My New Computer | Hacker News Reader

My New Computer

blog.taoetc.org

70 pointshackandthink59 comments

Shouldn't the link be pointing to https://blog.taoetc.org/my_new_computer/index.html and not the root website!

Also https://blog.taoetc.org/my_new_computer/ gives an error

Forgot to setup index.html as index file in AWS S3/Cloudfront!

If this message finds the author, or the people knowledgeable in the subject matter, I am very much interested in the implementation details.

How do you encrypt the flash drive? Do you run QEMU in the host OS or are there more optimal ways of "booting" it? How do you run QEMU to take benefit of all available resources on the "console" computer (the one running the image)? What's with the performance, and is the performance the reason for not running GUI? (But also - yay tmux!) How do you backup? (Do you just `dd` it? I don't put too much trust in the reliability of the flash drives...). What flash drive do you use? What are the pitfalls and limitations? I think I have more questions, but I will stop here, you see where I am going.

This is a really nice and simple idea and I will definitely try it too. I appreciate a lot if you can share your experience.

> How do you encrypt the flash drive?

My wild guess in that particular case he just installed alpine with full disk encryption within the qemu image itself, no the flash drive: " The filesystem is encrypted, and I carry it in a small USB stick. "

However it is not complicated to encrypt a flash drive. What may be complicated is having an encrypted flash drive that can easily be decrypted from any kind of OS.

I'd have nerves about qemu being snooped by a malicious/corporate/internet-cafe/friend's/etc host OS. Why not just use a bootable usb disc? Doesn't solve all the problems and probably introduces others. But if your employer allows you to run random qemu images, then doesn't seem they'd be overly worried about a bootable usb.

This was my exact thought too. Why not just make a bootable flash drive? Then you can use “your computer” anywhere in the world.

Years ago I had a .bat file on a usb that ran Puppy Linux and Slitaz ISOs inside qemu. Although it didn't have working persistence.

Was a lot of fun, but people are more wary of letting you run random scripts on their pc these days.

Great for the user, and its all very well saying his new computer doesnt have any hardware. But in reality when you take your' 'New Computer' somewhere out in the big wide world, you are going to need to use someone elses hardware to run your computer.

I don’t think the author was meaning to cut out hardware all together, more that he is becoming hardware agnostic. Upgrading his hardware means nothing since he has virtualized everything and is probably pretty quick.

But that’s pretty much what the cloud and distributed computing has been about for three decades. I was launching netbatch jobs in 1995 and never knew if they were running on HPUX, AIX, or SunOS. The OP has added an enormous amount of risk to their workflow by relying on incredibly unreliable flash storage. I wouldn’t touch this strategy with a ten foot pole. I can be hardware agnostic with five nines redundancy with cloud services.

Well, the article says "My new computer has no hardware."

What they has really done is just redefined the word "computer" from being the hardware on which we run our software to being the software that we run on someone else's hardware.

I guess since a computer used to be someone who used computing machinery we are getting a little ouroboros here

The fatal flaw with this idea, which I haven't been able to get around, is that you now spend your life entering passwords and doing sensitive work on supremely untrusted hardware.

Did he say he was using it on untrusted hardware he didn't own?

I saw it as something he can run wherever he wants without having to migrate configs and data. Like you are flying in a different country, go to a store, buy a computer, start an hypervisor and you are done.

I would still reinstall first that new computer with an OS of my choice, but an extension of his method could be to have that qemu image stored on a liveusb that already has qemu installed. Maybe that is what he does.

> I saw it as something he can run wherever he wants without having to migrate configs and data.

Much more practical to use syncthing

Or not.

To achieve the same with syncthing you'd need an aditionnal layer for the config like: git + stow, puppet, ansible, or using a distro like nix.

+ several GB of data may be moved faster from A to B using sneakernet than internet.

I don't think the assumption is you'd be doing that all the time. It's just good that you can do it if needed. If my laptop is stolen, I can just buy any linux-compatible laptop and run this, or I can borrow someone else's if I judge the risk acceptable.

From the article:

> When I switch from my work computer to my personal computer I just bring the USB stick with me; same thing next time I upgrade a computer.

As long as you decide where you put your USB stick in, this is not a fatal flaw or a flaw at all.

Can QEMU images boot straight from USB? No host OS/Hypervisor?

That’s news to me. I wish they would go over how they got that working. Does everything run from RAM? How large of flash drive do they use and how many snapshots/backups do they keep/where do they keep them?

There is also https://minios.dev/en/ and an HN link regarding a tons of other linux on USB options. I agree with the author. With USB in 1TB size range, easy to carry and backup. Why do I even need cloud?

