Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

github.com

Post reply on HN
Print view View original

81–90 of 142 posts

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#81

Post by brirec »

electroly wrote: post #79
hn_throwaway_99 wrote: post #69

Earlier quoted context omitted.

> HTTPS doesn't mean anything. That's not accurate at all. HTTPS should mean "we've validated that the content you're receiving comes from the registered domain that you've hit". Yes, it's possible that the domain host itself was compromised, or that the domain owner himself is malicious, but at the end of the day you have to trust the entity you're getting the content from. HTTPS says, importantly, "You're getting t…

> HTTPS says, importantly, "You're getting the content from whom you think you're getting it from." You need certificate pinning to know this for sure, due to the existence of MITM HTTPS spoofing in things like corporate firewalls. HTTPS alone isn't enough; you have to confirm the certificate is the one you expected. (You can pin the CA cert rather than the leaf certificate if you want, if you trust the CA; that stil…

I’m not aware of any HTTPS MITM that can function properly without adding its own certificate to the trusted roots on your system (or dismissing a big red warning for every site), so I don’t think certificate pinning is necessary in such an environment (if the concern is MITM by a corporate firewall).

An attacker would still need to either have attacked the domain in question, or be able to forge arbitrary trusted certificates.

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#82

Post by jvanderbot »

acatton wrote: post #68
jvanderbot wrote: post #52

Earlier quoted context omitted.

How much of this is outdated practice? Shouldn't TCP/TLS be doing checksum and origin signing already? In the days of FTP, checksum and gpg were vital. With http/TCP, you need more GPG due to TCP handling retries checksum etc, but still both due to MitM. But with https, how does it still matter? It's doing both verifications and signature checks for you.

TLS prevents a different kind of attack, the MitM one which you describe. GPG signing covers this threat model but much more, the threats include: * The server runs vulnerable software and is compromised by script-kiddies. They, then, upload arbitrary packages on the server * The cloud provider is compromised and attackers take over the server from the admin cloud provider account. * Attacker use a vulnerability (fro…

I agree, but I think that model of GPG is not how it's used any more. I think nowadays people upload a one-shot CI key, which is used to sign builds. So you're basically saying "The usual machine built this". Which is good information, don't get me wrong, but it's much less secure than "John was logged into his laptop and entered the password for the key that signed this"

So, you're right, that GPG verifies source, whereas TLS verifies distribution. I suppose those can be very different things.

Perhaps counter example: https://launchpad.net/~lubuntu-ci/+archive/ubuntu/stable-bac...

> The packages here are from the latest upstream release with WORK IN PROGRESS packaging, built from our repositories on Phabricator. These are going to be manually uploaded to the Backports PPA once they are considered stable.

And presumably "manually" means "signed and uploaded"

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#83

Post by yjftsjthsd-h »

electroly wrote: post #79
hn_throwaway_99 wrote: post #69

Earlier quoted context omitted.

> HTTPS doesn't mean anything. That's not accurate at all. HTTPS should mean "we've validated that the content you're receiving comes from the registered domain that you've hit". Yes, it's possible that the domain host itself was compromised, or that the domain owner himself is malicious, but at the end of the day you have to trust the entity you're getting the content from. HTTPS says, importantly, "You're getting t…

> HTTPS says, importantly, "You're getting the content from whom you think you're getting it from." You need certificate pinning to know this for sure, due to the existence of MITM HTTPS spoofing in things like corporate firewalls. HTTPS alone isn't enough; you have to confirm the certificate is the one you expected. (You can pin the CA cert rather than the leaf certificate if you want, if you trust the CA; that stil…

If an attack requires compromising my operating system certificate store, I'm reasonably comfortable excluding it from most of my threat models.

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#84

Post by xrd »

jmb99 wrote: post #59
nightowl_games wrote: post #57

Anyone know if I can I legitamately make and submit iPhone builds off a macosx VM?

