7 ms·

Netboot

214 points by p4bl0 11y ago

jamescun 11y ago
NetBooting from the internet AND over HTTP? Sign me up! Sarcasm aside, at the very least it would have been nice to see it use iPXE's `imgtrust` and `imgverify` functionality, which I could then audit and load on to a boot medium for netboot use.
- alfiedotwtf 11y ago
  For any naysayers, there's no difference between this project and say Hashicorps' images. You're either using upstream, or you're not. But yeah, you probably want a cert. To be honest, this looks like a cool project. I've always wanted a way to PXE without having to need another host on the LAN.
- deleted 11y ago
  [deleted]
- vive-la-liberte 11y ago
  >at the very least it would have been nice to see it use iPXE's `imgtrust` and `imgverify` functionality I'm not familiar with these but I saw a commit from just a couple of hours ago referencing "image trust" [1], so maybe it's in the works now following your comment? [1]: https://github.com/antonym/netboot.xyz/commit/25910be18da219c4a5a6cd292e25eb8b1dd147ed https://github.com/antonym/netboot.xyz/commit/25910be18da219...
gravypod 11y ago
Running unsigned code from the internet? Have I woken up in crazy land today? When did things like this become acceptable.
- p4bl0 11y ago
  I had the exact same reaction (and friends over IRC too), but I still find the idea quite cool: it could be implemented correctly (with signature verification or something alike). Also, if it is just to try out a new OS in a virtual machine, I guess it is okay to use such a service :).
  - gravypod 11y ago
    Yes, but you would probably want to have a local copy of all public keys for the OSs for verification, it would have to go over HTTPS, and You would likely need some signature validation. The idea is really cool, specifically I'd use this for the raspberry pi. I hope someone does some major security maintenance on this
- 1ris 11y ago
  People are running untrused code all the time. How uses a 100% open source, repoducably build, 100% audited os?
  - gravypod 11y ago
    The problem is that this is going over the intenet. If you haven't seen what kind of problems this can cause, you should look at moxie sslstrip talk from defcon. The problem arises when other people want root access to your system and they can now get it from a VERY simple man in the middle. Running untrusted code is one thing, running it after pulling it from the internet is an ENTIRELY different subject.
    - 1ris 11y ago
      All my apt-get downloads go over the internet. All my install isos. People download third party docker contains. I can't see how this is worse.
- akerro 11y ago
  Run: sh | wget http://www...something.com/install.sh http://www...something.com/install.sh to install something automatically! Way too many projects do it, from my head: rvm and oh-my-zsh.
  - tacojuan 11y ago
    docker?
  - rplnt 11y ago
    Don't forget that many require you to use sudo.
    - akerro 11y ago
      zsh: command not found: sudo
  - bodyfour 11y ago
    No worse than "./configure && make && sudo make install"
    - viraptor 11y ago
      It's a bit different though. autoconf/automake is mostly autogenerated and will prevent silly issues like accidental wiping of your drive (https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/issues/123 https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/issue...). Released packages will often have hashes either on the website or as additional download. With git you can verify tags (provided they're signed). You can compile&test package inside chroot before installing. Etc. etc. In theory, yes, `curl | sh` is the same as configure&make is the same as downloading your initial iso image and installing the system from it. In practice they have different risks associated with them.
      - akerro 11y ago
        What about AUR from ArchLinux? It's similar, but it also has different risks, Vidalia/Tor-git maintainers change quite often, users are forced to add new GPG keys, but it downloads src from git (quite often). What about `cd /usr/ports/www/firefox && make clean install`?
neeel 11y ago
Sounds great
Mojah 11y ago
I'm happy to see the PXE booting scene get a new revival. It's one of those crucial services that's often neglected. It's also not a very "sexy" place to do development in, but boy it's good to see a proper tool emerge. Fyi, I first heard about Netboot via the cron.weekly newsletter last Sunday, it seems to be a very new project that's only just been released: http://www.cronweekly.com/issue-11/ http://www.cronweekly.com/issue-11/