Yes with that new usb stick boot method... I cannot remember the name of the project, not eufus, not unetbootin, not lili

I'm thinking you mean Ventoy? They say they can load vhd and img files, though I've only tried ISO's myself.

https://www.ventoy.net/

> Why do you not trust Ventoy?

> Ventoy is a great tool from what I’ve seen online and the use case it fills does save time and resources. However, I have some reservations about it. If I had to compromise a bunch of critical systems over a long time period, then publishing a great tool and having it tamper with your OS installation media silently would be a really good pick. At this time, I don’t trust the developers of the tool enough and I don’t have the time or skills to perform repeated audits of the software every time they release a new version.

...from the addendum to https://ounapuu.ee/posts/2023/02/15/shrinkflation/ (which was itself discussed previously [0]) - I don't have strong opinions of my own but reading this review was enough to put me off installing Ventoy the other day.

[0] https://news.ycombinator.com/item?id=34800830

If you're not wishing to read its code, it's a good strategy not to use it.

I'm a Ventoy user but missed this feature. Does anyone knows how it works? Are they packaging one or more hyoervisors together with Ventoy?

That's what I'm wondering too. Why not use a live USB?

Because those are platform dependent, you can't run an ARM image on X64 for example.

That's similar to my setup but under an Atom n270 netbook:

- Zram, useful for SBCL using 2GB of stack.

- CWM+Xclock+slock.

- UXTerm+ksh+TMux

- Links and "links -g" for image heavy sites, but often I just call sxiv with typing "i" while I'm at the image link.

- Sfeed+links with no cookies. Few sites: HN, Slashdot, some GNU sites, The Conversation. I avoid international news sites, http://68k.news it's more than enough for a quick glance on major issues in the planet.

- Gopher/Gemini with cgmnlm, with gopher://magical.fish as a good starting portal with useful services like torrent searching and, sometimes, news. Gopher blogs have tons of tech/science/math content not found anywhere else.

- I used to run lynx against gopher://gopherddit.com, but gemini against gemini://gemi.dev it's perfect. Yes, RSS, but I can read the local newspapaper over gemini by proxying the web page and save lots of bandwith, up to 95% if not more. Also, the local newspaper cuts down the RSS content.

- Mocp

- Nchat/Catgirl for TG/IRC.

- Custom ebook reader, for the ones without pics.

- MuPDF (graphical ebooks/PDF's).

- MPV+yt-dlp.

- Sxiv (pics)

- Mutt+msmtp+mbsync

- Tut for mastodon

- SBCL (Common Lisp) + rlwrap.

- Slrn

- MC, for fast documentation reading.

- Luakit for "emergencies": goverment pages with JS. Launched every few months and that's it.

On USB media, as long as you don't put local data on it, a system like Slax with a Linux Libre kernel would be very trustable and reliable:

https://www.slax.org/#getslax

Swap out the propietary kernel with Linux-Libre if your hardware supports it.

I love this idea but I'd be worried that I would lose something that small. OK the filesystem is encrypted but there are going to be private keys and other sensitive data on there which I really don't want to give someone unlimited time to crack... I don't carry sensitive data around every day on a regular usb stick either.

Not to mention you're going to freak out a lot of laypeople when you reboot their computer and it comes back up in Hackerman mode. Though if you could get it to play West Side Lane after it booted up then yeah this would be totally worth it.

If you don't trust encryption, I'm honestly curious to hear how you handle your sensitive data. My own opinion is that you're being too paranoid, but it would be interesting to hear back from you.

I trust encryption, but I don't necessarily trust myself to configure everything correctly. I am aware of how complex the topic is and could imagine myself for example having a password on something which could be brute forced if my password wasn't strong enough plus the default lockout period for incorrect attempts was too short... or some other scenario I as a non-expert might not anticipate.

In addition to encryption there's a physical access component to how a lot of my secrets are stored, no way I would ever transfer them to a phone for example.

Some necessary context for this is that I own a small business and it's not large enough to afford a dedicated person or people setting IT policy, but it's large enough that an attacker would have plenty of motivation to go the extra mile in terms of say doing some social engineering to drain our bank account.

Maybe the productive line of thinking here is, there is a set of secrets that does need a really high level of paranoia, but most of them don't and those would be OK sitting encrypted on a phone or USB stick. But it's easy to go down the rabbit hole and say if they get access to X and Y pieces of info can they call someone and get a password reset... etc.

I understand your concern. I would just add that, if the main concern for you would be someone finding such a USB key with encrypted private keys and be willing to use a long time to recover them, that's not really an issue: you only need the encryption to be strong enough for you to notice that you lost the USB key and rotate the keys, if such an adversary needs even just a couple days to perform its attack, you still got enough time IMO.

Good point thanks!

You're welcome

It is not much different than losing your smartphone or having it stolen.

