Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

github.com

Post reply on HN
Print view View original

41–50 of 142 posts

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#41

Post by st3fan »

colejohnson66 wrote: post #18
acatton wrote: post #8

Just a security reminder from the last time this got posted[1] This tool downloads random files from the internet, and check their checksum against other random files from the internet. [2] This is not the best security practice. (The right security practice would be to have the gpg keys of the distro developers committed in the repository, and checking all files against these keys) This is not downplaying the effort…

Can someone explain how this is a security problem? While GPG key verification would be the best way to ensure authenticity, it's doing nothing different from what almost everyone does: download the ISO from the distro's own HTTPS site. It then goes beyond what most people do and validates that the hashes matche.

Because you wrote HTTPS in italic .. HTTPS doesn't mean anything. Both the good and bad actors can have perfectly valid HTTPS configured. It is not a good indicator of trustworthiness of the actual thing you download.

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#42

Post by Joker_vD »

repelsteeltje wrote: post #25
colejohnson66 wrote: post #18

Earlier quoted context omitted.

Can someone explain how this is a security problem? While GPG key verification would be the best way to ensure authenticity, it's doing nothing different from what almost everyone does: download the ISO from the distro's own HTTPS site. It then goes beyond what most people do and validates that the hashes matche.

Absolutely true, but one additional factor (or vector) is that this adds a level of indirection. That is, you're trusting the Quickemu people to take the same diligence you yourself would do when downloading an ISO from, say ubuntu.com for each and every target I can conveniently install with Quickemu. It's a subtle difference, but the trust-chain could indeed be (mildly) improved by re-distributing the upstream gpg…

Eh, you can fetch the GPG keys from some GPG keyserver, it's not like those keys are just random files from the Internet. They're cross-signed, after all!

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#44

Post by [deleted] »

cmiller1 wrote: post #34
prmoustache wrote: post #20

Earlier quoted context omitted.

Also, author is typing his user password during live streaming with a mechanical keyboard while microphone is on.

While this comment doesn't seem 100% serious, I wonder if this kind of attack is made less effective by the trend in mechanical keyboards to isolate the PCB and plate from the case acoustically, e.g. gasket mount, flex cuts, burger mods. In my experience the effect of these changes is each key sounds more similar to the others rather than the traditional case mount setup where each key sound changes drastically based…

[deleted]

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#45

Post by hnfong »

nu11ptr wrote: post #37
arghwhat wrote: post #13

The convenience of such a tool is great, but it's also ~5000 lines of bash across the two main scripts. I'd want to vet such a thing before I run it, but I also really don't want to read 5000 lines of bash.

Why is it different from any other software just because it is a shell script? Do you read the kernel sources for your OS before running it? Your web browser? My point is not that we should blindly run things, but that we all have criteria for what software we choose to run that typically doesn't rely on being familiar with its source code.

I believe GP implicitly assumes that bash (and generally POSIX-y shell script) has lots of quirks and footguns (to which I generally agree).

After skimming through the source code though, I'd say the concerns are probably overstated.

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#46

Post by dncornholio »

acatton wrote: post #8

Just a security reminder from the last time this got posted[1] This tool downloads random files from the internet, and check their checksum against other random files from the internet. [2] This is not the best security practice. (The right security practice would be to have the gpg keys of the distro developers committed in the repository, and checking all files against these keys) This is not downplaying the effort…

My red flag was that there is no explanation of what an "optimised" image is.

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#47

Post by arghwhat »

nu11ptr wrote: post #37
arghwhat wrote: post #13

The convenience of such a tool is great, but it's also ~5000 lines of bash across the two main scripts. I'd want to vet such a thing before I run it, but I also really don't want to read 5000 lines of bash.

Why is it different from any other software just because it is a shell script? Do you read the kernel sources for your OS before running it? Your web browser? My point is not that we should blindly run things, but that we all have criteria for what software we choose to run that typically doesn't rely on being familiar with its source code.

Well, yes, I read code of (and contribute to) the kernel and web browsers I use, but that's not really relevant.

There's a big difference between "large, structured projects developed by thousands of companies with a clear goal" vs. "humongous shell script by small group that downloads and runs random things from the internet without proper validation".

And my own personal opinion: The venn diagram of "Projects that have trustworthy design and security practices", and "projects that are based on multi-thousand line bash scripts" is two circles, each on their own distinct piece of paper.

(Not trying to be mean to the developers - we all had to build our toolkits from somewhere.)

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#48

Post by antongribok »

_joel wrote: post #28

Shout out to https://virt-manager.org/ - works much better for me, supports running qemu on remote systems via ssh. I used to use this all the time for managing bunches of disparate vm hosts and local vms.

I know it's not the same thing, but Quickemu happily works over SSH too.

Run it on a remote system via ssh, and it will "X-Forward" the Qemu console on my local Wayland session in Fedora.

First time I ran it, thinking I was doing a headless mode, and it popped up a window, was quite surprising. :)

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#49

Post by ge0rg »

yoyoinbog wrote: post #3

Looks interesting but would someone be so kind to point out if there are any advantages for a guy like me who just runs win 11 in VirtualBox under Ubuntu from time to time?

Especially regarding GPU acceleration... Running video-conferencing inside windows inside vbox is almost impossible, and even modestly complex GUI apps have a significant lag there.
Post reply on HN