4 ms·
Virtual machines are treated as a security boundary despite the fact that with enough R&D they are not. Hosting minecraft servers in virtual machines is fine, b
by hsbauauvhabzb 10mo ago
Virtual machines are treated as a security boundary despite the fact that with enough R&D they are not. Hosting minecraft servers in virtual machines is fine, but not a great idea if they’re cohosted on a machine that has billions of dollars in crypto or military secrets.
Docker is pretty much the same but supposedly more flimsy.
Both have non-obvious configuration weaknesses that can lead to escapes.
- hoppp 10mo agoYeah but why would somebody co-host military secrets or billions of dollars? Its a bit of a stretch
- hsbauauvhabzb 10mo agoI think you’re missing the point, which was that high value targets adjacent to soft targets make escapes a legitimate target, but in low value scenarios vm escapes aren’t worth the R&D
- z3t4 10mo agobut if you can do it at scale it might still be worth it, like owning thousands of machines
- kevinrineer 10mo ago> Virtual machines are treated as a security boundary despite the fact that with enough R&D they are not. Hosting minecraft servers in virtual machines is fine, but not a great idea if they’re cohosted on a machine that has billions of dollars in crypto or military secrets. While I generally agree with the technical argument, I fail to see the threat model here. Is it that some external threat would have prior knowledge that an important target is in close proximity to a less hardened one? It doesn't seem viable to me for nation states to spend the expensive R&D to compromise hobbyist-adjacent services in a hope that they can discover more valuable data on the host hypervisor. Once such expensive malware is deployed, there's a huge risk that all the R&D money is spent on potentially just reconnaissance.
- hsbauauvhabzb 10mo agoYes. Docker too.