3 ms·

Why would you ever trust something like this that will helpfully pull images from the internet? I'm sure whomever is running it today is perfectly honest and no

Why would you ever trust something like this that will helpfully pull images from the internet? I'm sure whomever is running it today is perfectly honest and none of their computers have been compromised, but there's no reason to expect it to stay that way, is there? Firewalling the application so that only local images are available seems like the only safe way to use this.

nxobject 2y ago
If I read the the docs correctly, since source locations are printer, it’s about as trustworthy as trusting “wget $ISO_URL” on your installation to not download anything malicious. Unfortunately what seems to be missing is a hash check after the fact - a missed opportunity since images are loaded to RAM anyway. (The limitation here is that you have to be able to load the installer image into RAM, which does exclude a lot of smaller nettop/thin/SoC clients unfortunately.)
- ForOldHack 2y ago
  I may be totally missing something, but does this mean I can use a printer as a netboot? Still no morning coffee.
  - nxobject 2y ago
    Oh all the deities, I meant _print_ all the source URLs, and now it’s too late to edit. No morning coffee either ;)
    - wang_li 2y ago
      Whew! As long as it prints the url on my screen we’ll all be safe.
geek_at 2y ago
you can selfhost it. It's mainly useful to boot and play with multiple different linux distros
- kayson 2y ago
  Even if you self host it, some assets are still pulled from Github by default.
LeonM 2y ago
> Why would you ever trust something like this that will helpfully pull images from the internet? How is that different than pulling an ISO image of your favorite distro, or using a package manager like apt? Yes, I know that Linux ISOs have checksums and apt uses digital signatures, but so does iPXE. The only difference here would be that for some reason you trust the websites of your Linux distro vendor, but not netboot.xyz?
- martinflack 2y ago
  > you trust the websites of your Linux distro vendor, but not netboot.xyz Well... yeah... that's not that crazy of a position to take. Not saying there's anything wrong with netboot.xyz, but it's a question of how many cooks to let in the kitchen, and how many public eyes are on each cook.
  - deleted 2y ago
    [deleted]
- kelnos 2y ago
  > The only difference here would be that for some reason you trust the websites of your Linux distro vendor, but not netboot.xyz? "Some" reason? I think I'd have a very good reason to place much more trust in the Debian folks than some guy who runs some random netbooting website.
  - fragmede 2y ago
    just because you're one of today's lucky 10,000, that shouldn't impugne the project. It's been around since 2016. if you need verified boot, you'd not be using this in the first place.
- akira2501 2y ago
  > How is that different than pulling an ISO image of your favorite distro, or using a package manager like apt? "Some iPXE builds do not support HTTPS connections. If you get an "Operation not supported" error message, run this instead: chain --autofree http://boot.netboot.xyz http://boot.netboot.xyz" Which.. think about that advice for a minute.

nxobject 2y ago

If I read the the docs correctly, since source locations are printer, it’s about as trustworthy as trusting “wget $ISO_URL” on your installation to not download anything malicious. Unfortunately what seems to be missing is a hash check after the fact - a missed opportunity since images are loaded to RAM anyway. (The limitation here is that you have to be able to load the installer image into RAM, which does exclude a lot of smaller nettop/thin/SoC clients unfortunately.)

ForOldHack 2y ago
I may be totally missing something, but does this mean I can use a printer as a netboot? Still no morning coffee.
- nxobject 2y ago
  Oh all the deities, I meant _print_ all the source URLs, and now it’s too late to edit. No morning coffee either ;)
  - wang_li 2y ago
    Whew! As long as it prints the url on my screen we’ll all be safe.

geek_at 2y ago

you can selfhost it. It's mainly useful to boot and play with multiple different linux distros

kayson 2y ago
Even if you self host it, some assets are still pulled from Github by default.

LeonM 2y ago

> Why would you ever trust something like this that will helpfully pull images from the internet? How is that different than pulling an ISO image of your favorite distro, or using a package manager like apt? Yes, I know that Linux ISOs have checksums and apt uses digital signatures, but so does iPXE. The only difference here would be that for some reason you trust the websites of your Linux distro vendor, but not netboot.xyz?

martinflack 2y ago
> you trust the websites of your Linux distro vendor, but not netboot.xyz Well... yeah... that's not that crazy of a position to take. Not saying there's anything wrong with netboot.xyz, but it's a question of how many cooks to let in the kitchen, and how many public eyes are on each cook.
- deleted 2y ago
  [deleted]
kelnos 2y ago
> The only difference here would be that for some reason you trust the websites of your Linux distro vendor, but not netboot.xyz? "Some" reason? I think I'd have a very good reason to place much more trust in the Debian folks than some guy who runs some random netbooting website.
- fragmede 2y ago
  just because you're one of today's lucky 10,000, that shouldn't impugne the project. It's been around since 2016. if you need verified boot, you'd not be using this in the first place.
akira2501 2y ago
> How is that different than pulling an ISO image of your favorite distro, or using a package manager like apt? "Some iPXE builds do not support HTTPS connections. If you get an "Operation not supported" error message, run this instead: chain --autofree http://boot.netboot.xyz http://boot.netboot.xyz" Which.. think about that advice for a minute.