Hacker News Reader

Comment by rvz | Hacker News Reader

With some very business critical limitations [0]. If one was to implement security features like LKRG and it disrupts other components in the system, then just as it looks promising security research, then I'm afraid that we'll have to wait for it to improve before we can use it.

[0] https://www.openwall.com/lists/lkrg-users/2019/11/18/1

View on HN

I don't mean to detract from your point, but if virtualbox is business critical, I would suggest changing your business. Apart from KVM being a far superior hypervisor, oracle licensing provisions are a noticeable liability.

https://www.reddit.com/r/sysadmin/comments/d1ttzp/oracle_is_...

also, the vbox drivers are considered to be "crap": https://www.phoronix.com/scan.php?page=news_item&px=OTk5Mw

The dev at Oracle must feel great to have their work labeled as "crap".

As if they didn't already know. Remember -- we are not defined by the shitty hacks we write to pay our rent.

Maybe if nobody called their code crap, it would be better code?

When tickets last that long unfixed, the dev working on it now isn't hurt ;)

It hasn't been an Oracle product forever.

I remember it as Sun. But looking it up, Sun acquired it from something called Innotek GmbH.

I don't get the impression that Oracle is putting a lot of serious engineering effort on the old Sun products, aside from maintenance. Anyone keeping the lights on is probably unlikely to get offended by the thing from 2 layers of acquisition being called "crap".

in 2011. (They may still be crap, but nine years is a long time.)

This link reflects the extension pack, not Virtualbox itself, which is CDDL licensed.

Virtualbox represents exactly as much threat to your business as an OpenIndiana or FreeBSD server. Are you sure that a sysadmin is not using (CDDL licensed) ZFS?

Oracle can't go after CDDL licensed work - VirtualBox extension pack wasn't CDDL or even open source project.

That's the point, yeah. Virtualbox is CDDL. Extension pack is not. Using virtualbox doesn't hurt, they got nailed because of the extension pack.

Watch your licenses. Oracle Java JRE/JDK switched to a proprietary commmercial license (it's time to switch to openjre/openjdk including on the desktop. You're either out of date on patches or running oracle non-cddl code (prepare to bend over)

openjdk jre link: https://adoptopenjdk.net/installation.html?variant=openjdk11...

Affero GPL/AGPL is commercially toxic as well. Java iTextPdf is probably the most common thing.

Further in the thread [0] they explain why this is happening (hint: it's due to the virtualbox driver allocating an RWX page and executing it, which violates integrity rules and has been exploited in the past). Either way, the authors have provided build instructions for VirtualBox users.

[0] https://www.openwall.com/lists/lkrg-users/2019/12/02/1

There's the full secure extreme — turning it off and unplugging it — but the usability tradeoff isn't great. TFA lies somewhere along that spectrum, but it isn't clear to me it's a sane default.

(It is not especially clear to me what exact mitigations TFA describes; it seems to be glossy ad copy rather than technical documentation.)

I'm not sure I'd want "!!!" log lines going to the primary business log when only the suspicion of an attack exists.

Reply on news.ycombinator.com