6 ms·

I no longer use Windows on any of my PCs. I have currently two instances that run as VMs. One dedicated solely for remote connection to my work. The company in

I no longer use Windows on any of my PCs. I have currently two instances that run as VMs. One dedicated solely for remote connection to my work. The company insists on software to scan that my PC is "secure", so I give them a finger with an almost virgin Windows install. Their crap can work only on Windows, so I don't actually have any choice. Another is for any application that I use that I absolutely can't find replacement for on Linux. I also have separate Linux VMs for suspect software like Zoom that I have to use but I don't trust to run on my machine or try to take over my desktop.

vijaybritto 6y ago
Do you run all of these VMs on linux?
- lmilcin 6y ago
  Yes. I also have a bunch of other VMs. For example, I keep my toolchains for embedded development in separate VMs so that I can trust they still work years later when I need to do some quick correction to some project of mine. These have auto updates turned off. I hate when I want to quickly change something and program the device but first I have to investigate why the tool chain no longer works. Not all of these VMs are active at the same time. I usually have 2 or 3 VMs active, some paused and most turned off.
  - kstenerud 6y ago
    I do similar things. Everything I run is built on top of LXD or KVM so that it remains compatible across time and is not beholden to anything but the Linux kernel, with disk images backed up at key points of the installation process. All of the build scripts are housed at [1] and then I have a set of machine-specific scripts that leverage those to rebuild any of my virtual systems in a single command with no data loss. Press a button, walk away, and in half an hour I have a pristine system with everything I need installed and my data drive mounted. Any time I'm working on a machine that was set up non-deterministically, I feel vulnerable... [1] https://github.com/kstenerud/virtual-builders https://github.com/kstenerud/virtual-builders
    - zentiggr 6y ago
      This brings to mind, fondly, my gentoo days. Just never had time to continue to spend that much time controlling the config vs using it.
  - codpiece 6y ago
    This is a great idea, thank you!
  - deleted 6y ago
    [deleted]
- thejosh 6y ago
  I recently started playing around with libvirt/QEMU on Linux and was amazed how well the VMs work, especially when you have two video cards plugged in and can do PCI passthrough. It's so seamless. I now run my Windows "VM" on that, and works fantastically. I have it installed to a separate SSD as well (I was curious if it would work) and performance is excellent.
  - vijaybritto 6y ago
    Yeah I was watching a video[1] about QEMU vs virtual box comparison yesterday on youtube and the guy doing it found that the QEMU version was faster than his host machine in some cases. It was confusing! [1] https://www.youtube.com/watch?v=hOKQfeUNTCE https://www.youtube.com/watch?v=hOKQfeUNTCE
mstipetic 6y ago
I don't know what's the solution. I'm trying to get back to linux but then my suspend doesn't work, touchpad feels sluggish and my battery lasts 2 hours instead of 7+. Not to mention things like https://news.ycombinator.com/item?id=25843874 https://news.ycombinator.com/item?id=25843874
- lmilcin 6y ago
  There are tools to debug power issues on Linux laptops. I use these from time to time especially when I am going to be sailing for couple of days. I can use my t440s (7yo) for over 24 hours on three batteries, internal 3 cell, and external 3 cell and 9 cell. I use it for light development, reading PDFs, some web, etc. There are also laptops that are more Linux friendly than others. It is best to buy laptop specifically for Linux use and do research before the purchase.
  - mstipetic 6y ago
    Maybe I'm being an asshole and should "submit a patch" but I really get annoyed when basic things don't work. I'm happy to debug custom software, but I don't understand how things like battery management isn't solved. I've used it on many laptops including a fully specced Dell XPS 13 (which burned out after a small spill on the keyboard)
    - lmilcin 6y ago
      Mine was once drenched completely in hot sweet latte and once submerged in mineral water (don't ask how...) It still works with no issues even though both times I had to disassemble completely and wash all parts including motherboard. The mineral water got between lcd leaves so I had to separate, wash and dry individual layers of LCD. My tip is to always have IPA, distilled water and tools to disassemble and clean your laptop.
      - oAlbe 6y ago
        How do you wash electronic components without causing damage?
RamRodification 6y ago
> The company insists on software to scan that my PC is "secure", so I give them a finger with an almost virgin Windows install. Their crap can work only on Windows, so I don't actually have any choice. Maybe this software actually is crap and you know this for a fact. Maybe whoever is in charge doesn't know what they're doing. If so maybe ignore this comment. With that said though, the principle to only allow "secure" systems for remote access sounds absolutely reasonable. Having been on the other side of this situation, I have to say users like you are a real pain to deal with sometimes. There are always a few who "know their stuff thank-you-very-much", and feel that they need to "give the finger" to whatever measures are taken to secure things. Try to see it from the IT-sec guy's perspective. Maybe some "crap" endpoint security software on the PCs isn't the end of the world if it helps keep things secure?
- mr_gibbins 6y ago
  I have two laptops, a work laptop and a personal laptop. The work laptop is supplied by my employer and as far as I'm concerned they can install whatever they damn well please on it, because the only thing I use it for, and I mean the only thing, is work - no Internet searches, no random software downloads, not even HN. A patch of tape over the camera and away we go. My personal laptop stays personal. It's mine and doesn't belong to anyone else. I never use it for work, even if alongside me during working hours. Zero crapware, minimal AV. I have the same approach to phones. There's my phone, and my work phone. I was pressured to put Outlook, Teams on my personal phone since my work phone is switched off out of hours - I nearly succumbed, until that Office Portal app wanted to 'manage my device'. Nope. Our primary on-call comms mechanism remains SMS/direct call.
  - RamRodification 6y ago
    Sounds like an excellent setup as long as you don't mind the additional hardware.
- lmilcin 6y ago
  The issue is this practice does not achieve anything and only achieves to annoy me as a person who must navigate unnecessary complexity of trying to do honest work. If employer is really interested in achieving some measure of security, there would have to be separate computer configured and locked to only allow it to be used for work. That would, I think be "reasonable". What I think is not reasonable is meddling in my own machine which I treated as my own until one day my employer said "Sorry, from now your private PC is ours to audit because we are not willing to spend equivalent of two days of your income to provide a machine for you to securely, conveniently and reasonably access our system". Nobody really cared for the fact that my all machines are running Linux, they just have assumed that I must have some kind of PC and that that PC is running either Windows or Linux. And so they configured their system so that before I can use Citrix (which works perfectly fine on Linux) their piece of crap written for Windows or Macos (no Linux version) must run and report what is installed and running on my machine for their own silly needs. No, that is not "reasonable" and for that my honest middle finger.
fsflover 6y ago
I think you might be interested in Qubes OS [0], which provides secure and user-friendly hardware virtualization for all your VMs, including Windows. [0] https://qubes-os.org https://qubes-os.org
hazmazlaz 6y ago
Honestly I would love it if more users would adopt similar practices. My only question would be how do we validate that the Windows guests remain isolated from the host. Depending on the virtualization software that is an achievable task. Imagine a world where users only ran the bare minimum software necessary for an atomically specific work task. It sounds like pure joy from my perspective.