This is such an odd thing to be worried about. Do you really think there are people who go around looking for random USBs on the floor hoping that they contain sensitive data? Unless someone is specifically following you around and looking for this, I doubt they would bother. I also think anyone smart enough to crack the encryption on that thing is probably also smart enough not to plug random USBs into their computer.

I've been wanting something like this recently.

I want to occasionally have my "virtual computer" with me to use on other hardware. (ie my SO's laptop, my Steam Deck; hardware I mostly trust). I find myself bringing my laptop many places where I don't actually plan to use it, just in case some server goes down or the like.

Why Qemu though? Why not a Live USB? Is it just for the ease of treating the VM as a regular file for backup and transfers? I have little experience with Qemu.

Unlike a live usb, Qemu is (mostly?) hardware agnostic. The abstraction means you could run a VM image on a x86 based ThinkPad or an ARM based Mac.

Should rather mean "my new operating system"

Agree this is strangely worded

This wouldn't fly on work computers at most large enterprises where the USB ports are locked down. Inserting any USB storage violates security policy and triggers security alerts, if the USB port works at all.

> My new computer has no hardware.

Funny, that's the opposite of my dream computer, which is running low amounts of software (or at least low amounts of dependencies for userspace) on lots of trusted and open hardware.

I ran this way when I first (had to) switch to a mac. Running linux in a Virtualbox vm, and having it fullscreen most of the time. It's a really nice way to work, and gives you much more of a sense of owning your environment - especially the mac started acting-up and slowing down/hanging frequently, and even losing the application state through a reboot, but the vm would continue where it left off after a restart, even the cursor in the same place etc.

IMHO you do need a graphic environment in 2024 though; text-only, and gemini etc is a bit too monastic.

I really like the idea of separating storage from hardware. Unfortunately this relies on having Qemu installed on every machine you intend to use. Many machines don't fit that bill.

Isn't this what the idea of sync (Backups, etc) are about? I do like the idea of using my hardware (devices, phones, computers) as tools and be able to pick up one that works. I'm working towards this but far from there. Of course, the storage can be on multiple hardware, say, via Syncthing (or other Cloud storage) but I should be able to replace the hardware and still know that the content can be sync elsewhere.

You load the qemu portably onto the usb as well

I feel like a better version of this would be Guix/Nix/Similar for a reproducible setup, then just putting all your personal files on a USB.

Why do I have this nagging feeling in the back of my head that this is pretty bad for a lot of obscure hardware and peripherals?

I used to have a USB stick with Kali Linux with encrypted persistence in 2017. I felt cool as a script kiddie.

According to Wikipedia

> A computer is a machine that can be programmed to carry out sequences of arithmetic or logical operations automatically.

I don't think his encrypted Qemu image on a usb stick can do any of that...

Why not? It just needs one small extra dependency: to be plugged into a device that supplies processing power.

You might as well say that my desktop isn't a computer, because it needs external (electrical) power to do any logical or arithmetic operations. Or that my credit card doesn't run Java.

Because their usb stick just contains the program a computer can run.

> It just needs one small extra dependency: to be plugged into a device that supplies processing power.

So it just needs a computer to be a computer?

Your logic doesn't work for me. It's like saying I am a cruise ship captain, just that I lack the ship, the certification and the knowledge.

I am not aware that there are credit cards which can run java (I assume that means they have a jvm that can interpret java bytecode). I think similarly they store data and programs (which might be java) but don't run them. e.g. https://www.oracle.com/java/java-card/

> The Qemu image is small enough (3.6G currently) that I can easily make backups and snapshots

Why? I can make snapshots and backups of multi-terabyte drives just as easily.

I doubt snapshots in your workflow are quite as easy and fast as:

  qemu-img create -f qcow2 -b base-image.qcow2 -F qcow2 snapshot.qcow2

This takes mere milliseconds. The great thing about this is that snapshots are chainable, so you can create snapshots based on snapshots, and easily go back and forth to boot whatever version you want. Each snapshot only takes up the space of the data written to it, so they're like layers in an OCI image.

The qcow2 format is quite ingenious and one of my favorite things about working with QEMU. I wish its CLI would be simpler and more intuitive, so for more advanced scenarios I prefer working with libvirt/virt-manager/Proxmox.

For any drive size a diff is a diff, so if very few bytes change, very few bytes are going to be written regardless of the disk size.

This whole post is an exercise in futility

Not the parent poster, but I have automatic incremental snapshots of my zfs datasets which also automatically sync to a NAS for backup.

maybe there is a "size" as in how much storage he/she has. Or maybe bandwidth issues. I do not own a large NAS nor i have fast internet for uploads and stuff, so 3,6G is a god sent.

3.6GB is a lot bigger than what I would expect. Esp given the small number of applications he uses.

I expected something around 1GB

Would prefer a VPS

Reply on news.ycombinator.com