Hacker News

Favorites Setup
Comment by sdcfgy | original | Arbitrary code execution in QubesOS via copy-to-VM error reporting backchannel
[−]sdcfgy · 2026-08-30 Sun 11:30 UTC · link
Reminds me of Theo DeRaadt again: https://marc.info/?l=openbsd-misc&m=119318909016582
[−]throwa356262 · 2026-08-30 Sun 11:41 UTC · link
Theo is a very insightful guy, but also very opinionated. I think the truth is somewhere in between.

Especially as more and more virtualization functions move into hardware, not using them as a second security barrier seems foolish.

[−]12995816 · 2026-08-30 Sun 11:42 UTC · link
Peak Theo! This refreshing truth telling has been eradicated in 2026.
[−]Topfi · 2026-08-30 Sun 12:29 UTC · link
It has? News to me. Go on any major thread on this page, you’ll witness similarly strong pushback visa-vi buying into corporate backed hype, akin to the overconfidence in virt security he pointed at back then.
[−]nython · 2026-08-30 Sun 13:08 UTC · link
Vi doesn't require a visa but the trip is one way only. (Vis-a-vis)
[−]Topfi · 2026-08-30 Sun 14:59 UTC · link
You know, given my French grades, I really should stop using such phrases…
[−]XMPPwocky · 2026-08-30 Sun 11:44 UTC · link
Looks like this has nothing to do with the hypervisor, it's not a traditional VM escape
[−]fallat · 2026-08-30 Sun 11:45 UTC · link
Brutal

I hope when people read this though they understand this is a communication style; they're clearly trying to strongly discourage people from thinking they are suddenly protected. Effective? Maybe at one time, where "macho dev energy" was a thing. Today, not so much. You can tell they mean well because the intro sentence is actually pretty cheeky!

[−]zvmaz · 2026-08-30 Sun 12:05 UTC · link
All I see is rudeness, insults, and arrogance sparkled with inklings of technical arguments. Worthless.
[−]iugtmkbdfil834 · 2026-08-30 Sun 12:34 UTC · link
But, and this is the important part, is he wrong?
[−]zvmaz · 2026-08-30 Sun 12:48 UTC · link
I don't really know as the argument is mainly about how stupid people are... The technical argument is one paragraph ended with an insult, not much to make an educated and civilized opinion.
[−]eli · 2026-08-30 Sun 12:51 UTC · link
What if that isn’t the most important part
[−]matherial · 2026-08-30 Sun 13:25 UTC · link
Being right is not the most important part. If you're right but don't convince anyone, you've made no difference.

Theo was right that virtualization is a comparatively shoddy security boundary. At the same time, it's flexible and capable in ways that now define the shape of modern IT.

Could we have replicated that by other means? If yes, then it's on Theo and other knee-jerk critics that they never proposed a better approach and settled for insulting people. If not, then maybe virtualization was a necessary evil. Or maybe everyone else is an irredeemable idiot, but again - if we reach that conclusion, is the world better off?

[−]sdcfgy · 2026-08-30 Sun 13:35 UTC · link
Maybe if we didn't virtualize everything at machine level we'd have portable software that runs on the original virtualization method: processes.

Stares at Go as about the only step in that direction...

[−]systemf_omega · 2026-08-30 Sun 14:32 UTC · link
LLM slop account. Admittedly this one was harder to spot.
[−]tucnak · 2026-08-30 Sun 16:11 UTC · link
Oh shit, you're right!
[−]matherial · 2026-08-30 Sun 16:31 UTC · link
You're chasing ghosts, son.
[−]Betelbuddy · 2026-08-30 Sun 13:46 UTC · link
This community lives on not understanding that...form over function always...
[−]zvmaz · 2026-08-30 Sun 14:21 UTC · link
Can I insult you and then complain that you focus too much on form?
[−]Betelbuddy · 2026-08-30 Sun 14:40 UTC · link
Only If I deserved it :-)
[−]edelbitter · 2026-08-30 Sun 12:08 UTC · link
This is less of a virt/x86 bug and more of a "don't call system() on arbitrary user input" bug.

.. incidentally, OpenBSD also provides one of the clearest examples of how the excuse "calling system() is fine in my case, its totally not arbitrary user input" is deluded just the same, see CVE-2020-8794.

[−]pornel · 2026-08-30 Sun 12:09 UTC · link
The bug here is not related to virtualization, but a footgun as old as C stdlib: system() that doesn't take arguments separately, and instead relies on shell escaping by the application.
[−]1718627440 · 2026-08-30 Sun 13:54 UTC · link
The only point of system(3) is to invoke the OS shell, if you do not want that use exec(3).
[−]Topfi · 2026-08-30 Sun 12:10 UTC · link
I feel that, in fairness, one should at least read Adam’s response, though ideally all subsequent mails: https://marc.info/?l=openbsd-misc&m=119320496730314&w=2

Theos is a very opinionated and not necessarily wrong position, but I feel also a bit too reductive given we are eternally having to deal with compromises of some form. Also, lest we forget, it has been two decades in the interim and oh so much has changed. In any case, this originated from their code, not virtualization, so it doesn’t really apply either way…

[−]chmod775 · 2026-08-30 Sun 13:00 UTC · link
That's an impressive amount of maturity and composure Adam demonstrates there after receiving a response like that.
[−]sdcfgy · 2026-08-30 Sun 13:33 UTC · link
I think it's pretty much spot on myself and applies to more than virtualization based on the last point. It really suggests that further complexity and abstraction is not a good security posture. And I agree with this from extensive experience (embedded, defence).

Regarding the two decades since and the numerous exploitable x86-64 and hypervisor bugs suggests he wasn't wrong and that the tone was appropriate for the severity of the problem.

[−]Betelbuddy · 2026-08-30 Sun 13:45 UTC · link
In all fairness also read this: https://taviso.decsystem.org/virtsec.pdf
[−]koverstreet · 2026-08-30 Sun 15:52 UTC · link
Yeah, I'm with Theo on this one. Conventional OS security between Ring-0 and everything else is well understood; the problem has become too much code in Ring-0, a great fraction of which has its own interfaces across the security boundary, and the Unix security model just doesn't scale.

No capabilities, or even a sane and useful way of adding capabilities with everything in ring 0, and the flat integer namespacing of users and groups just doesn't work for what userspace needs to do today - hence namespaces, which have introduced their own problems, because (no surprise) trying to graft a tree structure onto a flat integer namespace after the fact is a mess.

Virtualization tried to sidestep all that, but to make it fast the cost has been more driver interfaces to host ring-0 - remember what the original was? - and screwing around a whole bunch with particularly arcane facets of the core ring-0 security boundary, e.g. page tables.

It is a mess.