vijaybritto 6y ago

Do you run all of these VMs on linux?

lmilcin 6y ago
Yes. I also have a bunch of other VMs. For example, I keep my toolchains for embedded development in separate VMs so that I can trust they still work years later when I need to do some quick correction to some project of mine. These have auto updates turned off. I hate when I want to quickly change something and program the device but first I have to investigate why the tool chain no longer works. Not all of these VMs are active at the same time. I usually have 2 or 3 VMs active, some paused and most turned off.
- kstenerud 6y ago
  I do similar things. Everything I run is built on top of LXD or KVM so that it remains compatible across time and is not beholden to anything but the Linux kernel, with disk images backed up at key points of the installation process. All of the build scripts are housed at [1] and then I have a set of machine-specific scripts that leverage those to rebuild any of my virtual systems in a single command with no data loss. Press a button, walk away, and in half an hour I have a pristine system with everything I need installed and my data drive mounted. Any time I'm working on a machine that was set up non-deterministically, I feel vulnerable... [1] https://github.com/kstenerud/virtual-builders https://github.com/kstenerud/virtual-builders
  - zentiggr 6y ago
    This brings to mind, fondly, my gentoo days. Just never had time to continue to spend that much time controlling the config vs using it.
- codpiece 6y ago
  This is a great idea, thank you!
- deleted 6y ago
  [deleted]
thejosh 6y ago
I recently started playing around with libvirt/QEMU on Linux and was amazed how well the VMs work, especially when you have two video cards plugged in and can do PCI passthrough. It's so seamless. I now run my Windows "VM" on that, and works fantastically. I have it installed to a separate SSD as well (I was curious if it would work) and performance is excellent.
- vijaybritto 6y ago
  Yeah I was watching a video[1] about QEMU vs virtual box comparison yesterday on youtube and the guy doing it found that the QEMU version was faster than his host machine in some cases. It was confusing! [1] https://www.youtube.com/watch?v=hOKQfeUNTCE https://www.youtube.com/watch?v=hOKQfeUNTCE

