Hacker News Reader

Comment by dave2000 | Hacker News Reader

dave2000

All that stuff - bittorrent, soulseek, calibre etc - lives in a vm, with access to the host only via samba shares. I'll decide what you see and where you can write. Yes, it's great you download stuff. No, you can't write to the stuff I'm sharing. Yes, having a web-server serving up books to the outside world is great. No, you can't serve up anything from my filesystem to anyone who feels like it.

When you can't (be bothered to) vet the source code, stick it in a vm. On a sensible machine with an ssd it's only 10 seconds away. Why risk it. Especially if the software you want/need to run only works under windows.

View on HN

This is exactly why sandboxed apps (e.g., iOS/UWP/etc.) are a good thing.

Or the Mac App Store itself. Its enforced sandboxing would have provided a decent first line of defense against this, but torrent clients can't be submitted to the App Store due to Apple not liking the legal aspects, not to mention the other issues people have with it. (Outside the store, apps can still opt into sandboxing, but that wouldn't help with a malicious installer.)

I doubt Apple keeps it out for "Legal" aspects. iTunes sales seems more likely.

For Windows there is SandboxIE: http://www.sandboxie.com/index.php?DownloadSandboxie

It should be able to sandbox Windows Apps, except for Metro/Modern UI Apps and Microsoft Edge.

Too many programs are having a backdoor or Trojan in them now. It is a good idea to run any app that accesses the Internet in a sandbox first to see what it does.

Just a warning: by default it doesn't protect your documents from reading.

It isolates the process, all writes (filesystem, registry) go to the sandbox instead of the host filesystem, so a malicious software can't easily install itself. But reading data is mostly unprotected by default, so a malware ran in a sandbox may steal some sensitive data. To protect such data you have to pre-configure sandbox manually.

Also cameyo to make your own:

http://www.cameyo.com

And they have prepackaged sandboxed apps:

https://online.cameyo.com/public

I have no problem paying for apps but for people who have paid for SandboxIE, do you think you've got your money's worth out of it?

Yes. Back when I still used Windows five years ago, the app was an essential tool for me. All web browsers, downloaders and basically anything else that I consider high risk must be run in a sandbox, which is routinely emptied. Less risky apps are sometimes also installed in a sandbox, which is emptied much less frequently. And it's great for trying out trial versions of software before I fully trust their publishers. I didn't run any antivirus on that machine at all and I'm that confident. Nowadays I've switched to OS X but I still miss the easy sandboxing of basically any app.

Beware that VMs are not necessarily secure. They can be escaped!

This argument is similar to "a condom can always break". Technically you are correct, but I'd still use one.

Which is the entire premise behind Qubes: https://www.qubes-os.org

This argument is only similar if the condom is known to have huge design flaws

VMs have tons of well documented issues. If you want a smaller attack surface, try OS virtualization technologies (zones/jails)

This makes no sense. VMs are by far the most secure form of isolation. No one is going to get infected with malware that escapes VMs - it is far too valuable.

How can you honestly think VMs are the most secure form of isolation?

Sure, in theory. Are there any current exploits for VirtualBox?

The way I see it, they're more secure that running the same apps on bare metal. Ubuntu host running a Fedora VM; the latter (with Transmission etc) only running when I need the apps running - seems an almost entirely painless way of providing a lot of security.

Unsure if there are any currently publicly known exploits, but it sure isn't unheard of for VirtualBox:

* http://arstechnica.com/security/2015/05/extremely-serious-vi...

* http://www.securityfocus.com/archive/1/495095

* https://www.cert.be/advisories/oracle-vm-virtualbox-two-priv...

* http://www.coresecurity.com/content/virtualbox-privilege-esc...

"Requires a 0-day" is still a huge barrier. It's not 100% secure, sure, but it's an improvement.

Yeah, not arguing that. Just don't treat it like a panacea

Yes! Some reliable ways to extract an RSA key, and some less reliable ways to swap two cache lines. Virtualization on x86 is a helpful tool for configuration management, but should not be mistaken for a security feature.

More secure than without though.

Lets try to avoid treating security as something binary.

Yes but if you run a compromised App in VM A and have your sensitive data in VM B then they have to break out of the VM A and then break into VM B. It's no longer worth the effort. There are often easier ways like phising.

You can also lease a VPS (anonymously even) and use Deluge with a webGUI. Said webGUI can be a Tor onion service, for better isolation.

But still, this is about malware in Transmission itself, not anything downloaded using it. So the fact that it's a BitTorrent client is rather beside the point, I think.

> soulseek

Neat. Never heard of this one before - what makes it special?

It's a very old P2P file sharing network modeled after Napster. It's main propositions (in my opinion) are its active users who share harder-to-find electronic music, and its discussion groups which are available inside the app.

I didn't know Soulseek is still alive - brings me back to the days of Direct Connect / DC++ and hunting down rare live sets and (as you mentioned) electronic music over ISDN/dial up.

Wouldn't have a container for this be good enough ?

A container may be "good enough", but running within a container generally doesn't give the same security posture as running within a virtual machine.

I have no idea;I've never used a container. Is it easier than downloading an ISO, selecting how much ram/disk/cpu to give it and installing it?

Admittedly, this might reasonably be considered a basic question, but how do you recommend running a VM on a Mac?

https://www.virtualbox.org/wiki/Downloads

http://veertu.com

Note that I've only used it to run Linux so far.

Does it run much better than in VirtualBox?

Now you got an infected VM. How about we stop packing malware in OSS?

Reply on news.ycombinator.com