9 ms·
Better slow than sorry – VirtualBox 3D acceleration considered harmful
- pytyper2 8y ago3D acceleration has its own issues aside from the security concerns. https://askubuntu.com/questions/1035410/ubuntu-18-04-gnome-hangs-on-virtualbox-with-3d-acceleration-enabled https://askubuntu.com/questions/1035410/ubuntu-18-04-gnome-h...
- komali2 8y agoOh woops, I accidentally duplicated that question without realizing it a few weeks ago: https://unix.stackexchange.com/questions/458034/fullscreen-mode-in-apps-causes-gnome-shell-to-hit-80-100-cpu-even-after-closin https://unix.stackexchange.com/questions/458034/fullscreen-m... Took me ages to figure out it was virtual box that was the issue, not gnome or vscode. A shame, I liked my VM in Windows set up. Now I had to suffer through installing Ubuntu natively on a gen3 Thinkpad x1 yoga which has been a new class of nightmare thanks to Lenovo nuking critical sleep functionality:https://forums.lenovo.com/t5/Linux-Discussion/X1-Carbon-Gen-6-cannot-enter-deep-sleep-S3-state-aka-Suspend-to/td-p/3998182/page/19 https://forums.lenovo.com/t5/Linux-Discussion/X1-Carbon-Gen-... Getting my tools just like I like them always has such an exhausting spin-up time.
- X6S1x6Okd1st 8y agoI've been pleasantly surprised with how well Linux subshell for Windows has been working
- pytyper2 8y agoThis will work but then you have to find a system to test on, I like to have my dev vm as close to production as possible.
- swiley 8y agoOr just run a WM that doesn't need compositing to be usable. (fvwm for example)
- AstralStorm 8y agoDoes not mean that basics like VSync will work.
- pytyper2 8y agoI spend most of my time in sublime and terminal, so I deal with it for the sake of my current deadline. Should I believe it will never be fixed?
- zokier 8y agoAnd the grass is not much greener on the other side either: https://github.com/vmware/open-vm-tools/issues/176 https://github.com/vmware/open-vm-tools/issues/176 :(
- 1996 8y agoThe only valid safety model is airgapped computers, stripped of any networking equipment, fed data only using dedicated thumbdrives coming from another computer running a different OS VM are a problem waiting to happen.
- craftyguy 8y agoConsidering all of the issues with usb, you'd be better off using floppy disks or optical drives for data transfer to this hypothetical 'secure' system. > VM are a problem waiting to happen. Something something security threat model and personal risk tolerance...
- 1996 8y agoThe problem of optical drives is the size limit and the time to make them. They can contain malicious code just as well as a thumbdrive. The concern with USB is the firmware, and the thumbdrive pretending to be a HID device or having an extra partition with malicious code. Purchasing many similar drives of a well known brand in a random supermarket is a reasonable alternative. Just keep them for 1 year before using them, in case an exploit becomes popular - but this is extremely paranoid.
- craftyguy 8y ago> They can contain malicious code just as well as a thumbdrive Of course. > The concern with USB is the firmware, and the thumbdrive pretending to be a HID device or having an extra partition with malicious code. Right, that's the concern I was alluding to above. You'd still be better off burning optical media (and disabling any autoplay crap on the target system). You can still store severl GB of data on optical media. > Just keep them for 1 year before using them, in case an exploit becomes popular - but this is extremely paranoid. This may work if you only stick with very popular makes/models, since they would have a higher chance of being 'noticed' for doing something wrong.
- 1996 8y ago
- bcoates 8y agoIf this worries you go ahead and disable WebGL too.
- zokier 8y agoFrankly, might not be such a bad idea. https://www.contextis.com/blog/webgl-more-webgl-security-flaws https://www.contextis.com/blog/webgl-more-webgl-security-fla... etc
- mirimir 8y agotl;dr > However, to enable this impressive breakthrough in online technology, web browsers (currently Chrome and Firefox) have had to expose low level parts of their operating systems which previously could not be directly accessed by potentially malicious web pages, thus creating a number of potential security vulnerabilities.
- greggman 8y agoyour post is FUD. that issus was solved immediately and the actually bug listed had nothing special to do with graphics and is just a bug like a bug in javascripy or the browser in general. a bug that was fixed. If you're going to off WebGL based on that bug then you'd better turn off your entire browser
- mirimir 8y agoI do. It's a fingerprinting risk, if nothing else.
- greggman 8y agoChrome itself doesn't have these issues. In particular it doesn't support features that would raise these kinds of issues. For one it's not supporting all of desktop opengl it's only supporting the subset that needed for WebGL. All of if is massively validated , shaders are rewritten, bound checked, memory cleared, clamps added, etc...
- greggman 8y ago
- deleted 8y ago[deleted]
- chomp 8y ago*VirtualBox considered harmful Oracle recently started hunting our company for licenses due to the fact that the VB guest additions software phones home. Fail on us for not considering the license on the guest additions outside of the VirtualBox software. Bye bye Vagrant! Time for a new workflow!
