Hacker News Reader

Comment by kwar13 | Hacker News Reader

I had a very similar experience: https://kaveh.page/blog/job-interview-scam

I would never agree to run someone's code on my own machine that didn't come from a channel I initiated. The odd time I've ran someone else's code, ALWAYS USE A VM!

View on HN

How are you guys spinning up vms, specifically windows vms, so quickly? I used to use virtual box back in the day, but that was a pain and required a manual windows OS install.

I'm a few years out of the loop, and would love a quick point in the right direction : )

For coding I normally run Linux VMs. But Windows should be doable as well. If you do a fresh install every time then sure it takes a lot of time, but if you keep the install in VirtualBox then it's almost as fast as you rebooting a computer.

You take the time to set one up, then you clone it and use the clones for these things.

A docker container isn’t as bulletproof as a VM but it would certainly block this kind of attack. They’re super fast and easy to spin up.

It would not block many other attacks.

Can you give some examples? I think of my containers as decently good security boundaries, so I'd like to know what I'm missing.

Containers share resources at the OS level, VMs don't. That's the crucial difference.

Containers share the whole kernel (and more) so there's a massive attack surface.

A lot of the world has moved on from virtualbox to primarily qemu+kvm and to some extent xen. Usually with some higher-level tool on top. Some of these are packages you can run on your existing OS and some are distributions with hypervisor for people who use VMs as part of their primary workflows. If you just want quick-and-easy one-off Windows VM and move on, check out quickemu.

Libvirt and virt-manager https://wiki.archlinux.org/title/Libvirt

Quickemu https://github.com/quickemu-project/quickemu

Proxmox VE https://www.proxmox.com/en/proxmox-ve

QubesOS https://qubes-os.org

Whonix https://whonix.org

XCP-ng https://xcp-ng.org/

You can also get some level of isolation by containers (lxc, docker, podman).

Also, you can spin up an ec2/azure/google vm pretty easy too. I do this frequently and it only costs a few bucks. Often more convenient to have it in the data center anyway.

Windows does have a builtin sandbox that you can enable. (it also enables copy-paste to it)

If you're on a Mac, you probably want OrbStack nowadays. It's fabulous!

Not sure about windows but I solved it for myself with basic provisioning script (could be an ansible playbook also) that installs everything on a fresh linux vm in a few minutes. For macos, there is tart vm that works well with arm64 (very little overhead compared to alternatives). Could be a rented cloud vm in a nearby location with low latency. Being a neovim user also helped not to having to worry about file sync when editing.

Reply on news.ycombinator.com