Better slow than sorry – VirtualBox 3D acceleration considered harmful
phoenhex.re
phoenhex.re
Oracle recently started hunting our company for licenses due to the fact that the VB guest additions software phones home. Fail on us for not considering the license on the guest additions outside of the VirtualBox software.
Bye bye Vagrant! Time for a new workflow!
Old FAQ, license, and a relevant FAQ excerpt:
https://web.archive.org/web/20161108235524/https://www.virtu...
https://web.archive.org/web/20170126144347/https://www.virtu...
> Personal use is when you install the product on one or more PCs yourself and you make use of it (or even your friend, sister and grandmother). It doesn't matter whether you just use it for fun or run your multi-million euro business with it. Also, if you install it on your work PC at some large company, this is still personal use. However, if you are an administrator and want to deploy it to the 500 desktops in your company, this would no longer qualify as personal use.
Current license with the "noncommercial" requirement: https://www.virtualbox.org/wiki/VirtualBox_PUEL
> use solely by the person downloading the Product from Oracle on a single Host Computer, provided that no more than one client or remote computer is connected to that Host Computer and that client or remote computer is used solely to remotely view the Guest Computers.
This isn't a standard definition for "Personal Use" and I can now understand why people weren't happy.
You can also use vagrant with a libvirt/KVM backend (on linux). Sometimes the box is not available in libvirt format. But that issue can be worked around converting them
VirtualBox on MacOS is absolutely shit.
I wonder when Oracle poisoned this well (Fortune 100).
However, our guy handling the call just mentioned that we're considering switching to VirtualBox anyways, and didn't hear back since. I think VBox actually has a clause about educational use in their EULA.
> VMware Workstation Player is free for personal non-commercial use (business and non profit use is considered commercial use). If you would like to learn about virtual machines or use them at home you are welcome to use VMware Workstation Player for free. Students and faculty of accredited educational institutions can use VMware Workstation Player for free if they are members of the VMware Academic Program <http://kb.vmware.com/kb/1033638>.
Maybe "VirtualBox 3D acceleration not fully sandboxed" would be a more accurate, less sensationalist title?
Took me ages to figure out it was virtual box that was the issue, not gnome or vscode. A shame, I liked my VM in Windows set up. Now I had to suffer through installing Ubuntu natively on a gen3 Thinkpad x1 yoga which has been a new class of nightmare thanks to Lenovo nuking critical sleep functionality:https://forums.lenovo.com/t5/Linux-Discussion/X1-Carbon-Gen-...
Getting my tools just like I like them always has such an exhausting spin-up time.
https://github.com/vmware/open-vm-tools/issues/176
:(
If you are considering doing your VM's on a server then it's worth a look at Unraid too - it uses QEMU/KVM under the hood but has some other advantages too.
Edit: you are likely to lose a little GPU 2-3% due to vm overhead, but GPU passthrough is as close to native as you are going to get. I've happily run a high end VR headset via a Windows VM running on Unraid in the past.
Running a Ubuntu Host with KVM, passing through an NVIDIA 970 to a Windows host. Yea...the GPU performance was fast, but everything else was so slow compared to running native. I think my biggest issue was with disk R/W, especially when memory pressure went up from the VM the system bogged down to a halt. After that, my biggest problems were with the fact that after the Windows host turned off, the GPU was stuck in the weird state where you can't reset it ( I know its a feature™ from Nvidia) and the Keyboard / Mouse would flake since I would attach the whole USB root to the VM as well.
In the end just decided to install back Windows and not have to deal with it.
Say hello to distributions not providing latest releases.
Qemu/KVM + virt-manager. No Oracle nonsense about closed USB drivers and the like.
> Are there any that can do proper 3D acceleration to play games at a reasonable speed?
Just ditch Windows and use Wine, it works very well these days especially paired with DXVK.
Usually Wine is actually running older games better than recent Windows.
If not - you can check for errors and file some bugs. It would help developers know there are issues.
Wine definitely is better for older games 99% of the time, this one is just something that was incredibly picky even when it was new. I've bothered them to ask if they'd open source it or let me port it with me signing an NDA, but they haven't responded.
What kind of libraries? I never had a problem with Wine dependencies in Debian, even when installing WineHQ packages. It just pulls them from the repo.