- organsnyder 8y agoApparently they track it by downloads. My previous employer (a 25k employee healthcare system) had IP addresses in their logs a dozen times. Rather than telling Oracle to go f&*$ themselves (or at least pointing out that the organization has guest networks used by thousands of people), they rolled over and paid the $40,000 invoice—and threatened to take away the ability for their in-house software developers to download their own software.
- Murrawhip 8y agoYou mean virtualbox extension pack, right? As far as I'm aware, guest additions don't require a paid license.
- barbegal 8y agoAre you sure you mean "Guest additions". Guest additions is GPL licensed however the "VirtualBox Extension Pack" requires a paid for license to use commercially. And since Oracle make it very clear what licenses are needed [1] they are well within their rights to hunt down your company for revenue which is due. [1] https://www.virtualbox.org/wiki/Licensing_FAQ https://www.virtualbox.org/wiki/Licensing_FAQ
- AnssiH 8y agoBy the way, this is a relatively recent change made in July 2017 (License version 10). Before that there was no "noncommercial" restriction, and the free license allowed commercial use as long as you installed it yourself (i.e. not deployed company-wide etc.). Old FAQ, license, and a relevant FAQ excerpt: https://web.archive.org/web/20161108235524/https://www.virtualbox.org/wiki/Licensing_FAQ https://web.archive.org/web/20161108235524/https://www.virtu... https://web.archive.org/web/20170126144347/https://www.virtualbox.org/wiki/VirtualBox_PUEL https://web.archive.org/web/20170126144347/https://www.virtu... > Personal use is when you install the product on one or more PCs yourself and you make use of it (or even your friend, sister and grandmother). It doesn't matter whether you just use it for fun or run your multi-million euro business with it. Also, if you install it on your work PC at some large company, this is still personal use. However, if you are an administrator and want to deploy it to the 500 desktops in your company, this would no longer qualify as personal use. Current license with the "noncommercial" requirement: https://www.virtualbox.org/wiki/VirtualBox_PUEL https://www.virtualbox.org/wiki/VirtualBox_PUEL
- tombert 8y agoI ask this in sincerity; in Linux land, what is a good alternative to VirtualBox? Are there any that can do proper 3D acceleration to play games at a reasonable speed?
- robeastham 8y agoOn linux you could try QEMU/KVM with GPU passthrough - install virtmanager for GUI. Easy with a desktop, difficult to do, but possible on Optimus laptops with - so you need the right kind of integrated and dedicated GPU there - see this guide https://gist.github.com/Misairu-G/616f7b2756c488148b7309addc940b28 https://gist.github.com/Misairu-G/616f7b2756c488148b7309addc.... Easy, but expensive route for a laptop, on a more modern laptop, would be to attach a eGPU enclosure via thunderbolt and share/passthrough that to your VM. If you are considering doing your VM's on a server then it's worth a look at Unraid too - it uses QEMU/KVM under the hood but has some other advantages too. Edit: you are likely to lose a little GPU 2-3% due to vm overhead, but GPU passthrough is as close to native as you are going to get. I've happily run a high end VR headset via a Windows VM running on Unraid in the past.
- deleted 8y ago[deleted]
- pmalynin 8y agoI had a similar setup about a year back. Running a Ubuntu Host with KVM, passing through an NVIDIA 970 to a Windows host. Yea...the GPU performance was fast, but everything else was so slow compared to running native. I think my biggest issue was with disk R/W, especially when memory pressure went up from the VM the system bogged down to a halt. After that, my biggest problems were with the fact that after the Windows host turned off, the GPU was stuck in the weird state where you can't reset it ( I know its a feature™ from Nvidia) and the Keyboard / Mouse would flake since I would attach the whole USB root to the VM as well. In the end just decided to install back Windows and not have to deal with it.
- dijit 8y ago
- mirimir 8y ago> One could argue that technically this component might not be considered attack surface in VirtualBox, due to the big warning put out in the documentation recommending against its use ... Yes, that was my reaction.
- barbegal 8y agoThe current situation seems perfectly fine to me. In reality, lots of people are using VirtualBox for completely trusted virtual machines so why not allow 3D acceleration for that use case?
- brink 8y agoPersonally, I consider it beneficial, as I'd want my games and software (that hasn't been ported to my OS of choice, but I still trust) to run as fast as possible. Not fully sandboxed != "harmful" to everyone. Maybe "VirtualBox 3D acceleration not fully sandboxed" would be a more accurate, less sensationalist title?
- whyagaindavid 8y agoIf u do not need 3D, I strongly suggest moving to lxd. Using in kernel security and it is very light. Couple it to zfs and it runs 100 containers for a measily 15 GB RAM.
- AstralStorm 8y agoIn kernel insecurity you mean. Lxd escape is trivial, might not use a container anyway if security is the goal. Xen with driver domains and (only just started) similar support in KVM is about the kit reasonable thing from security point of view. Maybe VMware but that cannot be studied.