mcs_ 11y ago
Thanks
mercora 11y ago
After boot.kernel.org and netboot.me seem dead now i like to see this kind of thing available again. I acknowledge the threat of downloading these boot images over the internet but think it is actually not that much different from downloading the iso... from the internet. Sure, i could verify the image more easily but i barely did this in the past. However the ability to verify the the images would be nice though.
- theantonym 11y ago
  Dev here. The project is just a bunch of iPXE scripts that understands how each distro works and routes you to their hosted bits or a trusted mirror once you select the image. I've tried to keep all of the code on Github and the Travis CI deployment out in the open for that very reason. A project like this needs to be highly visible in order to be trusted to a degree. I also have things like image verification and https support on the list of things to do.
HeadlessChild 11y ago
Archlinux does the same thing for their releases. https://releng.archlinux.org/pxeboot/ https://releng.archlinux.org/pxeboot/
matt_wulfeck 11y ago
This is a really neat idea security concerns aside. I have about 5 minutes USB drives laying around with various OS versions. Sometimes I just want to you with something (such as mint Linux) and this kind of thing is ideal! Thanks dev, great work!
mawalu 11y ago
A short idea after seeing some people complaining about the security. Wouldn't it be possible to host the IPXE scripts itself on gh-pages? That way the hosting would be complete transparent and the .github.io domain would work over SSL
mwcampbell 11y ago
Looks similar to boot.rackspace.com.
- jlgaddis 11y ago
  Looks like the author works for Rackspace so it may be related.
- theantonym 11y ago
  Yeah, I originally wrote boot.rackspace.com. I built netboot.xyz based on a lot of that original code, expanded what Operating Systems and Utilities it supported, and wanted to make it a more open project for everyone to take advantage of.
7373737373 11y ago
Combining this with IPFS.io would be interesting. See https://github.com/zignig/astralboot https://github.com/zignig/astralboot
crackerjackmack 11y ago
Netbooting isn't new. Insecure netbooting isn't new (ala netboot install USB's per distro). Wrapping it up into a cohesive service is and it's awesome. Going signed CA wouldn't be hard to do in this case at all, it's just part of the build process actually but only gets you to to a trusted PXE+menu system. After getting into the PXE menu a system could still hijack the upstream kernel/initrd files. Even freebsd netinstall (aka not limited to linux installers) is just http/ftp without any package signing. The whole ecosystem probably needs to mature some more in regards to verification that won't break downstream projects such as this.
crackerjackmack 11y ago
Netbooting isn't new. Insecure netbooting isn't new (ala netboot install USB's per distro). Wrapping it up into a cohesive service is and it's awesome. Going signed CA wouldn't be hard to do in this case at all, it's just part of the build process actually but only gets you to to a trusted PXE+menu system. After getting into the PXE menu a system could still hijack the upstream kernel/initrd files. Even freebsd netinstall (aka not limited to linux installers) is just http/ftp without any package signing. The whole ecosystem probably needs to mature some more in regards to verification that won't break downstream projects such as this.
jlgaddis 11y ago
This is very cool and very useful to me as I'm currently in the process of rebuilding our infrastructure (working on OpenBSD autoinstalls at the moment). I'm gonna test this out very shortly although I'll be using it internally and not over the Internet (for what should be obvious reasons), but it will definitely simplify things for me. Thanks!
notlisted 11y ago
The only thing I get from xyz domains is spam and viruses (I didn't click the link).
- therein 11y ago
  It is just a TLD, dude. Doesn't mean anything.
  - legulere 11y ago
    It means much: who is operating it and under which jurisdiction.
    - deleted 11y ago
      [deleted]
- eric_h 11y ago
  https://abc.xyz https://abc.xyz
- ajdlinux 11y ago
  I've seen more legitimate users of .xyz than of .biz (which pre-New GTLDs was the go-to TLD for general awfulness...)

