I’m @froztbyte more or less everywhere that matters

  • 22 Posts
  • 845 Comments
Joined 3 years ago
cake
Cake day: July 2nd, 2023

help-circle



















  • I’d seen that link and didn’t even go looking, but wow this is way worse that I would’ve expected

    it’s been a while since I last looked (I usually just deploy whatever network I need) but iirc even the typical desktop config distributions of qemu-kvm are a macvtap or link+nat setup

    It then detected I run my host kernel with mitigations=off

    I wonder if this person even thought to run a nessus/openvas/whatever scan against the same machine

    also, quite seriously, what fucking clowning is this to have this be some “I slapped together a test on my desktop” rather than having a lab bench? is it too hard and costly for trail of bits employees to afford a 1u they can pxeboot for experiments? wild

    The standard approach for QEMU is to either wire up a TUN/TAP interface or to use passt.

    (e: adding)

    The standard approach for QEMU is to either wire up a TUN/TAP interface or to use passt.

    other typical modes are bridged (e.g. having various vlans available as bridges and then managing vm exposure to vlan by interface attachment), direct interface assignment (hw offload to the guest)

    passt is also commonly used for podman, and it’s moooostly userspace[0] IP and no real good l2 options

    1. I had an absolute rager[2] of a time figuring out how to make n-many podman containers[3] spin up into an assortment of vlans for realtime multi-vlan testing
    2. of the graaaargh kind
    3. don’t do containers, kids. they’re bad for your health

    (I’m only half joking. it’s stunning how badly container-management software and tooling all suck)