Helix 🧬

Exactly my thoughts. If the credential stealer is coded halfway competently, it doesn’t matter if the creds lay on C: or Z:

After all, WINE is trying to emulate Windows with all its quirks and features, which will also mean that it runs Windows viruses perfectly fine. Heck, I think WINE can probably run Windows viruses better than Windows itself.

The VM is definitely safer by an order of magnitude, because you can use hardware CPU features to guard address areas and have separate Kernels for your games and other OS. However, look at this recent security hole: https://lemmy.zip/post/67733533

Security is never absolute, it’s always relative. It’s also never done, as with time any system can become hacked. Security is both a process and a consideration.

Your threat model is that you download malware which is either written for Windows or has some nasty Linux exploits baked in (as Steam Decks are popular now aswell). I doubt if most people run games without sandboxes that they try to get out of a user namespace with a privilege escalation. Sandboxing in Linux is done with Kernel level separation, and very secure.

Hackers who want to get your data who use a 0day sandbox breaking exploit really deserve your data. If they can do this they’re basically the elite of hackers. Most stuff will be simple crypto trojans and credential stealers, focused at Windows, which are both stopped dead in their tracks by sandboxing.

Let’s say you get 99.9% safety against your specific threat model with sandboxing. If you have 1000 exploits, one might be able to break it, good luck finding 1000 exploits in pirated games even if you try to collect them. And with VMs you might have 99.99% safety but so much less performance and so much more hassle it’s not worth it.

There are lower hanging fruits to hack you at that point. In reality there might be an even lower likelyhood of Windows games breaking out of a sandbox or VM on Linux. I have never even read about something like that happening once.

Nice try Mr Hacker, you’re not getting anything out of this BOFH 🙃

I have a wiki! Covers way more diverse topics than self-hosting though. It’s mostly a copy pasted stream of consciousness and links to other resources, with varying quality. Lots of stub articles.

https://wiki.tilde.fun/

You shouldn’t need a full VM running Proton. I’d rather use sonething more lightweight, i.e. sandboxing.

Most likely Windows games which are malicious don’t have a way to break out of Linux containment, so if you run all games as a different user with no access to your other files or inside a sandbox, there should be a negligible risk.

The chance of a Windows malware using Linux sandbox exploits is very very very small.

Wine doesn’t sandbox things though.

You can use Gnome Boxes or virt-manager, but in the end you’ll still be fiddling with config files, as GPU pass-through is not really easy to do, or recommended in this case.

It’s only worth the hassle if you need Windows to play some games, and even then will Kernel-level anticheat still ban you in online games.

It’s much less hassle to use Firejail (or similar). That one just needs a few lines of config and already has predefined configs for Steam etc., however you might need to tweak them a bit if you store games and savegames somewhere else than your homedir.

Using Ansible, but it still means I need to run it and schedule patches etc. – you can’t just patch stuff when people are currently working on it.

You can use configuration management software like Ansible or Puppet. I wouldn’t write my own scripts when there are good Ansible modules.

You quoted something directly contradicting what you said. Nothing is concealed, every line of erroneous code could have been analysed for 15 years. All information needed to find the bug was public since it the code has been written and checked in publicly.

You confused “obscurity” as in a synonym for low popularity with the word “obscurity” as in people not knowing how it works and people deliberately hiding the inner workings of a system.

Everyone using Linux can know how it works, that’s the opposite of obscurity in the sense it is used within “security by obscurity”.

Apart from that, Linux is very popular, just not on the Desktop. It is therefore not obscure in the sense of popularity either, at least the components which are hit by the bug mentioned in the article.

ugh shit next week will be awful at work patching all those servers. At least they found it before bad actors did.

Wieso nimmst du das an? Wieso hast du deinen Beitrag gelöscht? Was stand da? Hattest du dich blamiert?

Sagt dir Whataboutismus was?

Arch Linux it is, then 😋

the VM would be linux using proton

Proton is not a VM, it’s a translation layer for Windows API calls based on WINE.

Virtualisation (VMs), sandboxing and API translation layers are fundamentally different in both scope and application.

Proton does not give you any additional security, since Security By Obscurity is a broken concept.

I have heard that malware designed for windows can still run under linux due to the way wine / proton works.

This is correct.

Linux isn’t inherently safer than Windows when running untrusted binaries, i.e. games.

There is a real possibility of user data being extracted or a virus infecting a WINE prefix. If you get a crypto trojan it doesn’t matter if you’re cool and on Linux, they still can encrypt all your precious family photos.

Please do not hand out potentially dangerous advice like “you should be safe”. Sure, the architecture of Linux distributions make it harder for criminals to do things, but you’re certainly not safe running untrusted binaries, even though Steam does some security analysis before games can be uploaded, and malware games are usually reported quickly.

Regarding using a VM with a GPU passthrough, what software would you recommend for doing this with?

KVM Passthrough, e.g. with https://looking-glass.io/

However, it’s way too much hassle. Just run Steam in a sandbox, e.g. Firejail.

tldr: use firejail. I already answered in your other thread: https://feddit.org/comment/13927222

You know you can cross-post so it shows up as cross-posted in other communities? You just need to hit that “copy” button once you posted the first one.

I’d have answered here instead of !piracy if I had seen that it’s a crosspost.

What are you looking for in that article?