News for hackers. Stuff that matters.
Re:Announcing qboot, a minimal x86 firmware for QEMU by viraptor on Thursday May 21, 2015 @10:41PM (#9586390)
> VirtualBox is irrelevant.

Except for every single "prepackaged developer's workstation" solution I've seen so far. Seriously it works on all systems more or less the same, so I see it used all over the place.

Re:Announcing qboot, a minimal x86 firmware for QEMU by LukeShu on Thursday May 21, 2015 @11:39PM (#9586481)
I believe he is saying that VirtualBox is irrelevant as an alternative to Xen, not that it is irrelevant in general.

Xen is meant for running a potentially large number of server VMs headless. VirtualBox is meant for running desktop VMs. You could make VirtualBox run headless (exposing a pseudo-screen over VRDP) to do what Xen does, but... eww.

Re:Announcing qboot, a minimal x86 firmware for QEMU by walterbell on Friday May 22, 2015 @04:29AM (#9587111)
Xen is also used on the desktop, e.g. Qubes (Type-1) or Bromium uXen (Type-2).
Re:Announcing qboot, a minimal x86 firmware for QEMU by throwaway7767 on Friday May 22, 2015 @06:29AM (#9587442)
Is bromium out of vaporware stage yet? They make bold claims, but I've never heard of anyone actually getting a hold of their tech. I've certainly not seen any reviews by serious security professionals picking apart their offering.

Qubes is awesome though. It really does not get as much attention as it deserves.

Re:Announcing qboot, a minimal x86 firmware for QEMU by walterbell on Friday May 22, 2015 @01:27PM (#9589752)
Some companies are listed at http://www.bromium.com/customers.html. No sign of third-party reviews, sadly.
Re:Announcing qboot, a minimal x86 firmware for QEMU by navlelo on Friday May 22, 2015 @10:19AM (#9588412)
Why is it eww? I found it to be a very nice solution to running a legacy OS on new hardware. I could probably use something else, but VBox with vrdp works great!
Re:Announcing qboot, a minimal x86 firmware for QEMU by throwaway7767 on Friday May 22, 2015 @06:27AM (#9587432)
It's also incredibly insecure. One uses it to run a different OS on the same computer, not really for isolating it from the host OS/other VMs.

Just look at the kinds of vulnerabilities regularly found in it. They're mostly run-of-the-mill buffer overflows or missing range checks in emulation. Simple stuff that should have been caught if they were serious about security.

Compare that to xen or kvm, which have of course also had vulnerabilities, but you can see people usually have to get a lot more creative when attacking those.

If you wouldn't run a program on your actual machine, you probably should not run it in a VirtualBox VM either.

Re:Announcing qboot, a minimal x86 firmware for QEMU by ghshephard on Thursday May 21, 2015 @11:55PM (#9586512)
You are exactly correct - VirtualBox is a workstation solution, not a back-end server solution. That's the domain of Xen, VMware, and KVM. Xen and KVM are interesting to hosting providers and technology companies like google, everywhere else in the world it's VMware.