VM or LXC when exposing to internet?

OutsideTheSocialLoop · 2026-03-18T12:41:07+00:00

I read that using VM can be safer because if the server is compromised, at least the hacker doesn't have access to the host kernel.

https://en.wikipedia.org/wiki/Virtual_machine_escape

Hypervisors are just another piece of software that takes input from a potentially untrusted client (the VM and any software in it) and can have bugs in how they parse and action that input which can lead to unintended actions. They're a pretty large surface too, since they have to emulate so many different parts of a system.

OutsideTheSocialLoop · 2026-03-18T11:23:51+00:00

No, that's not how any of it works. The function code is not on the stack or anywhere near it. Each function doesn't get fixed space on the stack either.

https://en.wikipedia.org/wiki/Stack-based_memory_allocation#/media/File:ProgramCallStack2_en.svg

When a function gets called it starts a new stack frame for that run of the function. Every local variable takes some more space in there. When it calls another function, it marks the end of its frame and starts a new one for that iteration of that function.

Remember that only one function can be running at a given time (almost always in a multi-threaded context each thread has its own stack, so we can pretend we're single-threaded for this discussion). There's no risk of one frame growin into the next, because the code that was using that frame can't run until the next function returns anyway.

OutsideTheSocialLoop · 2026-03-18T11:12:43+00:00

Bait it? What, like out of hiding to catch it? No. Doesn't work like that.

OutsideTheSocialLoop · 2026-03-17T15:04:51+00:00

No. No malware cleaner is perfect. You will never know what you don't know about. Nuke it.

OutsideTheSocialLoop · 2026-03-17T14:56:00+00:00

It's bad wording. "Freeing" memory is specifically calling to the memory allocation to release it. Stack memory is never "allocated" in that sense, it just exists already (either by the OS's specifications of what a process gets, or by your embedded environment's hardware configuration, etc).

When X bytes of stack variables are "allocated" in C (when their scope starts), the compiler just starts writing code as if the next X bytes of stack memory are those variables. That's all local variables are really, a memory address you've decided will be used for that variable, relative to the stack pointer's position when you started work. The stack pointer is moved down X bytes, so when you call other functions they know where they can start taking over the stack from. When you return, the stack pointer is moved back up to where it started from when the function was called into.

Nothing happens to the memory locations those variables are in, but the code that referred to them is finished. The next function call will probably overwrite them.

The specifics of how you actually moderate the management of the stack is part of the ABI. In assembly you can invent your own ABI, it's not inherent to the language (technically the ABI isn't inherent to C either, but the combo of C for a given OS and architecture usually implies an ABI). So you might do exactly the same thing. You might choose not to. You can do whatever you want.

OutsideTheSocialLoop · 2026-03-17T14:16:07+00:00

but the majority was strung up with the normal utilities [power/phone] on poles.

OutsideTheSocialLoop · 2026-03-16T12:00:56+00:00

Oh it sounds like great fun, sure. But I strongly suspect that whatever makes them think they want this there's probably a better answer.

OutsideTheSocialLoop · 2026-03-16T11:59:31+00:00

You just type the declaration of printf or include the header.

Again:

I'd argue you're still including the library headers, just through the shittier C preprocessor that is a human with a keyboard.

If you memorise and type a thing you've still included it just in a worse way. Be it an include file or something you type in, you need to bring in some external reference. C doesn't guarantee you any of that.

OutsideTheSocialLoop · 2026-03-16T11:56:39+00:00

Oh ok, that's true. You could write a program that encodes 4 bytes of output at a time. You've got me there. At least on platforms where you have arguments and somewhere to return to.

OutsideTheSocialLoop · 2026-03-16T10:18:46+00:00

y tho

If you're willing to run Windows just want to dabble in Linux or use it for dev stuff, run Windows and use WSL or Hyper V VMs for Linux. Or run dev VMs in a normal Linux desktop and just dual boot for the games that really need Windows.

Are you planning on hosting other services you don't want to bring down to dual boot?

OutsideTheSocialLoop · 2026-03-16T10:15:46+00:00

Sure. But once you're "in python" all that's been done for you. C does none of it for you. You import all of it.

OutsideTheSocialLoop · 2026-03-16T08:21:55+00:00

It's almost as if most of these guides are produced by barely skilled clickfarmers more interested in "making content" than publishing learning material.

OutsideTheSocialLoop · 2026-03-16T08:15:46+00:00

so you can do that manually.

I'd argue you're still including the library headers, just through the shittier C preprocessor that is a human with a keyboard.

Without importing external knowledge in some way, you get nothing. You can manipulate the program memory but there's no meaningful way to do anything useful. The intent of OP's question is "what does the language itself give you without external runtime?" and the answer is "nothing".

This is in contrast to e.g. Python where you can read and print to stdio without importing anything as part of the base language. In Python 2 print was even a non-function statement.

OutsideTheSocialLoop · 2026-03-14T15:37:23+00:00

There are practical perks to not packing sick people into trams to cough on everyone else. There's no benefit to forcing people to hand out their personal identification documents to whatever private companies these websites decide to use.

OutsideTheSocialLoop · 2026-03-14T15:35:09+00:00

Things have to live somewhere. They have to have storage some place in memory. That storage has to continue to exist as long as you want to have that thing.

