Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

github.com

Post reply on HN
Print view View original

121–130 of 142 posts

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#121

Post by IshKebab »

acatton wrote: post #68
jvanderbot wrote: post #52

Earlier quoted context omitted.

How much of this is outdated practice? Shouldn't TCP/TLS be doing checksum and origin signing already? In the days of FTP, checksum and gpg were vital. With http/TCP, you need more GPG due to TCP handling retries checksum etc, but still both due to MitM. But with https, how does it still matter? It's doing both verifications and signature checks for you.

TLS prevents a different kind of attack, the MitM one which you describe. GPG signing covers this threat model but much more, the threats include: * The server runs vulnerable software and is compromised by script-kiddies. They, then, upload arbitrary packages on the server * The cloud provider is compromised and attackers take over the server from the admin cloud provider account. * Attacker use a vulnerability (fro…

> They then upload arbitrary packages on the server

And change the instructions to point to a different GPG key (or none at all).

I think the only situation it possibly helps in is if you are using untrusted mirrors. But then a simple checksum does that too. No need for GPG.

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#122

Post by heavyset_go »

_joel wrote: post #28

Shout out to https://virt-manager.org/ - works much better for me, supports running qemu on remote systems via ssh. I used to use this all the time for managing bunches of disparate vm hosts and local vms.

I wish Quickemu would make it easier to interface with libvirt, but apparently that's been marked as out of scope for the project.

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#123

Post by petepete »

_joel wrote: post #28

Shout out to https://virt-manager.org/ - works much better for me, supports running qemu on remote systems via ssh. I used to use this all the time for managing bunches of disparate vm hosts and local vms.

Virt Manager is fantastic. I've used it for more than a decade and it's been rock solid throughout.

Being able to connect to my TrueNAS Scale server and run VMs across the network is the icing on the cake.

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#124

Post by [deleted] »

arghwhat wrote: post #47
nu11ptr wrote: post #37

Earlier quoted context omitted.

Why is it different from any other software just because it is a shell script? Do you read the kernel sources for your OS before running it? Your web browser? My point is not that we should blindly run things, but that we all have criteria for what software we choose to run that typically doesn't rely on being familiar with its source code.

Well, yes, I read code of (and contribute to) the kernel and web browsers I use, but that's not really relevant. There's a big difference between "large, structured projects developed by thousands of companies with a clear goal" vs. "humongous shell script by small group that downloads and runs random things from the internet without proper validation". And my own personal opinion: The venn diagram of "Projects that…

[deleted]

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#125

Post by thatfunkymunki »

xmichael909 wrote: post #93
_joel wrote: post #28

Shout out to https://virt-manager.org/ - works much better for me, supports running qemu on remote systems via ssh. I used to use this all the time for managing bunches of disparate vm hosts and local vms.

I just wish it had a web interface option, but I guess there is always proxmox.

Cockpit has a good web interface for libvirt

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#126

Post by nightowl_games »

jmb99 wrote: post #59
nightowl_games wrote: post #57

Anyone know if I can I legitamately make and submit iPhone builds off a macosx VM?

Technically, yes probably. You’ll be breaking Apple’s ToS though, so depends how big of a fish you are as to whether Apple cares.

How will they know?

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#127

Post by mmh0000 »

jthemenace wrote: post #87
_joel wrote: post #28

Shout out to https://virt-manager.org/ - works much better for me, supports running qemu on remote systems via ssh. I used to use this all the time for managing bunches of disparate vm hosts and local vms.

Anyone running virt-manager on mac connecting to a headless linux hypervisor on the same network? I tried installing it through "brew", but was getting many random errors. I thought about running it over the network using XQuartz, but I'm not sure how maintained / well supported that is anymore.

In virt-manager, you should* be able to go to file -> add connection.

Select Hypervisor "Custom URL", and enter: qemu+ssh://root@/system

And Bob's your uncle.

It works great for me! This means it likely won't work for you until you've paid the proper penance to the computer god.

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#128

Post by st3fan »

yjftsjthsd-h wrote: post #105
st3fan wrote: post #85

Earlier quoted context omitted.

Yes but we abandoned that idea a while ago. There are no more green locks in browsers. Nobody buys those expensive certificates that proof ownership. When you curl something it doesn't show anything unless it is an actual invalid certificate. You are correct that it _should mean_ but reality today is that it doesn't mean anything.

No, it still means that you've connected to the domain that you wanted to connect to and the connection is reasonably resistant to MITM attacks. It doesn't say anything about who controls the domain, but what it provides still isn't nothing.

It is not about the domain.

"It is not a good indicator of trustworthiness of the actual thing you download."

I just downloaded something with malware from github.com. I indeed wanted to connect to github.com and I trust that it is Github.com. But again ... it did not say _anything_ about the trustworthyness of the _actual_ thing I did, which was to download an asset from that domain.

That is my point. In the context of this discussion about downloading dependencies.

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#129

Post by saagarjha »

xrd wrote: post #99
saagarjha wrote: post #97

Earlier quoted context omitted.

This is only true for products based on the Virtualization framework. Intel “Macs” can sign in just fine. (Also, I think you can authenticate things with an API key these days rather than your credentials?)

Meaning, Intel vms? This is great. I'll check it out.

Yep. Give it a try!

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#130

Post by funcDropShadow »

hn_throwaway_99 wrote: post #69
st3fan wrote: post #41

Earlier quoted context omitted.

Because you wrote HTTPS in italic .. HTTPS doesn't mean anything. Both the good and bad actors can have perfectly valid HTTPS configured. It is not a good indicator of trustworthiness of the actual thing you download.

> HTTPS doesn't mean anything. That's not accurate at all. HTTPS should mean "we've validated that the content you're receiving comes from the registered domain that you've hit". Yes, it's possible that the domain host itself was compromised, or that the domain owner himself is malicious, but at the end of the day you have to trust the entity you're getting the content from. HTTPS says, importantly, "You're getting t…

But by using GPG to check the authenticity of the actual files that are downloaded, we can remove the web site -- whether https is sufficienctly secure or not -- from the trust chain all together. The shorter the trust chain, the better.
Post reply on HN