Hacker News Reader

Comment by onion2k | Hacker News Reader

You aren't concerned with 'hidden' code - you're concerned about this now because you know it's there. Because it isn't hidden.

If you're worried about code doing things you don't know about then there's a heck of a lot more to VMWare that you could be concerned with. It's a huge, complex application. A few KB for a hidden game is irrelevant - you don't know what hundreds of MB of it actually does. If you're worried about things being hidden in apps then you run them in a trusted environment on tested hardware after you're audited the code (and removed the easter egg).

The only reason this should worry anyone is because VMWare potentially lost sales to organisations who do need to run audited code. I imagine they would have been supplied a version without the Easter Egg though.

View on HN

Yes. It's a huge codebase. Why complicate it further by adding something 100% unnecessary? You cannot assume any bit of code no matter how small is irrelevant. If it's there it's potentially exploitable.

Because it's fun. As the industry matures, people seem to lose the sense of humuor - which is sad, because practical jokes and playfullness is what created said industry.

There is a time and place for humor. Important software is not one of them. When I run something on my machine I want it to do exactly what it is supposed to, nothing more and nothing less.

You won't be laughing if $RANDOM_EASTER_EGG has a bug that allows for remote code execution.

> There is a time and place for humor. Important software is not one of them.

Thing is, everyone seems to think the place and time is everywhere but not here and now. Companies today tend to have inflated sense of importance and gloominess stemming from what I believe is a mistaken understanding of professionalism.

> You won't be laughing if $RANDOM_EASTER_EGG has a bug that allows for remote code execution.

Hell yes I'll be laughing, I always laugh from remote code execution bugs ;). Anyway, you can argue that for any piece of code. Sure, an easter egg increases the surface of attack... by 0.1% or something.

Exactly. Anyone who objects to easter eggs because they may accidentally introduce vulnerabilities should be objecting much more strongly to features of the application that they don't need. If you want to know every aspect of a program, then you need to own the code and be brutal about stripping out features that you aren't currently using.

> When I run something on my machine I want it to do exactly what it is supposed to, nothing more and nothing less.

So you're running on seL4 right now? How's that going? Did you program the userspace yourself?

I'm impressed.

Strongly disagree; appropriate humour in "professional" software is just fine:

  $ man tunefs
  System Administration Commands                         tunefs(1M)

  NAME
       tunefs - tune an existing UFS file system
  ...
  NOTES
       You can tune a file-system, but you can't tune a fish.

You must be a real blast at company party's - lighten up a sense of humour is a requirement in this industry.

If people you don't trust can boot your VM from arbitrary floppy images, I have bad news: you have already been exploited.

I'm pretty sure the bulk of the code is in a disk image, and that binary is embedded instead of loaded from disk... the source for the image likely isn't in the same as an integrated egg generally speaking. They likely added one embed statement and a hotkey listener...

Reply on news.ycombinator.com