Easter Egg Hidden in VMWare Fusion and Workstation | Hacker News Reader

Easter Egg Hidden in VMWare Fusion and Workstation

misc.name

72 pointsofficialjunk47 comments

Am I the only one not amused by easter eggs in software? It's code that I don't know about doing stuff that I don't know about. More code means more chances for bugs, maybe even bugs that results in security vulnerabilities. If the programmer snuck it in without management approval, it may mean code that isn't as thoroughly tested as the rest of the program.

It would be acceptable if each easter egg lasted a maximum of one release, followed by a public post-mortem on the vulnerability identified in the release management process.

To the three downvoters: are you saying that easter eggs are approved by the release management process? Wouldn't that make them features?

Easter eggs wouldn't be considered features (even if management-approved) because they are not advertised, and they do not perform a function related to the application. For example, if management approved a flight simulator in Excel '97, would you still consider if a 'feature' of Excel '97?

It was a feature (a property of the artifact) because it provided a signal about management priorities with respect to purchase criteria such as security. Microsoft eventually removed all Easter Eggs as part of their company-wide effort to fix their poor security reputation.

A programmer that leaves an easter egg in some critical part of the software really isn't worth his salt. For the very first thing, it would be way too obvious (no longer qualifying as an easter egg), and second, for the reasons you mentioned.

The way this is implemented, I can't see any harm: Instead of getting something along the line "BLEEP LOADER NOT FOUND AT 0" (and you'll still get this if len(floppyimg)>0 ) you get pong.

I think one should be amused here.

You aren't concerned with 'hidden' code - you're concerned about this now because you know it's there. Because it isn't hidden.

If you're worried about code doing things you don't know about then there's a heck of a lot more to VMWare that you could be concerned with. It's a huge, complex application. A few KB for a hidden game is irrelevant - you don't know what hundreds of MB of it actually does. If you're worried about things being hidden in apps then you run them in a trusted environment on tested hardware after you're audited the code (and removed the easter egg).

The only reason this should worry anyone is because VMWare potentially lost sales to organisations who do need to run audited code. I imagine they would have been supplied a version without the Easter Egg though.

Yes. It's a huge codebase. Why complicate it further by adding something 100% unnecessary? You cannot assume any bit of code no matter how small is irrelevant. If it's there it's potentially exploitable.

Because it's fun. As the industry matures, people seem to lose the sense of humuor - which is sad, because practical jokes and playfullness is what created said industry.

There is a time and place for humor. Important software is not one of them. When I run something on my machine I want it to do exactly what it is supposed to, nothing more and nothing less.

You won't be laughing if $RANDOM_EASTER_EGG has a bug that allows for remote code execution.

> There is a time and place for humor. Important software is not one of them.

Thing is, everyone seems to think the place and time is everywhere but not here and now. Companies today tend to have inflated sense of importance and gloominess stemming from what I believe is a mistaken understanding of professionalism.

> You won't be laughing if $RANDOM_EASTER_EGG has a bug that allows for remote code execution.

Hell yes I'll be laughing, I always laugh from remote code execution bugs ;). Anyway, you can argue that for any piece of code. Sure, an easter egg increases the surface of attack... by 0.1% or something.

Exactly. Anyone who objects to easter eggs because they may accidentally introduce vulnerabilities should be objecting much more strongly to features of the application that they don't need. If you want to know every aspect of a program, then you need to own the code and be brutal about stripping out features that you aren't currently using.

> When I run something on my machine I want it to do exactly what it is supposed to, nothing more and nothing less.

So you're running on seL4 right now? How's that going? Did you program the userspace yourself?

I'm impressed.

You must be a real blast at company party's - lighten up a sense of humour is a requirement in this industry.

Strongly disagree; appropriate humour in "professional" software is just fine:

  $ man tunefs
  System Administration Commands                         tunefs(1M)

  NAME
       tunefs - tune an existing UFS file system
  ...
  NOTES
       You can tune a file-system, but you can't tune a fish.

