News for hackers. Stuff that matters.

A comment on Compromised PyTorch-nightly dependency chain December 30th, 2022. Parent comment

Re:Compromised PyTorch-nightly dependency chain December 30t... by rogers18445 on Sunday January 01, 2023 @12:12AM (#34203809)
This is the way things should be done by any competent developer.

Generally a VM jail is preferable - firecracker or cloud-hypervisor(virtiofs & gpu passthrough) recommended.

A proper namespace jail (eg. bwrap) is sufficient for 99.9% of cases. To break out of a properly configured namespace jail you would need to sacrifice a 0day.

[ Parent | on HN ]
Re:Compromised PyTorch-nightly dependency chain December 30t... by codedokode on Sunday January 01, 2023 @12:52AM (#34203997)
It looks like totally overengineered solution to me. The CPU already has a protected mode which doesn't allow the program to access any files directly. Why do you need to run a VM which by the way is run from the kernel (privileged mode) in Linux? Why cannot you run untrusted programs in protected mode?
[ Parent | on HN ]
Re:Compromised PyTorch-nightly dependency chain December 30t... by rogers18445 on Sunday January 01, 2023 @10:47PM (#34214050)
With containers the entire surface area of the kernel is available to attack (syscalls). With a VM the surface is restricted to the VMM and KVM.

This is an oversimplification, there may be other protocols that are passed through or utilized, they would add to the surface.

[ Parent | on HN ]