Technically, yes probably. You’ll be breaking Apple’s ToS though, so depends how big of a fish you are as to whether Apple cares.

I don't think you can. All virtualized MacOS machines, iirc, can't fully install the tools necessary to build software for MacOS. For example, I don't believe you will ever be able to sign and staple the app.

I would really love to have someone prove me wrong on this thread but I've never found a solution other than building on MacOS hardware, which is such a pain to maintain.

I have multiple old MacOS machines that I keep in a stable state just so I can be sure I'll be able to build our app. I'm terrified of failure or just clicking the wrong update button.

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#85

Post by st3fan »

hn_throwaway_99 wrote: post #69
st3fan wrote: post #41

Earlier quoted context omitted.

Because you wrote HTTPS in italic .. HTTPS doesn't mean anything. Both the good and bad actors can have perfectly valid HTTPS configured. It is not a good indicator of trustworthiness of the actual thing you download.

> HTTPS doesn't mean anything. That's not accurate at all. HTTPS should mean "we've validated that the content you're receiving comes from the registered domain that you've hit". Yes, it's possible that the domain host itself was compromised, or that the domain owner himself is malicious, but at the end of the day you have to trust the entity you're getting the content from. HTTPS says, importantly, "You're getting t…

Yes but we abandoned that idea a while ago. There are no more green locks in browsers. Nobody buys those expensive certificates that proof ownership. When you curl something it doesn't show anything unless it is an actual invalid certificate.

You are correct that it _should mean_ but reality today is that it doesn't mean anything.

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#86

Post by 0cf8612b2e1e »

Are there any numbers on performance change vs naively running a VM? Usually running Linux guest inside Linux host and frequently disappointed at the guest performance. I have never done any research on tuning the VM experience, so I am curious how much I might be missing. 5% faster? 100%?

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#87

Post by jthemenace »

_joel wrote: post #28

Shout out to https://virt-manager.org/ - works much better for me, supports running qemu on remote systems via ssh. I used to use this all the time for managing bunches of disparate vm hosts and local vms.

Anyone running virt-manager on mac connecting to a headless linux hypervisor on the same network? I tried installing it through "brew", but was getting many random errors.

I thought about running it over the network using XQuartz, but I'm not sure how maintained / well supported that is anymore.

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#88

Post by TylerE »

vdaea wrote: post #51
acatton wrote: post #8

Just a security reminder from the last time this got posted[1] This tool downloads random files from the internet, and check their checksum against other random files from the internet. [2] This is not the best security practice. (The right security practice would be to have the gpg keys of the distro developers committed in the repository, and checking all files against these keys) This is not downplaying the effort…

It doesn't download "random files from the internet", it seems to be using original sources only.

If you don't control then source, you can't guarantee that what it points to today is what it points to tomorrow.

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#89

Post by saagarjha »

xrd wrote: post #84
jmb99 wrote: post #59

Earlier quoted context omitted.

Technically, yes probably. You’ll be breaking Apple’s ToS though, so depends how big of a fish you are as to whether Apple cares.

I don't think you can. All virtualized MacOS machines, iirc, can't fully install the tools necessary to build software for MacOS. For example, I don't believe you will ever be able to sign and staple the app. I would really love to have someone prove me wrong on this thread but I've never found a solution other than building on MacOS hardware, which is such a pain to maintain. I have multiple old MacOS machines that…

You can run codesign just fine in a VM.

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#90

Post by user_7832 »

ge0rg wrote: post #49
yoyoinbog wrote: post #3

Looks interesting but would someone be so kind to point out if there are any advantages for a guy like me who just runs win 11 in VirtualBox under Ubuntu from time to time?

Especially regarding GPU acceleration... Running video-conferencing inside windows inside vbox is almost impossible, and even modestly complex GUI apps have a significant lag there.

Does qemu allow GPU acceleration while running with a single GPU? From the video on the website it appears so, however from what I’ve read (at least with amd igpus) it doesn’t seem to work.
Post reply on HN