mstipetic 6y ago

I don't know what's the solution. I'm trying to get back to linux but then my suspend doesn't work, touchpad feels sluggish and my battery lasts 2 hours instead of 7+. Not to mention things like https://news.ycombinator.com/item?id=25843874 https://news.ycombinator.com/item?id=25843874

lmilcin 6y ago
There are tools to debug power issues on Linux laptops. I use these from time to time especially when I am going to be sailing for couple of days. I can use my t440s (7yo) for over 24 hours on three batteries, internal 3 cell, and external 3 cell and 9 cell. I use it for light development, reading PDFs, some web, etc. There are also laptops that are more Linux friendly than others. It is best to buy laptop specifically for Linux use and do research before the purchase.
- mstipetic 6y ago
  Maybe I'm being an asshole and should "submit a patch" but I really get annoyed when basic things don't work. I'm happy to debug custom software, but I don't understand how things like battery management isn't solved. I've used it on many laptops including a fully specced Dell XPS 13 (which burned out after a small spill on the keyboard)
  - lmilcin 6y ago
    Mine was once drenched completely in hot sweet latte and once submerged in mineral water (don't ask how...) It still works with no issues even though both times I had to disassemble completely and wash all parts including motherboard. The mineral water got between lcd leaves so I had to separate, wash and dry individual layers of LCD. My tip is to always have IPA, distilled water and tools to disassemble and clean your laptop.
    - oAlbe 6y ago
      How do you wash electronic components without causing damage?

RamRodification 6y ago

> The company insists on software to scan that my PC is "secure", so I give them a finger with an almost virgin Windows install. Their crap can work only on Windows, so I don't actually have any choice. Maybe this software actually is crap and you know this for a fact. Maybe whoever is in charge doesn't know what they're doing. If so maybe ignore this comment. With that said though, the principle to only allow "secure" systems for remote access sounds absolutely reasonable. Having been on the other side of this situation, I have to say users like you are a real pain to deal with sometimes. There are always a few who "know their stuff thank-you-very-much", and feel that they need to "give the finger" to whatever measures are taken to secure things. Try to see it from the IT-sec guy's perspective. Maybe some "crap" endpoint security software on the PCs isn't the end of the world if it helps keep things secure?

mr_gibbins 6y ago
I have two laptops, a work laptop and a personal laptop. The work laptop is supplied by my employer and as far as I'm concerned they can install whatever they damn well please on it, because the only thing I use it for, and I mean the only thing, is work - no Internet searches, no random software downloads, not even HN. A patch of tape over the camera and away we go. My personal laptop stays personal. It's mine and doesn't belong to anyone else. I never use it for work, even if alongside me during working hours. Zero crapware, minimal AV. I have the same approach to phones. There's my phone, and my work phone. I was pressured to put Outlook, Teams on my personal phone since my work phone is switched off out of hours - I nearly succumbed, until that Office Portal app wanted to 'manage my device'. Nope. Our primary on-call comms mechanism remains SMS/direct call.
- RamRodification 6y ago
  Sounds like an excellent setup as long as you don't mind the additional hardware.
lmilcin 6y ago
The issue is this practice does not achieve anything and only achieves to annoy me as a person who must navigate unnecessary complexity of trying to do honest work. If employer is really interested in achieving some measure of security, there would have to be separate computer configured and locked to only allow it to be used for work. That would, I think be "reasonable". What I think is not reasonable is meddling in my own machine which I treated as my own until one day my employer said "Sorry, from now your private PC is ours to audit because we are not willing to spend equivalent of two days of your income to provide a machine for you to securely, conveniently and reasonably access our system". Nobody really cared for the fact that my all machines are running Linux, they just have assumed that I must have some kind of PC and that that PC is running either Windows or Linux. And so they configured their system so that before I can use Citrix (which works perfectly fine on Linux) their piece of crap written for Windows or Macos (no Linux version) must run and report what is installed and running on my machine for their own silly needs. No, that is not "reasonable" and for that my honest middle finger.

fsflover 6y ago

I think you might be interested in Qubes OS [0], which provides secure and user-friendly hardware virtualization for all your VMs, including Windows. [0] https://qubes-os.org https://qubes-os.org

hazmazlaz 6y ago

Honestly I would love it if more users would adopt similar practices. My only question would be how do we validate that the Windows guests remain isolated from the host. Depending on the virtualization software that is an achievable task. Imagine a world where users only ran the bare minimum software necessary for an atomically specific work task. It sounds like pure joy from my perspective.