Hacker News Reader

Comment by beagle3 | Hacker News Reader

Security wise, this seems like an awful idea: Unless the host is firewalled from the guest, if Arc-style VMs become popular, than you'll have malicious websites starting VMs to scan your host network for unpatched vulnerabilities, and abuse them.

I try to keep my network secure, but e.g. Cisco/Linksys E3000 hasn't received a firmware update in a long time, and it has known exploitable bugs - right now, the fact that it is only accessible from inside the NAT, and that webpages can't do arbitrary accesses is what keeps all those E3000s from being exploited.

(My E3000 has been running dd-wrt, so it's not vulnerable to those problems; but I had to manually upgrade the dropbear ssh because of vulnerabilities - latest official dd-wrt for it is still vulnerable)

View on HN

Security-wise it is no different than installing a multitude of software packages onto your computer, which many developers are already comfortable with (whether they should be or not).

Perhaps - But Dripy and Peggo are not targeted at developers.

The people who use Dripy & Peggo are also the people download spyware infected "Youtube Downloader" apps already.

I don't see a lot of difference - for good or for bad.

Arc apps will require explicit permission to communicate with a local network. This can be enforced at the hardware layer by the virtual NIC.

How do you define local?

Is it 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16? I guess that would cover 99% of local networks.

I wasn't aware virtualbox has firewalling at the virtual NIC level - my 4.1 doesn't; It's either host-only, bridged, or nat - of which bridged is unlimited, host-only is useless, and nat cannot (as far as I can tell) be firewalled at the virtual NIC level. So how do you do it?

Even better would be to require explicit permission to communicate with any site that isn't the app origin.

A VM can be put on its own VLAN with a traffic routed through a secure firewall. I don't think Arc is as doomed to be insecure as many are claiming.

VirtualBox, at least the version I run, cannot do that on its own. You would need to set up the firewall rules on the host. Which is, of course, possible - but not in a cross platform way (linux uses netfilter/iptables, bsd uses pf, windows uses ... I'm not sure what these days, but many users have a 3rd party firewall as well)

It isn't doomed to be insecure, but its security, portability and convenience/usability have a nontrivial tradeoff which is ignored by the original description. If it's portable and convenient, it is likely going to be lacking on the security front.

Which Dropbear vulnerability? The last one I can see is from 2012.

That's the one. The latest stable dd-wrt is from 2009 - if you're running dd-wrt and haven't updated dropbear, you're vulnerable.

The original Cisco firmware for the E3000 also has vulnerabilities, which were never fixed.

Reply on news.ycombinator.com