21–30 of 142 posts
Looks interesting but would someone be so kind to point out if there are any advantages for a guy like me who just runs win 11 in VirtualBox under Ubuntu from time to time?
Sadly “ macOS Monterey, Big Sur, Catalina, Mojave & High Sierra”
It's a QEMU wrapper. I don't know how is this useful. It might save you 2 minutes. Maybe more with windows 11 because of tpm.
Looks like this tries to use better default settings for qemu, which doesn't always have good defaults. I think that is useful practically, as a learning tool, and as a repository of recommended settings.
Just a security reminder from the last time this got posted[1] This tool downloads random files from the internet, and check their checksum against other random files from the internet. [2] This is not the best security practice. (The right security practice would be to have the gpg keys of the distro developers committed in the repository, and checking all files against these keys) This is not downplaying the effort…
Can someone explain how this is a security problem? While GPG key verification would be the best way to ensure authenticity, it's doing nothing different from what almost everyone does: download the ISO from the distro's own HTTPS site. It then goes beyond what most people do and validates that the hashes matche.
It's a subtle difference, but the trust-chain could indeed be (mildly) improved by re-distributing the upstream gpg keys.
Just a security reminder from the last time this got posted[1] This tool downloads random files from the internet, and check their checksum against other random files from the internet. [2] This is not the best security practice. (The right security practice would be to have the gpg keys of the distro developers committed in the repository, and checking all files against these keys) This is not downplaying the effort…
Also, author is typing his user password during live streaming with a mechanical keyboard while microphone is on.
The convenience of such a tool is great, but it's also ~5000 lines of bash across the two main scripts. I'd want to vet such a thing before I run it, but I also really don't want to read 5000 lines of bash.
Over for windows, there's been a constant presence of tweak utilities for decades that attract people trying to get everything out of their system on the assumption that 'big corp' developers don't have the motivation to do so and leave easy options on the table behind quick config or registry tweaks that are universally useful. One that comes to mind which I see occasionally is TronScript which if I had to bet on it passes the 'sniff test' with its history and participation I'd say it's good, but presents itself as automation, abstracting away the details and hoping they make good decisions on your behalf. While you could dig into it and research/educate yourself on what is happening and why, for many it might as well be a binary.
I think only saving grace for this is that most of these tools have a limited audience, so they're not worth compromising. When one brand does become used often enough you may get situations like CCleaner from piriform that was backdoored in 2017.
Sadly “ macOS Monterey, Big Sur, Catalina, Mojave & High Sierra”
Why is it sad?
``` Only the latest major release of macOS (currently macOS Sonoma) receives patches for all known security vulnerabilities.
The previous two releases receive some security updates, but not for all vulnerabilities known to Apple.
In 2021, Apple fixed a critical privilege escalation vulnerability in macOS Big Sur, but a fix remained unavailable for the previous release, macOS Catalina, for 234 days, until Apple was informed that the vulnerability was being used to infect the computers of people who visited Hong Kong pro-democracy websites. ```