. If the programmer snuck it in without management approval, it may mean code that isn't as thoroughly tested as the rest of the program.

A programmer who bothers to put in an Easter egg to me has pride in what they are creating and also gives them more ownership. So I see it as both an indicator of good work and a positive thing. Yes, other's believe that Easter eggs are bad I assume you're referring to the famous http://blogs.msdn.com/b/larryosterman/archive/2005/10/21/483... It has good points but I believe it to be wrong in conclusion, there's lots…

I agree with Easter Eggs in products. That being said another good example of an "Easter Egg gone wrong" was the games in Excel 95 and 97.

Excel 95 had a "Doom"-like 3D game. Excel 97 had a basic flight simulator. These were fun and weren't buggy, but here's the problem:

How much time do you think was lost in classrooms in particular after all the kids discovered there were games they could be playing instead of working? All of the built in Windows games were removed, and Flash/Java weren't installed. But you cannot remove these if you need Excel.

This was a legitimate issue in the 1990s. So much so that the school I attended gave anyone detention caught playing these games during class time(!). Yet every class there would be someone sitting in the corner playing away.

Re: Easter Egg Hidden in VMWare Fusion and Workstation

#28

Post by mendort »

TeMPOraL wrote: post #24
ayrx wrote: post #20

Earlier quoted context omitted.

There is a time and place for humor. Important software is not one of them. When I run something on my machine I want it to do exactly what it is supposed to, nothing more and nothing less. You won't be laughing if $RANDOM_EASTER_EGG has a bug that allows for remote code execution.

> There is a time and place for humor. Important software is not one of them. Thing is, everyone seems to think the place and time is everywhere but not here and now. Companies today tend to have inflated sense of importance and gloominess stemming from what I believe is a mistaken understanding of professionalism. > You won't be laughing if $RANDOM_EASTER_EGG has a bug that allows for remote code execution. Hell yes…

Exactly. Anyone who objects to easter eggs because they may accidentally introduce vulnerabilities should be objecting much more strongly to features of the application that they don't need. If you want to know every aspect of a program, then you need to own the code and be brutal about stripping out features that you aren't currently using.

Re: Easter Egg Hidden in VMWare Fusion and Workstation

#29

Post by pyre »

walterbell wrote: post #17
walterbell wrote: post #4

Earlier quoted context omitted.

It would be acceptable if each easter egg lasted a maximum of one release, followed by a public post-mortem on the vulnerability identified in the release management process.

To the three downvoters: are you saying that easter eggs are approved by the release management process? Wouldn't that make them features?

Easter eggs wouldn't be considered features (even if management-approved) because they are not advertised, and they do not perform a function related to the application. For example, if management approved a flight simulator in Excel '97, would you still consider if a 'feature' of Excel '97?

Re: Easter Egg Hidden in VMWare Fusion and Workstation

#30

Post by cujo »

Someone1234 wrote: post #27
aaron695 wrote: post #11

Earlier quoted context omitted.

A programmer who bothers to put in an Easter egg to me has pride in what they are creating and also gives them more ownership. So I see it as both an indicator of good work and a positive thing. Yes, other's believe that Easter eggs are bad I assume you're referring to the famous http://blogs.msdn.com/b/larryosterman/archive/2005/10/21/483... It has good points but I believe it to be wrong in conclusion, there's lots…

I agree with Easter Eggs in products. That being said another good example of an "Easter Egg gone wrong" was the games in Excel 95 and 97. Excel 95 had a "Doom"-like 3D game. Excel 97 had a basic flight simulator. These were fun and weren't buggy, but here's the problem: How much time do you think was lost in classrooms in particular after all the kids discovered there were games they could be playing instead of work…

I find it hilarious that you're upset with easter eggs in principle because kids were distracted during class. I'm sure all those kids couldn't hack it in the real world because of these awful distractions.
Post reply on HN