Hacker News Reader

Comment by Polylactic_acid | Hacker News Reader

I'm on several private torrent sites and I still wont run software out of a VM. The problem is the users are trusted but unless they packaged the crack themselves they don't even know if there is malware bundled in. Its easy to verify that audio or a book is high quality but verifying software is next to impossible.

View on HN

Software on private torrent sites comes straight from the scene, who treat their hobby pretty seriously.

Exactly. Scene groups are tight knit and very professional.

Unless you piss them off and become their target

If it's not a 0day tracker they usually unpack the scene files and repackage them so you don't have the split archive files. It wouldn't be hard to slip something in in this process.

One of the things I miss in Windows 10 I don't have on Ubuntu is 'Windows Sandbox'. It's great for testing software out. It loads pretty much instantly.

Look into Firejail.

https://firejail.wordpress.com/

Thanks!

If you are going that route you are better of with LXC or Docker. IIRC LXC is part of the 20.04 install.

Or use Vagrant if you want better security.

There are so many ways to escape Firejail, that no one should seriously rely (solely) on it for security. Please, just use proper virtualization for trying shady software/suspected malware.

Is there such software for macOS?

I don’t think anyone has packaged this up, although the tools are there.

Sure: https://www.virtualbox.org/wiki/Downloads

This is 100%. I'm not sure, however, that I even trust PDFs these days. Somewhat paranoid there are zero days on libgen, etc.

> Somewhat paranoid there are zero days on libgen, etc.

Do you have an alternative to trusting them?

Sure, PDF is a bit hairy. But you also can choose to not use Acrobat Reader. If you use e.g. Preview (macOS) or Evince (Linux) then I would wager that it’s not exactly trivial to get remote code execution. (Most probably possible though, but it would probably take some work.)

I think all clients are a bit questionable since it's such a complex format and because most clients are not written in safe languages. Although they're rarer, even Mac OS X's Preview.app has had CVEs.

Here's a tip: the safest way to open sketchy pdf is through PDF.js that's used in browsers as it relies on the same JS sandbox you use to browse net all day. Other than that - open documents in a VM (with reverting to the previous snapshot after viewing the file) or install Qubes where this is default behaviour.

Reply on news.ycombinator.com