stefanha

11 ms·

91.
by stefanha 10y ago
I don't work for Google but have seen KVM Forum presentations and mailing list discussions where they contributed back to KVM. They have world-class security researchers working on keeping KVM secure. Your comment implies they rely on
92.
Git: Internals of how objects are stored(blog.vmsplice.net)
4 points by stefanha 10y ago|0 comments
93.
by stefanha 11y ago
Never had performance issues with the Docker device-mapper graph driver on Fedora 23. No tweaking was necessary. I imagine CentOS is similar although it may not use the latest and greatest features. There is not enough information in this
94.
by stefanha 11y ago
I agree, this isn't particular new or inspired. It's similar to existing mechanisms which the author pointed out. Seccomp is really hard to integrate into existing programs, especially if they are monolithic and don't have p
95.
by stefanha 11y ago
Most of these settings are available to systemd unit files. Is there anything unique here that isn't available?
96.
by stefanha 11y ago
Careful using relative paths in PYTHONPATH. If you share a file system with untrusted users (like /tmp or an NFS mount) or extract an untrusted archive (zip, tar, rar) then you might inadvertently execute python code that another user
97.
by stefanha 11y ago
Keep in mind that the pcnet NIC is not used by default in most QEMU, KVM, or Xen deployments. So it's mostly a problem in scenarios where untrusted users may add pcnet NICs to their VMs. Even then, remember that additional layers of s
98.
by stefanha 11y ago
> it doesn't really support the light IO solutions (like novm's file, rather than block access) That is incorrect. novm just implements the virtio-9p device that QEMU has supported for years. Clear Linux does add something new
99.
by stefanha 12y ago
This comment should be at the top. False alarm, squid users, and now back to our regularly scheduled HTTP proxying. For more details on why this issue doesn't affect squid users: https://rwmj.wordpress.com/2015/03
100.
by stefanha 12y ago
> 9p works from OSes other than Linux; there's a driver for Windows as well. Do you have a link to the Windows virtio 9p driver? I'm not aware of such a thing existing.
101.
by stefanha 12y ago
http://qemu-advent-calendar.org/feed.rss (Still populating the feed but you can already subscribe.)
102.
by stefanha 12y ago
Thanks, I've taken note of the link!
103.
by stefanha 12y ago
There hasn't been much conversation on the #qemu irc.oftc.net channel about the advent calendar, but that's the channel. For the most part I send out an email to the QEMU mailing list before December and folks have been emailing m
104.
by stefanha 12y ago
An early Debian image would be very cool. The Slackware 1.01 download is actually still available at http://mirrors.slackware.com/slackware/slackware-1.01/ . Gerd, who put together the image, had to find the right
105.
by stefanha 12y ago
Thanks!
106.
by stefanha 12y ago
Hi, I run the QEMU Advent Calendar and hope you enjoy the images that the QEMU community has put together for your holiday season enjoyment. We still have a few slots free so if you have a cool disk image to contribute, get in touch! stefa
107.
by stefanha 12y ago
Flow control != control flow https://en.wikipedia.org/wiki/Flow_control_(data) https://en.wikipedia.org/wiki/Control_flow I expected a "please stop sending until I am ready to receive again&q
108.
by stefanha 12y ago
Why does the Android app need access to my photos, camera, and mic?
109.
by stefanha 12y ago
Careful, disk encryption usually doesn't cover the entire disk. So an attacker can place an evil initramfs in the /boot partition that stores away your disk encryption passphrase, for example. This is even easier if the operating
110.
by stefanha 13y ago
The presentation makes a good point that containers aren't universally "insecure". For certain use cases they are absolutely fine because the trust boundary between containers or the kernel isn't critical: * Deployment
111.
by stefanha 13y ago
This benchmark is bogus because the iozone -I flag is missing. -I uses O_DIRECT to avoid the page cache. Due to page cache usage it's hard to say what this benchmark is comparing. The I/O pattern seen by the actual disk, shared
112.
by stefanha 13y ago
I believe the Android emulator is now quite different from mainline QEMU. No efforts have been made to merge patches back into QEMU, so the Android emulator is basically a fork of QEMU. That said, ARM development in QEMU is very active rig
113.
by stefanha 13y ago
Try again with QEMU 1.7 and recent gcc. There has been a known gcc issue triggered by one of the QEMU source files that requires a lot of memory. A workaround went into QEMU a while back using the gcc -fno-gcse flag for that particular so
114.
by stefanha 13y ago
There are a lot of guides online if you search for how to set up KVM (which uses QEMU). Linux distros also provide documentation specific to their distro: https://access.redhat.com/site/documentation/en-US/Re
115.
by stefanha 14y ago
Looks useful for development. Does live editing also work with Xcode?