214 points by p4bl0 11y ago

NetBooting from the internet AND over HTTP? Sign me up! Sarcasm aside, at the very least it would have been nice to see it use iPXE's `imgtrust` and `imgverify` functionality, which I could then audit and load on to a boot medium for netboot use.

alfiedotwtf 11y ago
For any naysayers, there's no difference between this project and say Hashicorps' images. You're either using upstream, or you're not. But yeah, you probably want a cert. To be honest, this looks like a cool project. I've always wanted a way to PXE without having to need another host on the LAN.
deleted 11y ago
[deleted]
vive-la-liberte 11y ago
>at the very least it would have been nice to see it use iPXE's `imgtrust` and `imgverify` functionality I'm not familiar with these but I saw a commit from just a couple of hours ago referencing "image trust" [1], so maybe it's in the works now following your comment? [1]: https://github.com/antonym/netboot.xyz/commit/25910be18da219c4a5a6cd292e25eb8b1dd147ed https://github.com/antonym/netboot.xyz/commit/25910be18da219...

gravypod 11y ago

Running unsigned code from the internet? Have I woken up in crazy land today? When did things like this become acceptable.

p4bl0 11y ago
I had the exact same reaction (and friends over IRC too), but I still find the idea quite cool: it could be implemented correctly (with signature verification or something alike). Also, if it is just to try out a new OS in a virtual machine, I guess it is okay to use such a service :).
- gravypod 11y ago
  Yes, but you would probably want to have a local copy of all public keys for the OSs for verification, it would have to go over HTTPS, and You would likely need some signature validation. The idea is really cool, specifically I'd use this for the raspberry pi. I hope someone does some major security maintenance on this
1ris 11y ago
People are running untrused code all the time. How uses a 100% open source, repoducably build, 100% audited os?
- gravypod 11y ago
  The problem is that this is going over the intenet. If you haven't seen what kind of problems this can cause, you should look at moxie sslstrip talk from defcon. The problem arises when other people want root access to your system and they can now get it from a VERY simple man in the middle. Running untrusted code is one thing, running it after pulling it from the internet is an ENTIRELY different subject.
  - 1ris 11y ago
    All my apt-get downloads go over the internet. All my install isos. People download third party docker contains. I can't see how this is worse.
akerro 11y ago
Run: sh | wget http://www...something.com/install.sh http://www...something.com/install.sh to install something automatically! Way too many projects do it, from my head: rvm and oh-my-zsh.
- tacojuan 11y ago
  docker?
- rplnt 11y ago
  Don't forget that many require you to use sudo.
  - akerro 11y ago
    zsh: command not found: sudo
- bodyfour 11y ago
  No worse than "./configure && make && sudo make install"
  - viraptor 11y ago
    It's a bit different though. autoconf/automake is mostly autogenerated and will prevent silly issues like accidental wiping of your drive (https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/issues/123 https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/issue...). Released packages will often have hashes either on the website or as additional download. With git you can verify tags (provided they're signed). You can compile&test package inside chroot before installing. Etc. etc. In theory, yes, `curl | sh` is the same as configure&make is the same as downloading your initial iso image and installing the system from it. In practice they have different risks associated with them.
    - akerro 11y ago
      What about AUR from ArchLinux? It's similar, but it also has different risks, Vidalia/Tor-git maintainers change quite often, users are forced to add new GPG keys, but it downloads src from git (quite often). What about `cd /usr/ports/www/firefox && make clean install`?

neeel 11y ago

Sounds great

Mojah 11y ago

I'm happy to see the PXE booting scene get a new revival. It's one of those crucial services that's often neglected. It's also not a very "sexy" place to do development in, but boy it's good to see a proper tool emerge. Fyi, I first heard about Netboot via the cron.weekly newsletter last Sunday, it seems to be a very new project that's only just been released: http://www.cronweekly.com/issue-11/ http://www.cronweekly.com/issue-11/

mcs_ 11y ago

Thanks

mercora 11y ago

After boot.kernel.org and netboot.me seem dead now i like to see this kind of thing available again. I acknowledge the threat of downloading these boot images over the internet but think it is actually not that much different from downloading the iso... from the internet. Sure, i could verify the image more easily but i barely did this in the past. However the ability to verify the the images would be nice though.

theantonym 11y ago
Dev here. The project is just a bunch of iPXE scripts that understands how each distro works and routes you to their hosted bits or a trusted mirror once you select the image. I've tried to keep all of the code on Github and the Travis CI deployment out in the open for that very reason. A project like this needs to be highly visible in order to be trusted to a degree. I also have things like image verification and https support on the list of things to do.

HeadlessChild 11y ago

Archlinux does the same thing for their releases. https://releng.archlinux.org/pxeboot/ https://releng.archlinux.org/pxeboot/

matt_wulfeck 11y ago

This is a really neat idea security concerns aside. I have about 5 minutes USB drives laying around with various OS versions. Sometimes I just want to you with something (such as mint Linux) and this kind of thing is ideal! Thanks dev, great work!

mawalu 11y ago

A short idea after seeing some people complaining about the security. Wouldn't it be possible to host the IPXE scripts itself on gh-pages? That way the hosting would be complete transparent and the .github.io domain would work over SSL

mwcampbell 11y ago

Looks similar to boot.rackspace.com.

jlgaddis 11y ago
Looks like the author works for Rackspace so it may be related.
theantonym 11y ago
Yeah, I originally wrote boot.rackspace.com. I built netboot.xyz based on a lot of that original code, expanded what Operating Systems and Utilities it supported, and wanted to make it a more open project for everyone to take advantage of.

7373737373 11y ago

Combining this with IPFS.io would be interesting. See https://github.com/zignig/astralboot https://github.com/zignig/astralboot

crackerjackmack 11y ago

Netbooting isn't new. Insecure netbooting isn't new (ala netboot install USB's per distro). Wrapping it up into a cohesive service is and it's awesome. Going signed CA wouldn't be hard to do in this case at all, it's just part of the build process actually but only gets you to to a trusted PXE+menu system. After getting into the PXE menu a system could still hijack the upstream kernel/initrd files. Even freebsd netinstall (aka not limited to linux installers) is just http/ftp without any package signing. The whole ecosystem probably needs to mature some more in regards to verification that won't break downstream projects such as this.

crackerjackmack 11y ago

jlgaddis 11y ago

This is very cool and very useful to me as I'm currently in the process of rebuilding our infrastructure (working on OpenBSD autoinstalls at the moment). I'm gonna test this out very shortly although I'll be using it internally and not over the Internet (for what should be obvious reasons), but it will definitely simplify things for me. Thanks!

notlisted 11y ago

The only thing I get from xyz domains is spam and viruses (I didn't click the link).

therein 11y ago
It is just a TLD, dude. Doesn't mean anything.
- legulere 11y ago
  It means much: who is operating it and under which jurisdiction.
  - deleted 11y ago
    [deleted]
eric_h 11y ago
https://abc.xyz https://abc.xyz
ajdlinux 11y ago
I've seen more legitimate users of .xyz than of .biz (which pre-New GTLDs was the go-to TLD for general awfulness...)