If people you don't trust can boot your VM from arbitrary floppy images, I have bad news: you have already been exploited.

I'm pretty sure the bulk of the code is in a disk image, and that binary is embedded instead of loaded from disk... the source for the image likely isn't in the same as an integrated egg generally speaking. They likely added one embed statement and a hotkey listener...

Relevant: http://programmers.stackexchange.com/questions/39200/what-ar...

A programmer who bothers to put in an Easter egg to me has pride in what they are creating and also gives them more ownership.

So I see it as both an indicator of good work and a positive thing.

Yes, other's believe that Easter eggs are bad I assume you're referring to the famous http://blogs.msdn.com/b/larryosterman/archive/2005/10/21/483...

It has good points but I believe it to be wrong in conclusion, there's lots of real issues to care about before this one.

I see an Easter egg as a sort of "finishing touch" - something added after everything else is done. Thus, if one occurs in software that appears to be buggy and/or unfinished, it definitely creates a bad impression for me, wheres if the software looks nearly perfect it has the opposite effect.

I somewhat agree - but given that no meaningful piece of software has ever shipped without bugs being punted (and bugs that weren't even known about), when is there really time to add an easter egg?

I agree with Easter Eggs in products. That being said another good example of an "Easter Egg gone wrong" was the games in Excel 95 and 97.

Excel 95 had a "Doom"-like 3D game. Excel 97 had a basic flight simulator. These were fun and weren't buggy, but here's the problem:

How much time do you think was lost in classrooms in particular after all the kids discovered there were games they could be playing instead of working? All of the built in Windows games were removed, and Flash/Java weren't installed. But you cannot remove these if you need Excel.

This was a legitimate issue in the 1990s. So much so that the school I attended gave anyone detention caught playing these games during class time(!). Yet every class there would be someone sitting in the corner playing away.

I find it hilarious that you're upset with easter eggs in principle because kids were distracted during class. I'm sure all those kids couldn't hack it in the real world because of these awful distractions.

> I find it hilarious that you're upset with easter eggs in principle because kids were distracted during class.

That's exactly the opposite of what I said, I said I liked Easter Eggs in principle but then gave an example of when they went wrong. The first line of my comment was: "I agree with Easter Eggs in products."

Easter Eggs are good, you just really have to consider the impact they're going to have (in terms of perception, usages, and bugs).

Perhaps it is not microsofts responsibility to ensure kids are always hard at work.

Nobody claimed otherwise.

However it is unfortunate that they decided to conflate a product needed in a classroom (namely the Office suite) and a feature which is not (namely a game).

Microsoft's only responsibility is that their software is fit for purpose, and in this scenario it is not.

edit: 4 people downvoted, not a single reply? This place is turning into Reddit. Pathetic behaviour.

No, you're not the only one. I share your concern for all the reasons you cite.

I'm also concerned about the development process itself. Design reviews? Code reviews? Automated testing? CI/CD? What is the impact of an easter egg on these things? Were the eggs noticed and tacitly approved? What does this tell us about the process?

Do I want to rely on the product of that process?

Or are we saying we don't care?

I appreciate the idea behind the easter egg, the little human touch, the little flourish that says "look what I built", I really do. But, fundamentally, the software I use becomes part of the machine - and I want it to behave that way, like a reliable machine that does exactly what I expect and only what I expect. If I want a human touch, I'll reach out to a human. If I want a surprise, I'll read a book or play a game.

Imagine an easter egg in your car's navigation system. Won't that be cool! Not.

Easter eggs, especially in software that should be part of the machine, strike me as the height of unprofessional irresponsible behaviour. An f-u to management and to users that deserves its own resounding f-u, I'll use someone else's professional, reliable tools, thank you.

Were the eggs noticed and tacitly approved? What does this tell us about the process?

It doesn't tell us anything about the production process at VM because we don't know if they were noticed and approved or not noticed. Don't assume either way.

Imagine an easter egg in your car's navigation system.

