Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

github.com

Post reply on HN
Print view View original

61–70 of 142 posts

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#61

Post by freedomben »

arghwhat wrote: post #47
nu11ptr wrote: post #37

Earlier quoted context omitted.

Why is it different from any other software just because it is a shell script? Do you read the kernel sources for your OS before running it? Your web browser? My point is not that we should blindly run things, but that we all have criteria for what software we choose to run that typically doesn't rely on being familiar with its source code.

Well, yes, I read code of (and contribute to) the kernel and web browsers I use, but that's not really relevant. There's a big difference between "large, structured projects developed by thousands of companies with a clear goal" vs. "humongous shell script by small group that downloads and runs random things from the internet without proper validation". And my own personal opinion: The venn diagram of "Projects that…

Heh, this reminds me a bit of when on live television Contessa Brewer tried to dismiss Mo Brooks with "well do you have an economics degree?" and he actually did and responded with "Yes ma'am I do, highest honors" :-D [1]

I have no problem with (and have written a few) giant bash scripts, and I completely agree with you. A giant bash script isn't going to have many eyes on it, whereas a huge project like the kernel is going to get a ton of scrutiny.

[1] https://www.youtube.com/watch?v=5mtQyEd-zS4

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#62

Post by malux85 »

bobim wrote: post #32
prmoustache wrote: post #20

Earlier quoted context omitted.

Also, author is typing his user password during live streaming with a mechanical keyboard while microphone is on.

You mean that the sound of each key is unique and sufficiently different from the others? Or it has to do with how a person is typing?

It doesn’t need to be unique, it just needs to leak enough information to decrease the search space enough to where brute force (or other methods) can kick in.

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#63

Post by bobim »

overengineer wrote: post #38
bobim wrote: post #32

Earlier quoted context omitted.

You mean that the sound of each key is unique and sufficiently different from the others? Or it has to do with how a person is typing?

This is an actual attack surface: https://www.researchgate.net/publication/284949922_Keyboard_...

I’ll be yodeling while typing from now on. Happy open-spacing everyone.

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#64

Post by tarruda »

For Linux I highly recommend Incus/LXD. Launching a VM is as simple as

``` incus launch images:ubuntu/22.04 --vm my-ubuntu-vm ```

After launching, access a shell with:

``` incus exec my-ubuntu-vm /bin/bash ```

Incus/LXD also works with system containers.

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#66

Post by renonce »

tarruda wrote: post #64

For Linux I highly recommend Incus/LXD. Launching a VM is as simple as ``` incus launch images:ubuntu/22.04 --vm my-ubuntu-vm ``` After launching, access a shell with: ``` incus exec my-ubuntu-vm /bin/bash ``` Incus/LXD also works with system containers.

One thing I loved but rarely mentioned is systemd-nspawn. You do `docker create --name ubuntu ubuntu:22.04` and then `docker export ubuntu` to create a tar from an arbitrary docker image. Then you extract that to `/var/lib/machines/ubuntu`. Make sure to choose an image with systemd or install systemd in the container. Finally do `machinectl start ubuntu` and `machinectl shell ubuntu` to get inside.

systemd-nspawn is very simple and lightweight and emulates a real Linux machine very well. You can take an arbitrary root partition based on systemd and boot it using systemd-nspawn and it will just work.

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#67

Post by EasyMark »

colejohnson66 wrote: post #18
acatton wrote: post #8

Just a security reminder from the last time this got posted[1] This tool downloads random files from the internet, and check their checksum against other random files from the internet. [2] This is not the best security practice. (The right security practice would be to have the gpg keys of the distro developers committed in the repository, and checking all files against these keys) This is not downplaying the effort…

Can someone explain how this is a security problem? While GPG key verification would be the best way to ensure authenticity, it's doing nothing different from what almost everyone does: download the ISO from the distro's own HTTPS site. It then goes beyond what most people do and validates that the hashes matche.

Trust is an input into any security equation. Do you trust all sources of these files? I don't think anyone was challenging gpg

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#68

Post by acatton »

jvanderbot wrote: post #52
acatton wrote: post #8

Just a security reminder from the last time this got posted[1] This tool downloads random files from the internet, and check their checksum against other random files from the internet. [2] This is not the best security practice. (The right security practice would be to have the gpg keys of the distro developers committed in the repository, and checking all files against these keys) This is not downplaying the effort…

How much of this is outdated practice? Shouldn't TCP/TLS be doing checksum and origin signing already? In the days of FTP, checksum and gpg were vital. With http/TCP, you need more GPG due to TCP handling retries checksum etc, but still both due to MitM. But with https, how does it still matter? It's doing both verifications and signature checks for you.

TLS prevents a different kind of attack, the MitM one which you describe.

GPG signing covers this threat model but much more, the threats include:

* The server runs vulnerable software and is compromised by script-kiddies. They, then, upload arbitrary packages on the server

* The cloud provider is compromised and attackers take over the server from the admin cloud provider account.

* Attacker use a vulnerability (from SSH, HTTPd, ...) to upload arbitrary software packages to the server

GPG doesn't protect against the developer machine getting compromised, but it guarantees that what you're downloading has been issued from the developer's machine.

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#69

Post by hn_throwaway_99 »

st3fan wrote: post #41
colejohnson66 wrote: post #18

Earlier quoted context omitted.

Can someone explain how this is a security problem? While GPG key verification would be the best way to ensure authenticity, it's doing nothing different from what almost everyone does: download the ISO from the distro's own HTTPS site. It then goes beyond what most people do and validates that the hashes matche.

Because you wrote HTTPS in italic .. HTTPS doesn't mean anything. Both the good and bad actors can have perfectly valid HTTPS configured. It is not a good indicator of trustworthiness of the actual thing you download.

> HTTPS doesn't mean anything.

That's not accurate at all. HTTPS should mean "we've validated that the content you're receiving comes from the registered domain that you've hit". Yes, it's possible that the domain host itself was compromised, or that the domain owner himself is malicious, but at the end of the day you have to trust the entity you're getting the content from. HTTPS says, importantly, "You're getting the content from whom you think you're getting it from."

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#70

Post by tarruda »

renonce wrote: post #66
tarruda wrote: post #64

For Linux I highly recommend Incus/LXD. Launching a VM is as simple as ``` incus launch images:ubuntu/22.04 --vm my-ubuntu-vm ``` After launching, access a shell with: ``` incus exec my-ubuntu-vm /bin/bash ``` Incus/LXD also works with system containers.

One thing I loved but rarely mentioned is systemd-nspawn. You do `docker create --name ubuntu ubuntu:22.04` and then `docker export ubuntu` to create a tar from an arbitrary docker image. Then you extract that to `/var/lib/machines/ubuntu`. Make sure to choose an image with systemd or install systemd in the container. Finally do `machinectl start ubuntu` and `machinectl shell ubuntu` to get inside. systemd-nspawn is…

systemd-nspawn is simple but AFAIK it doesn't do any security other than the kernel namespacing. Docker is even worse because it runs containers as root, which means a rogue process can take over the host very easily.

Incus/LXD runs containers as normal users (by default) and also confines the whole namespace in apparmor to further isolate containerized processes from the host. Apparmor confinement is also used for VMs (the qemu process cannot access anything that is not defined in the whitelist)

Post reply on HN