6 ms·

What is the alternative to using Virtualbox besides buying a separate computer? I'm assuming there's more vulnerabilities to be found.

pipeep 9y ago
> What is the alternative to using Virtualbox Any other hypervisor. QEMU/KVM, Xen, VMWare, and Parallels all have good track records.
- sedachv 9y ago
  Xen doesn't: https://www.cvedetails.com/vulnerability-list/vendor_id-6276/XEN.html https://www.cvedetails.com/vulnerability-list/vendor_id-6276...
  - TheDong 9y ago
    Xen has a very responsible track record; they communicate clearly the scope and detail of vulnerabilities. This skews the CVE stats significantly since the kernel developers (aka kvm) rarely actually request CVE ids.
    - bonzini 9y ago
      Ehm, I always request CVE ids. KVM has had no serious VM escape in quite some time.
krylon 9y ago
On Linux, qemu/kvm works well enough for most purposes, on FreeBSD you have bhyve. OpenBSD's vmm is a thing, but I do not know if it can host other systems than OpenBSD, yet. On Windows, there is Hyper-V. I have only very little experience with it, but in my short time, I did not encounter anything I would like to complain about. I am not sure, however, if it comes with the client editions of Windows. Microsoft Virtual PC still exists, too. Xen is also a thing - run Dom0 as your desktop system, and run the VMs in the background. None of this is perfect, but if you need them, there are alternatives.
- bdcravens 9y ago
  > Microsoft Virtual PC still exists Not updated in almost 10 years, not supported on Windows 8 or 10.
  - Splines 9y ago
    I'm pretty sure the Virtual PC product went on to become Hyper-V.
    - emptysands 9y ago
      Some of the Xen technology went into Hyper-V. Microsoft had a partnership with the Cambridge labs.
    - bdcravens 9y ago
      My understanding is that Hyper-V replaced Virtual PC and was not based on it.
  - krylon 9y ago
    shudders Okay, that explains the vague feeling I had that something was not right with this one.
- Splines 9y ago
  > I am not sure, however, if it comes with the client editions of Windows. Microsoft Virtual PC still exists, too. It's in Windows 10 client editions too. Look under "Turn Windows features on or off". Windows Subsystem for Linux is there too.
  - Narishma 9y ago
    Not on the Home edition or whatever it's called.
    - tannhaeuser 9y ago
      Do you know if it can be installed on Home even if it's not part of the standard installation media?
userbinator 9y ago
I was going to recommend Bochs, which doesn't use virtualisation hardware at all and is instead an instruction-level emulator (much slower but should theoretically be more immune to hardware virtualisation bugs), but then there's this: https://www.cvedetails.com/vulnerability-list/vendor_id-2505/Bochs.html https://www.cvedetails.com/vulnerability-list/vendor_id-2505... Better than this though: https://www.cvedetails.com/vulnerability-list/vendor_id-93/product_id-20406/Oracle-Vm-Virtualbox.html https://www.cvedetails.com/vulnerability-list/vendor_id-93/p...
- pm215 9y ago
  Judging by the descriptions, these VirtualBox bugs are all in the device emulation, host-to-guest communications framework and so on, so they would apply equally whether the VM was using virtualization hardware or instruction emulation. This isn't unique to VirtualBox's track record -- the 'attack surface' for a VM is almost entirely in the device models, where software bugs allow VM escapes. The hardware virtualization is much less likely to cause problems: CPU bugs are rare compared to software bugs. In fact I think a pure-emulation setup would be worse off, because there's a lot more potentially buggy software doing the emulation that the guest can try to exploit. If you don't see those in a CVE list it's because nobody's bothering to try to exploit whatever emulator you're using, or because the emulator doesn't promise guest isolation and doesn't track bugs as CVEs. Comparison of raw CVE counts is tricky and risks apples-to-oranges problems.
  - bonzini 9y ago
    Compared to Xen and KVM, VirtualBox runs much larger parts of the device emulation in ring 0, together with the core CPU virtualization code, for performance. This is particularly important when KVM is used with a special user (such as user "qemu") and SELinux, because then a bug in QEMU becomes extremely hard to turn into host root access. Libvirt takes care of configuring SELinux this way for you, when you use for example KVM on OpenStack.
catdog 9y ago
> I'm assuming there's more vulnerabilities to be found. This also holds true for the alternatives.
deleted 9y ago
[deleted]
ThinkBeat 9y ago
Vmware Workstation or Player (on a Mac Fusion) on Linux workstation. Rock solid
equalunique 9y ago
There are VirtualBox alternatives, but the advantage of VirtualBox is your exported VM appliances may be imported to the same hypervisor on Windows, Mac, FreeBSD, Solaris, Illumos, and Linux. VirtualBox also has a slicker UI compared with QEMU/KVM on linux & bhyve on FreeBSD/Mac & vmm on OpenBSD. The alternatives all have their own merits, but if people are wondering why anyone would use VirtualBox, I believe the above reasons are why.

