Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

github.com

Post reply on HN
Print view View original

91–100 of 142 posts

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#91

Post by xrd »

saagarjha wrote: post #89
xrd wrote: post #84

Earlier quoted context omitted.

I don't think you can. All virtualized MacOS machines, iirc, can't fully install the tools necessary to build software for MacOS. For example, I don't believe you will ever be able to sign and staple the app. I would really love to have someone prove me wrong on this thread but I've never found a solution other than building on MacOS hardware, which is such a pain to maintain. I have multiple old MacOS machines that…

You can run codesign just fine in a VM.

I really appreciate your comment, I'm hoping I am wrong about my experiences!

But, this is the issue I believe:

https://mjtsai.com/blog/2023/09/15/limitations-on-macos-virt...

(or, the original is here: https://eclecticlight.co/2023/12/26/when-macos-wont-work-wit...)

You cannot login using AppleID. If you can't do that, aren't you prevented from basically doing any kind of stapling and/or retrieving certificates for signing?

I would LOVE to be wrong about this. You've done that?

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#92

Post by arghwhat »

jstrieb wrote: post #78
arghwhat wrote: post #13

The convenience of such a tool is great, but it's also ~5000 lines of bash across the two main scripts. I'd want to vet such a thing before I run it, but I also really don't want to read 5000 lines of bash.

While I agree in general that shell script is not usually fun to read, this particular code is really not bad. Not sure if this will sway you, but for what it's worth, I did read the bash script before running it, and it's actually very well-structured. Functionality is nicely broken into functions, variables are sensibly named, there are some helpful comments, there is no crazy control flow or indirection, and there…

I do see that it is better structured, but as any other bash script it relies heavily on global variables.

For example, `--delete-vm` is effectively `rm -rf $(dirname ${disk_img})`, but the function takes no arguments. It's getting the folder name from the global variable `$VMDIR`, which is set by the handling of the `--vm` option (another global variable named $VM) to `$(dirname ${disk_img})`, which in turn relies on sourcing a script named `$VM`.

First, when it works, it'll `rm -rf` the parent path of the VMs disk_img variable is set to, irrespective of whether it exists or is valid as dirname doesn't check that - it just tries to snip the end of the string. Enter an arbitrary string, and you'll `rm -rf` your current working directory as `dirname` just return ".".

Second, it does not handle relative paths. If you you pass `--vm somedir/name` with `disk_img` just set to the relative file name, it will not resolve`$VMDIR` relative to "somedir"- `dirname` will return ".", resulting in your current working directory being wiped rather than the VM directory.

Third, you're relying on the flow of global variables across several code paths in a huge bash script, not to mention global variables from a sourced bash script that could accidentally mess up quickemu's state, to protect you against even more broken rm -rf behavior. This is fragile and easily messed up by future changes.

The core functionality of just piecing together a qemu instantiation is an entirely fine and safe use of bash, and the script is well-organized for a bash script... But all the extra functionality makes this convoluted, fragile, and one bug away from rm -rf'ing your home folder.

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#93

Post by xmichael909 »

_joel wrote: post #28

Shout out to https://virt-manager.org/ - works much better for me, supports running qemu on remote systems via ssh. I used to use this all the time for managing bunches of disparate vm hosts and local vms.

I just wish it had a web interface option, but I guess there is always proxmox.

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#94

Post by npteljes »

colejohnson66 wrote: post #18
acatton wrote: post #8

Just a security reminder from the last time this got posted[1] This tool downloads random files from the internet, and check their checksum against other random files from the internet. [2] This is not the best security practice. (The right security practice would be to have the gpg keys of the distro developers committed in the repository, and checking all files against these keys) This is not downplaying the effort…

Can someone explain how this is a security problem? While GPG key verification would be the best way to ensure authenticity, it's doing nothing different from what almost everyone does: download the ISO from the distro's own HTTPS site. It then goes beyond what most people do and validates that the hashes matche.

Getting the signature and the file from the same place is questionable practice in itself. If the place is hacked, then all the hacker needs to do is to just hash his own file, which has happened in at least one high profile case [0]. And this practice doesn't even offer any extra protection if the resource was accessed with HTTPS in the first place.

[0] https://www.zdnet.com/article/hacker-hundreds-were-tricked-i...

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#95

Post by coppsilgold »

bobim wrote: post #32
prmoustache wrote: post #20

Earlier quoted context omitted.

