10 ms·
All that stuff - bittorrent, soulseek, calibre etc - lives in a vm, with access to the host only via samba shares. I'll decide what you see and where you can
by dave2000 11y ago
All that stuff - bittorrent, soulseek, calibre etc - lives in a vm, with access to the host only via samba shares. I'll decide what you see and where you can write. Yes, it's great you download stuff. No, you can't write to the stuff I'm sharing. Yes, having a web-server serving up books to the outside world is great. No, you can't serve up anything from my filesystem to anyone who feels like it.
When you can't (be bothered to) vet the source code, stick it in a vm. On a sensible machine with an ssd it's only 10 seconds away. Why risk it. Especially if the software you want/need to run only works under windows.
- TazeTSchnitzel 11y agoBeware that VMs are not necessarily secure. They can be escaped!
- dave2000 11y agoSure, in theory. Are there any current exploits for VirtualBox? The way I see it, they're more secure that running the same apps on bare metal. Ubuntu host running a Fedora VM; the latter (with Transmission etc) only running when I need the apps running - seems an almost entirely painless way of providing a lot of security.
- nevir 11y agoUnsure if there are any currently publicly known exploits, but it sure isn't unheard of for VirtualBox: * http://arstechnica.com/security/2015/05/extremely-serious-virtual-machine-bug-threatens-cloud-providers-everywhere/ http://arstechnica.com/security/2015/05/extremely-serious-vi... * http://www.securityfocus.com/archive/1/495095 http://www.securityfocus.com/archive/1/495095 * https://www.cert.be/advisories/oracle-vm-virtualbox-two-privilege-escalation-vulnerabilities https://www.cert.be/advisories/oracle-vm-virtualbox-two-priv... * http://www.coresecurity.com/content/virtualbox-privilege-escalation-vulnerability http://www.coresecurity.com/content/virtualbox-privilege-esc...
- brians 11y agoYes! Some reliable ways to extract an RSA key, and some less reliable ways to swap two cache lines. Virtualization on x86 is a helpful tool for configuration management, but should not be mistaken for a security feature.
- digi_owl 11y agoMore secure than without though. Lets try to avoid treating security as something binary.
- nikanj 11y agoThis argument is similar to "a condom can always break". Technically you are correct, but I'd still use one.
- conradev 11y agoWhich is the entire premise behind Qubes: https://www.qubes-os.org https://www.qubes-os.org
- feld 11y agoThis argument is only similar if the condom is known to have huge design flaws VMs have tons of well documented issues. If you want a smaller attack surface, try OS virtualization technologies (zones/jails)
- lawnchair_larry 11y agoThis makes no sense. VMs are by far the most secure form of isolation. No one is going to get infected with malware that escapes VMs - it is far too valuable.
- feld 11y agoHow can you honestly think VMs are the most secure form of isolation?
- b1460151 11y agoYes but if you run a compromised App in VM A and have your sensitive data in VM B then they have to break out of the VM A and then break into VM B. It's no longer worth the effort. There are often easier ways like phising.
- Aleman360 11y agoThis is exactly why sandboxed apps (e.g., iOS/UWP/etc.) are a good thing.
- comex 11y agoOr the Mac App Store itself. Its enforced sandboxing would have provided a decent first line of defense against this, but torrent clients can't be submitted to the App Store due to Apple not liking the legal aspects, not to mention the other issues people have with it. (Outside the store, apps can still opt into sandboxing, but that wouldn't help with a malicious installer.)
- maerF0x0 11y agoI doubt Apple keeps it out for "Legal" aspects. iTunes sales seems more likely.
- orionblastar 11y agoFor Windows there is SandboxIE: http://www.sandboxie.com/index.php?DownloadSandboxie http://www.sandboxie.com/index.php?DownloadSandboxie It should be able to sandbox Windows Apps, except for Metro/Modern UI Apps and Microsoft Edge. Too many programs are having a backdoor or Trojan in them now. It is a good idea to run any app that accesses the Internet in a sandbox first to see what it does.
- daveguy 11y agoAlso cameyo to make your own: http://www.cameyo.com http://www.cameyo.com And they have prepackaged sandboxed apps: https://online.cameyo.com/public https://online.cameyo.com/public
- voltagex_ 11y agoI have no problem paying for apps but for people who have paid for SandboxIE, do you think you've got your money's worth out of it?
- 11y ago
- frozenport 11y agoNow you got an infected VM. How about we stop packing malware in OSS?
- touristtam 11y agoWouldn't have a container for this be good enough ?
- dave2000 11y agoI have no idea;I've never used a container. Is it easier than downloading an ISO, selecting how much ram/disk/cpu to give it and installing it?
- IncRnd 11y agoA container may be "good enough", but running within a container generally doesn't give the same security posture as running within a virtual machine.
- kobayashi 11y agoAdmittedly, this might reasonably be considered a basic question, but how do you recommend running a VM on a Mac?
- 542458 11y ago> soulseek Neat. Never heard of this one before - what makes it special?
- rstacruz 11y agoIt's a very old P2P file sharing network modeled after Napster. It's main propositions (in my opinion) are its active users who share harder-to-find electronic music, and its discussion groups which are available inside the app.
- thirdsun 11y agoI didn't know Soulseek is still alive - brings me back to the days of Direct Connect / DC++ and hunting down rare live sets and (as you mentioned) electronic music over ISDN/dial up.
- mirimir 11y agoYou can also lease a VPS (anonymously even) and use Deluge with a webGUI. Said webGUI can be a Tor onion service, for better isolation. But still, this is about malware in Transmission itself, not anything downloaded using it. So the fact that it's a BitTorrent client is rather beside the point, I think.