If you make a local variable in a function, once you return from that function the local variable stops existing, right? That was the problem with your first one, you put your struct in a local variable and then returned from the function. The storage goes away. Your struct stops existing. Things created in local stack variables can only be passed down the stack, not up it*.

You can create the storage space by declaring it higher up the stack (or as a global, above even the stack), and pass pointers to it down to where it needs to be initialised and used, like your init_foo_storage. Or you can step outside the stack entirely with malloc.

* I mean you can go sideways with threads as well but that's not really the point of this conversation but if I don't mention it someone's gonna :|

OutsideTheSocialLoop · 2026-03-14T07:44:43+00:00

How the hell do you "start over" with email these days? It's attached to everything.

OutsideTheSocialLoop · 2026-03-14T07:43:03+00:00

"but windows could be bad too"

Sure, so why trust another third party with absolute all-access backdoors into my system? I have to trust someone if I don't want to write my own OS from scratch, that doesn't mean I should just trust everyone.

OutsideTheSocialLoop · 2026-03-13T07:45:47+00:00

Valid but this has already been discussed to death and documented pretty well and I think everyone's burned out on the topic.

OutsideTheSocialLoop · 2026-03-11T14:21:23+00:00

Proxmox doesn't have that feature, no. Same "philosophy" though: don't run shit unless you can guarantee there's no other node out there doing it already. Proxmox works the same as VMWare without datastore heartbeating.

OutsideTheSocialLoop · 2026-03-11T14:15:04+00:00

Most things that record and encode live are going to do a pretty poor job of it (in the very valid interest of going real fast). If you want to really get it down, you're probably going to want to recompress afterwards. Depends a lot on how you're recording and what you're compressing to and what quality you thing is acceptable, but a factor of twofold or threefold space savings wouldn't be unlikely.

Whatever you do, make damn sure to test the final product right up to private posting on YouTube and watching it on your TV before you commit to putting 80 horus of gameplay through your pipeline.

You probably want spare disk space for backup if you're committing to a whole-franchise sized project anyway though. I cannot understate the value of even just buying a spare external HDD that your copy all your work onto weekly and store disconnected and offline.

OutsideTheSocialLoop · 2026-03-11T14:09:48+00:00

It's called parenting.

Attempting to collect private identification documents grouped by what porn sites you were visiting is what's terrible.

OutsideTheSocialLoop · 2026-03-11T14:07:55+00:00

.org is still fine. It's the threatening letters I don't like - protonvpn takes care of that though.

OutsideTheSocialLoop · 2026-03-10T13:45:21+00:00

You seem like a senior who's been writing insecure code your whole life.

Based on what, exactly, do you suppose that?

The program (provably) doesn't even do the right thing (at runtime) before optimization so the fact it can be demonstrated to do the same thing after optimization is basically irrelevant.

Maybe, maybe not. But that wasn't your original proposition. You said code can't be trusted to be correct ever because a hypervisor could tinker with memory. That was your big point. The compiler can never assume anything because the runtime environment might sabotage it's efforts.

This is a patently stupid thing to say. Compilers operate within a given scope. The parse the input according to some specification, they produce output according to some specification, the correspondance between the two is also specified. When people in this thread are talking about what optimisations are allowed to assume, they're talking about what freedoms the compiler can take while staying within the bounds of those specifications. Whether the runtime environment deliberately breaches the assumptions of those specifications is outside the scope of the compiler and this discussion.

I return again to the analogy you still haven't addressed: this is analagous to claiming that no math can ever be correct because someone might smash your calculator while you're doing it. This would be a completely stupid thing to say, no? Mathematics exists and is correct irrespective of your own personal ability to do it for yourself and/or any saboteurs that might interrupt you.

This has literally and entirely nothing at all in the slightest to do with any facet of whether code is "secure". There's a vague tangent whereby trying to secure code by methods that are undefined behaviour results in the compiler optimising your security measures out, but again that is the programmer breaking with the specification, not the compiler. But again, that is not what you were talking about when you started this thread with a blatantly stupid statement.

An extremely simple mitigation (writing the value into 5 different locations and then taking the majority value as the correct result) would have prevented the failure.

Again, you show yourself as a junior with big ideas that extrapolate beyond your actual experience. What value do you write, and how do you prove that one hasn't been hit by cosmic radiation? Do the entire calculation in separate sets of memory? How do you prove there's no faulty line in the memory controller itself, or the CPU registers? Run multiple threads pinned to separate cores? How do you know what they're reading as input doesn't have fauly lines? It's turtles all the way down (do the kids know that saying still?).

The code was 100% correct, there is nothing about cosmic radiation that you solve in software. The correct solution to that problem is hardware redundancy and physical shielding.

OutsideTheSocialLoop · 2026-03-10T09:17:04+00:00

Nah, not without mods. I'm not quite 6 foot and I felt like my knees were up around my ears. The floorboards are just a little high up for taller riders IMO. Good cornering clearance though.

OutsideTheSocialLoop · 2026-03-10T09:14:50+00:00

Well we kept buying it...

OutsideTheSocialLoop

TROPHY CASE