5 ms·
I'm on several private torrent sites and I still wont run software out of a VM. The problem is the users are trusted but unless they packaged the crack themselv
by Polylactic_acid 6y ago
I'm on several private torrent sites and I still wont run software out of a VM. The problem is the users are trusted but unless they packaged the crack themselves they don't even know if there is malware bundled in. Its easy to verify that audio or a book is high quality but verifying software is next to impossible.
- austhrow743 6y agoSoftware on private torrent sites comes straight from the scene, who treat their hobby pretty seriously.
- Cyph0n 6y agoExactly. Scene groups are tight knit and very professional.
- techntoke 6y agoUnless you piss them off and become their target
- FindMySocks 6y agoGood point. Though there's an easy solution to this, and actually quite a few situations in real life. Brace yourself people as I'm about to drop a knowledge bomb: "Don't be a dick."
- dewey 6y agoIf it's not a 0day tracker they usually unpack the scene files and repackage them so you don't have the split archive files. It wouldn't be hard to slip something in in this process.
- philliphaydon 6y agoOne of the things I miss in Windows 10 I don't have on Ubuntu is 'Windows Sandbox'. It's great for testing software out. It loads pretty much instantly.
- heavyset_go 6y agoLook into Firejail. https://firejail.wordpress.com/ https://firejail.wordpress.com/
- philliphaydon 6y agoThanks!
- panpanna 6y agoIf you are going that route you are better of with LXC or Docker. IIRC LXC is part of the 20.04 install. Or use Vagrant if you want better security.
- aj3 6y agoThere are so many ways to escape Firejail, that no one should seriously rely (solely) on it for security. Please, just use proper virtualization for trying shady software/suspected malware.
- deleted 6y ago[deleted]
- wsc981 6y agoIs there such software for macOS?
- leoh 6y agoThis is 100%. I'm not sure, however, that I even trust PDFs these days. Somewhat paranoid there are zero days on libgen, etc.
- wolfgke 6y ago> Somewhat paranoid there are zero days on libgen, etc. Do you have an alternative to trusting them?
- cpach 6y agoSure, PDF is a bit hairy. But you also can choose to not use Acrobat Reader. If you use e.g. Preview (macOS) or Evince (Linux) then I would wager that it’s not exactly trivial to get remote code execution. (Most probably possible though, but it would probably take some work.)
- leoh 6y agoI think all clients are a bit questionable since it's such a complex format and because most clients are not written in safe languages. Although they're rarer, even Mac OS X's Preview.app has had CVEs.
- aj3 6y agoHere's a tip: the safest way to open sketchy pdf is through PDF.js that's used in browsers as it relies on the same JS sandbox you use to browse net all day. Other than that - open documents in a VM (with reverting to the previous snapshot after viewing the file) or install Qubes where this is default behaviour.