For Intel hardware, there's GPU virtualization called GVT-g [2], and the docs mention Windows.
If you're on a desktop, GPU passthrough would be the easiest option.
[0] https://virgil3d.github.io/ [1] https://www.reddit.com/r/archlinux/comments/7nmceg/kvmqemu_w... [2] https://github.com/intel/gvt-linux/wiki/GVTg_Setup_Guide
So there's very little point in switching software, assuming you play games with the virtualized system. QEMU ought to be as vulnerable as VirtualBox/VMWare to this problem.
And sure, they could fix this issue by checking this one pointer. But there's going to be 50 more where this problem came from, and they haven't even mentioned bounds checks.
In the GPU passhthrough scenario, the host OS GPU drivers are not involved, and this exact problem won't occur.
But it's another question how well the GPU is isolated from the host system using mechanisms like IOMMU. To shield against attacks like manipulating host memory from code running on the GPU.
https://www.contextis.com/blog/webgl-more-webgl-security-fla... etc
> However, to enable this impressive breakthrough in online technology, web browsers (currently Chrome and Firefox) have had to expose low level parts of their operating systems which previously could not be directly accessed by potentially malicious web pages, thus creating a number of potential security vulnerabilities.
Yes, that was my reaction.
Xen with driver domains and (only just started) similar support in KVM is about the kit reasonable thing from security point of view. Maybe VMware but that cannot be studied.
VM are a problem waiting to happen.
> VM are a problem waiting to happen.
Something something security threat model and personal risk tolerance...
They can contain malicious code just as well as a thumbdrive. The concern with USB is the firmware, and the thumbdrive pretending to be a HID device or having an extra partition with malicious code.
Purchasing many similar drives of a well known brand in a random supermarket is a reasonable alternative.
Just keep them for 1 year before using them, in case an exploit becomes popular - but this is extremely paranoid.
Of course.
> The concern with USB is the firmware, and the thumbdrive pretending to be a HID device or having an extra partition with malicious code.
Right, that's the concern I was alluding to above. You'd still be better off burning optical media (and disabling any autoplay crap on the target system). You can still store severl GB of data on optical media.
> Just keep them for 1 year before using them, in case an exploit becomes popular - but this is extremely paranoid.
This may work if you only stick with very popular makes/models, since they would have a higher chance of being 'noticed' for doing something wrong.
Security is in the spotlight, not in the shadows
Prefer tools that everyone else uses, unless you have a very compelling reason not to (windows: too many 0 days, complexity, and surface of attack ; wifi: too easy to start a rogue network)
Because when these popular tools get hacked, you will know it. I keep an eye on rogue firmware. I have not seen a real world threat yet, but I do expect spear fishing attacks for people involved in crypto (fortunately, not for us just writing software)
For a project idea I've been considering how to attach a sensitive (but powerful) machine to the network with the smallest possible interface (in terms of code exposure). RS232 is probably the simplest yet still functional without getting into niche hardware standards.
On balance I think USB might be worse than Ethernet[2] or even Ethernet+TCP/IP just because typical network stacks have probably seen more scrutiny than USB stacks. But at the end of the day I know I'm going to want to use something like seL4 to protect the application from the transport stack(s). And even then you still have to worry about the hardware. There's a real dilemma in choosing the simplest hardware that is still viable in terms of performance, support (including ease of porting or writing drivers), and long-term availability.
[1] Assuming a simple ethernet controller with all the fancy features disabled or, ideally, not even present.
https://arstechnica.com/gaming/2015/01/pokemon-plays-twitch-...
The problem with stuxnet was that non dedicated thumbdrive brought in the worm. Also their equipment was networked. Bad idea. If data must be exchanged, use unidirectional links. Good old serial ports, with only TX or RX wired (Edit: I do not think centrifuges need a full ethernet stack. Depending on high level abstractions like TCP/IP for simple operations comes at a cost)
My model is not perfect safety, but if it take something the scale of stuxnet to attack, I feel safe enough.
I laughed when the recent spectre and meltdown exploits were revealed, because the good old airgap model meant I did not have to care.
Afterall there "could" be a wireless chip within the ME hardware.
(I know there isn't, I'm just playing overly paranoid)