Unfashionably secure: why we use isolated VMs • Hacker News Board

Re: Unfashionably secure: why we use isolated VMs

#41

Post by ThreatSystems » Thu, Jul 25, 2024, 7:13 PM UTC

dboreham wrote: post #6

PedroBatista wrote: post #2

As a permanent "out of style" curmudgeon in the last ~15 years, I like that people are discovering that maybe VMs are in fact the best approach for a lot of workloads and the LXC cottage industry and Docker industrial complex that developed around solving problems created by themselves or solved decades ago might need to take a hike. Modern "containers" were invented to make things more reproducible ( check ) and sim…

For me it's about the ROAC property (Runs On Any Computer). I prefer working with stuff that I can run. Running software is live software, working software, loved software. Software that only works in weird places is bad, at least for me. Docker is pretty crappy in most respects, but it has the ROAC going for it. I would love to have a "docker-like thing" (with ROAC) that used VMs not containers (or some other isolat…

Vagrant / Packer?

Re: Unfashionably secure: why we use isolated VMs

#42

Post by gryfft » Thu, Jul 25, 2024, 7:17 PM UTC

neaanopri wrote: post #23

01HNNWZ0MV43FF wrote: post #10

Earlier quoted context omitted.

Yeah that's kind of a crummy tradeoff. Docker is "Runs on any Linux, mostly, if you have a new enough kernel" meaning it packages a big VM anyway for Windows and macOS VMs are "Runs on anything! ... Sorta, mostly, if you have VM acceleration" meaning you have to pick a VM software and hope the VM doesn't crash for no reason. (I have real bad luck with UTM and VirtualBox on my Macbook host for some reason.) All I want…

The modern developer yearns for Java

Maybe just the JVM.

Re: Unfashionably secure: why we use isolated VMs

#43

Post by sitkack » Thu, Jul 25, 2024, 7:20 PM UTC

applied_heat wrote: post #13

ganoushoreilly wrote: post #4

Earlier quoted context omitted.

Docker is great, way overused 100%. I believe a lot of it started as "cost savings" on resource usage. Then it became the trendy thing for "scalability". When home enthusiasts build multi container stacks for their project website, it gets a bit much.

Solves dependency version hell also

It doesn't solve it, it makes it tractable so you can use the scientific method to fix problems as opposed to voodoo.

Re: Unfashionably secure: why we use isolated VMs

#44

Post by [deleted] » Thu, Jul 25, 2024, 7:21 PM UTC

[deleted] wrote: post #36

anonfordays wrote: post #20

Earlier quoted context omitted.

>Personally FreeBSD Jails / Solaris Zones are the thing I like to dream are pretty much as secure as a VM and a perfect fit for a sane dev and ops workflow, I didn't dig too deep into this is practice, maybe I'm afraid to learn the contrary, but I hope not Having run both at scale, I can confirm and assure you they are not as secure as VMs and did not produce sane devops workflows. Not that Docker is much better, but…

[deleted]

[deleted]

Re: Unfashionably secure: why we use isolated VMs

#45

Post by TurningCanadian » Thu, Jul 25, 2024, 7:23 PM UTC

smallmancontrov wrote: post #31

neaanopri wrote: post #23

Earlier quoted context omitted.

The modern developer yearns for Java

I had to use eclipse the other day. How the hell is it just as slow and clunky as I remember from 20 years ago? Does it exist in a pocket dimension where Moore's Law doesn't apply?

That's not Java's fault though. IntelliJ IDEA is also built on Java and runs just fine.

Re: Unfashionably secure: why we use isolated VMs

#46

Post by SunlitCat » Thu, Jul 25, 2024, 7:27 PM UTC

VMs are awesome for what they can offer. Docker (and the like) are kinda a lean VM for a specific tool scenario.

What I would like to see, would be more App virtualization software which isolates the app from the underlying OS enough to provide an safe enough cage for the app.

I know there are some commercial offerings out there (and a free one), but maybe someone can chime in has some opinions about them or know some additional ones?

Re: Unfashionably secure: why we use isolated VMs

#47

Post by reddit_clone » Thu, Jul 25, 2024, 7:28 PM UTC

analognoise wrote: post #28

PedroBatista wrote: post #2

As a permanent "out of style" curmudgeon in the last ~15 years, I like that people are discovering that maybe VMs are in fact the best approach for a lot of workloads and the LXC cottage industry and Docker industrial complex that developed around solving problems created by themselves or solved decades ago might need to take a hike. Modern "containers" were invented to make things more reproducible ( check ) and sim…

What do you think of Nix/NixOS?

But that comes _after_ you have chosen VMs over Containers yes?

If you are using VMs, I think NixOs/Guix is a good choice. Reproducible builds, Immutable OS, Immutable binaries and Dead easy rollback.

It still looks somewhat futuristic. Hopefully gets traction.

Re: Unfashionably secure: why we use isolated VMs

#48

Post by stacktrust » Thu, Jul 25, 2024, 7:29 PM UTC

SunlitCat wrote: post #46

VMs are awesome for what they can offer. Docker (and the like) are kinda a lean VM for a specific tool scenario. What I would like to see, would be more App virtualization software which isolates the app from the underlying OS enough to provide an safe enough cage for the app. I know there are some commercial offerings out there (and a free one), but maybe someone can chime in has some opinions about them or know som…

HP business PCs ship with SureClick based on OSS uXen, https://news.ycombinator.com/item?id=41071884

Re: Unfashionably secure: why we use isolated VMs

#49

Post by smitty1e » Thu, Jul 25, 2024, 7:35 PM UTC

> Switching to another provider would be non-trivial, and I don’t see the VM as a real benefit in this regard. The barrier to switching is still incredibly high.

This point is made in the context of VM bits, but that switching cost could (in theory, haven't done it myself) be mitigated using, e.g. Terraform.

The brace-for-shock barrier at the enterprise level is going to be exfiltrating all of that valuable data. Bezos is running a Hotel California for that data: "You can checkout any time you like, but you can never leave" (easily).

Re: Unfashionably secure: why we use isolated VMs

#50

Post by qwery » Thu, Jul 25, 2024, 7:36 PM UTC

smallmancontrov wrote: post #31

neaanopri wrote: post #23

Earlier quoted context omitted.

The modern developer yearns for Java

I had to use eclipse the other day. How the hell is it just as slow and clunky as I remember from 20 years ago? Does it exist in a pocket dimension where Moore's Law doesn't apply?

I think it's pretty remarkable to see any application in continuous use for so long, especially with so few changes[0] -- Eclipse must be doing something right!

Maintaining (if not actively improving/developing) a piece of useful software without performance degradation -- that's a win.

Keeping that up for decades? That's exceptional.

[0] "so few changes": I'm not commenting on the amount of work done on the project or claiming that there is no useful/visible features added or upgrades, but referring to Eclipse of today feeling like the same application as it always did, and that Eclipse hasn't had multiple alarmingly frequent "reboots", "overhauls", etc.

[?] keeping performance constant over the last decade or two is a win, relatively speaking, anyway