pipeep 9y ago

> What is the alternative to using Virtualbox Any other hypervisor. QEMU/KVM, Xen, VMWare, and Parallels all have good track records.

sedachv 9y ago
Xen doesn't: https://www.cvedetails.com/vulnerability-list/vendor_id-6276/XEN.html https://www.cvedetails.com/vulnerability-list/vendor_id-6276...
- TheDong 9y ago
  Xen has a very responsible track record; they communicate clearly the scope and detail of vulnerabilities. This skews the CVE stats significantly since the kernel developers (aka kvm) rarely actually request CVE ids.
  - bonzini 9y ago
    Ehm, I always request CVE ids. KVM has had no serious VM escape in quite some time.

krylon 9y ago

On Linux, qemu/kvm works well enough for most purposes, on FreeBSD you have bhyve. OpenBSD's vmm is a thing, but I do not know if it can host other systems than OpenBSD, yet. On Windows, there is Hyper-V. I have only very little experience with it, but in my short time, I did not encounter anything I would like to complain about. I am not sure, however, if it comes with the client editions of Windows. Microsoft Virtual PC still exists, too. Xen is also a thing - run Dom0 as your desktop system, and run the VMs in the background. None of this is perfect, but if you need them, there are alternatives.

bdcravens 9y ago
> Microsoft Virtual PC still exists Not updated in almost 10 years, not supported on Windows 8 or 10.
- Splines 9y ago
  I'm pretty sure the Virtual PC product went on to become Hyper-V.
  - emptysands 9y ago
    Some of the Xen technology went into Hyper-V. Microsoft had a partnership with the Cambridge labs.
  - bdcravens 9y ago
    My understanding is that Hyper-V replaced Virtual PC and was not based on it.
- krylon 9y ago
  shudders Okay, that explains the vague feeling I had that something was not right with this one.
Splines 9y ago
> I am not sure, however, if it comes with the client editions of Windows. Microsoft Virtual PC still exists, too. It's in Windows 10 client editions too. Look under "Turn Windows features on or off". Windows Subsystem for Linux is there too.
- Narishma 9y ago
  Not on the Home edition or whatever it's called.
  - tannhaeuser 9y ago
    Do you know if it can be installed on Home even if it's not part of the standard installation media?

userbinator 9y ago

I was going to recommend Bochs, which doesn't use virtualisation hardware at all and is instead an instruction-level emulator (much slower but should theoretically be more immune to hardware virtualisation bugs), but then there's this: https://www.cvedetails.com/vulnerability-list/vendor_id-2505/Bochs.html https://www.cvedetails.com/vulnerability-list/vendor_id-2505... Better than this though: https://www.cvedetails.com/vulnerability-list/vendor_id-93/product_id-20406/Oracle-Vm-Virtualbox.html https://www.cvedetails.com/vulnerability-list/vendor_id-93/p...

pm215 9y ago
Judging by the descriptions, these VirtualBox bugs are all in the device emulation, host-to-guest communications framework and so on, so they would apply equally whether the VM was using virtualization hardware or instruction emulation. This isn't unique to VirtualBox's track record -- the 'attack surface' for a VM is almost entirely in the device models, where software bugs allow VM escapes. The hardware virtualization is much less likely to cause problems: CPU bugs are rare compared to software bugs. In fact I think a pure-emulation setup would be worse off, because there's a lot more potentially buggy software doing the emulation that the guest can try to exploit. If you don't see those in a CVE list it's because nobody's bothering to try to exploit whatever emulator you're using, or because the emulator doesn't promise guest isolation and doesn't track bugs as CVEs. Comparison of raw CVE counts is tricky and risks apples-to-oranges problems.
- bonzini 9y ago
  Compared to Xen and KVM, VirtualBox runs much larger parts of the device emulation in ring 0, together with the core CPU virtualization code, for performance. This is particularly important when KVM is used with a special user (such as user "qemu") and SELinux, because then a bug in QEMU becomes extremely hard to turn into host root access. Libvirt takes care of configuring SELinux this way for you, when you use for example KVM on OpenStack.

catdog 9y ago

> I'm assuming there's more vulnerabilities to be found. This also holds true for the alternatives.

deleted 9y ago

[deleted]

ThinkBeat 9y ago

Vmware Workstation or Player (on a Mac Fusion) on Linux workstation. Rock solid

equalunique 9y ago

There are VirtualBox alternatives, but the advantage of VirtualBox is your exported VM appliances may be imported to the same hypervisor on Windows, Mac, FreeBSD, Solaris, Illumos, and Linux. VirtualBox also has a slicker UI compared with QEMU/KVM on linux & bhyve on FreeBSD/Mac & vmm on OpenBSD. The alternatives all have their own merits, but if people are wondering why anyone would use VirtualBox, I believe the above reasons are why.