No need to imagine it.. http://www.gpsinformation.org/dale/secret.htm

In this case the majority of the easter egg code is running inside the VM sandbox. It's very unlikely but not impossible that the small amount of code needed to load the hidden disk image when a key combo is pressed would contain a major bug.

Personally I like it. It's a fun little touch

Since the software is closed, there is no code you know about and everything in there is doing stuff you don't know about with the exception of the intended consequences of the software. All you have is the publisher's promise it does only what it's intended to do.

Having said that, putting an easter egg in there denotes some kind of love for the product. I like that.

I've never had a job where we weren't constantly under tight (really, completely unreasonable) deadlines, so to me Easter Eggs always felt like a "fuck you losers" from developers at big, commercial software companies to developers at small, consulting software companies.

I wouldn't take it personally, it's more likely to be a bit of fun.

> I've never had a job where we weren't constantly under tight (really, completely unreasonable) deadlines

My guess would be the reason small/new shops have deadlines like that is because they're more likely to have less experienced managers. If it bothers you that much perhaps you should work at a larger company where the managers understand nine women can't make a baby in one month.

Is easter eggs in VM a good idea?

Couldn't malware attempt to locate potential easter eggs in order to determine if they are in a honeypot?

I think that there are millions of other aspects in a software (in vmware) which are much more important than easter egg or not easter egg. So the impact of an easter egg to this software quality is not significant.

VMalWare! Yikes!

I laughed harder than I should have.

> Couldn't malware attempt to locate potential easter eggs in order to determine if they are in a honeypot?

No. This is a key combination against the UI. If the VM could send key combinations to the UI of the VMC then the software running on the VM could determine if it was in a "honeypot" (VM) with or without this easter-egg (e.g. send CTRL-ALT-INSERT and see if CTRL-ALT-DELETE is triggered within the VM's context, restart the VM, alter connected devices, and so on).

Also, yes, I think Easter Eggs are fine in a VMC. Particularly when they're only UI deep as is this case. The only software I wouldn't put easter eggs into is software which is "life-death critical" (aircraft control systems, industrial equipment, et al). But these kind of systems are sometimes designed to be mathematically proven safe with no possible conflating variables in the execution (so putting in easter eggs would be HUGELY expensive and likely wouldn't happen for that reason).

"If you'd like to reverse engineer @scanlime's VMWare easter egg, attach a 0-length floppy image after booting and dump /dev/fd0 with dd."

https://twitter.com/travisgoodspeed/status/50224961576974745...

This is just an article linking to an article[1], which itself links to a Google translation of an article written in French[2].

[1]http://www.virtuallyghetto.com/2013/09/vmware-nested-easter-...

[2]http://www.hypervisor.fr/?p=4063

The French article has a comment by Regis Duschene one of the VMware Fusion developers stating that there is an Easter Egg in the Easter Egg.

The virtualghetto.com article is referring to that second easter egg (i.e. the Pride mode) and telling you how to "unlock" it.

The post linked to here on HN is by M. Elizabeth Scott who created the Pong OS easter egg while at VMware.

A version of the code of the Pong OS can be found here: http://sourceforge.net/p/vmware-svga/git/ci/master/tree/exam...

From a cursory look, I don't think it has the Pride mode.

There isn't really an explanation anywhere, but the colors that the game changes to in pride-mode look like original Apple logo colors - is that a hat tip?

>There isn't really an explanation anywhere, but the colors that the game changes to in pride-mode...

...are a rainbow, a symbol of gay pride[1].

[1] http://en.wikipedia.org/wiki/Gay_pride

Yes. Multiple meanings.. gay pride, but also pride in our work, and in producing the first product of its kind for Apple machines, and pride in the small team of us that made it happen within VMware.

This is the personal blog post of the author of the easter egg.

Oh, I stand corrected. Sorry.

your first statement is still true :) this article does in fact link to another, which links to another article.

i originally came across it here: https://twitter.com/scanlime/status/502239009595461632

Reply on news.ycombinator.com