Also, author is typing his user password during live streaming with a mechanical keyboard while microphone is on.

You mean that the sound of each key is unique and sufficiently different from the others? Or it has to do with how a person is typing?

Each key will produce a different sound even if it's just a touch screen surface keyboard due to being in different positions on the surface and having a relative position to the microphone - it may be more difficult and require a higher quality microphone.

Once you isolate and cluster all the key sounds you end up with a simple substitution cipher that you can crack in seconds.

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#96

Post by stefanha »

rwmj wrote: post #36
steve_rambo wrote: post #9

libvirt ships with virt-install which also allows for quickly creating and auto-installing Windows and many Linux distributions. I haven't tried it with mac. Here's a recent example with Alma Linux: $ virt-install --name alma9 --memory 1536 --vcpus 1 --disk path=$PWD/alma9.img,size=20 --cdrom alma9.iso --unattended Then you go for a coffee, come back and have a fully installed and working Alma Linux VM. To get the li…

Also $ virt-builder fedora-39 if you wanted a Fedora 39 disk image. (Can be later imported to libvirt using virt-install --import).

virt-builder is awesome for quickly provisioning Linux distros. It skips the installer because it works from template images. You can use virt-builder with virt-manager (GUI) or virt-install (CLI).

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#97

Post by saagarjha »

xrd wrote: post #91
saagarjha wrote: post #89

Earlier quoted context omitted.

You can run codesign just fine in a VM.

I really appreciate your comment, I'm hoping I am wrong about my experiences! But, this is the issue I believe: https://mjtsai.com/blog/2023/09/15/limitations-on-macos-virt... (or, the original is here: https://eclecticlight.co/2023/12/26/when-macos-wont-work-wit... ) You cannot login using AppleID. If you can't do that, aren't you prevented from basically doing any kind of stapling and/or retrieving certificates for…

This is only true for products based on the Virtualization framework. Intel “Macs” can sign in just fine. (Also, I think you can authenticate things with an API key these days rather than your credentials?)

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#98

Post by thomastjeffery »

_joel wrote: post #28

Shout out to https://virt-manager.org/ - works much better for me, supports running qemu on remote systems via ssh. I used to use this all the time for managing bunches of disparate vm hosts and local vms.

It's wild how important and useful a program that does nothing but configuration can be.

Imagine what life would be like if configuration was separated from the software it configures. You could choose your favorite configuration manager, and use that, rather than learn how each and every program with a UI reinvented the wheel.

The closest thing we have are text configuration files. Every program that uses them has to choose a specific language, and a specific place to save its configs.

An idea I've been playing with a lot lately is a configuration intermediary. Use whatever language/format you want for the user-facing config UI, and use that data as a single source of truth to generate the software-facing config files.

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#99

Post by xrd »

saagarjha wrote: post #97
xrd wrote: post #91

Earlier quoted context omitted.

I really appreciate your comment, I'm hoping I am wrong about my experiences! But, this is the issue I believe: https://mjtsai.com/blog/2023/09/15/limitations-on-macos-virt... (or, the original is here: https://eclecticlight.co/2023/12/26/when-macos-wont-work-wit... ) You cannot login using AppleID. If you can't do that, aren't you prevented from basically doing any kind of stapling and/or retrieving certificates for…

This is only true for products based on the Virtualization framework. Intel “Macs” can sign in just fine. (Also, I think you can authenticate things with an API key these days rather than your credentials?)

Meaning, Intel vms? This is great. I'll check it out.

Re: Quickemu: Quickly run optimised Windows, macOS and Linux virtual machines

#100

Post by electroly »

yjftsjthsd-h wrote: post #83
electroly wrote: post #79

Earlier quoted context omitted.

> HTTPS says, importantly, "You're getting the content from whom you think you're getting it from." You need certificate pinning to know this for sure, due to the existence of MITM HTTPS spoofing in things like corporate firewalls. HTTPS alone isn't enough; you have to confirm the certificate is the one you expected. (You can pin the CA cert rather than the leaf certificate if you want, if you trust the CA; that stil…

If an attack requires compromising my operating system certificate store, I'm reasonably comfortable excluding it from most of my threat models.

Obviously you choose your own relevant threat models, but it's common to do in iOS apps--many apps are including it in their threat models. Pinning the CA cert is what Apple recommends to app developers. It's not an unreasonable thing to do.

https://developer.apple.com/news/?id=g9ejcf8y

Post reply on HN