This is dedicated to all the hackers and the crackers, to the hackers and the crackers.
I see in binary, I speak source code, step on my toes, I'll post a million jpegs of you
and a fag pwned.
In your digital stance, getting firewalled ho, cause I'm riding the net in my six-fold.
I was a dick with my 56, now with my cable I'm able to get that stable.
On the out, my name is Ace and I'm a Leo. On the digital highway, my name is Neo and I'm a hero.
In a flash, I'll screw you on burning Dreamcast. You need some ISO? Let me through my hard drive rifle.
Our exchange you could never stifle. In a digital hug, you just caught the love bug.
I bootlegged your CD, I caused a fight between Un and Jay-Z.
Your CG, it's all gonna be free, whether we take it by force or we take it nicely.
You feel that rattle in your bones? When I tell you we just hacked out Jones.
And NASDAQ leaves you flat on your back, cause I am he who loves to hack and crack.
Cause I am he who loves to hack and crack.
This is dedicated to the hackers and the crickets.
Serial codes, source codes, ISOs, RANS, SIFS, SISs.
This is dedicated to the hackers and the crack.
Welcome, everyone, to Binary Revolution Radio, episode number 169.
Oh, yeah.
You are joining the man himself, Buck Dangler, back on the show after a very long hiatus.
Coming to you on October 17, 2006.
And joining me on the Prawn episode this week is one of my fellow actors in the industry,
if you will, who goes by the name of Johnny Rosebud.
Hey, that's Johnny Swank, tough guy.
I'm sorry, Johnny Swank on the show with us this week.
Johnny, how's life treating you there, buddy?
You've been gone for a while.
You've been doing some film?
You've been doing some, getting some side work or what?
Yeah, yeah, I'm a little worn out, so I'm taking a break.
You know, the doctors advised it.
Otherwise, certain parts of my anatomy would just fall off.
So, I think it's going to be good for me.
Sometimes you just got to give it a break and then go back re-energized.
Sometimes you feel like a nut, and sometimes you don't.
Well, you know, if you feel like a nut, I think the industry pay scale doubles, doesn't it?
I wouldn't know.
I'm just saying I heard things.
So, I have to ask the guys out in California about that one.
Notice how I left out any company name or people's names there.
So, yeah, we are here for episode 169, and we have an abbreviated show this week, actually.
We will still have a good full show, but actually, both Johnny Swank and I have a couple business
ventures coming up here in the future.
And, personally, I've got a little porn convention type sort of thing that I have to go to.
So, we are actually recording this on a, what is today?
Saturday.
Saturday afternoon.
So, you're listening to this on Tuesday the 17th, but this was recorded a couple days earlier
because, you know, I've got to get down to business and make that money.
You know what I'm saying?
So, let's do a little housekeeping here.
Now, Johnny Swank, I, if I remember correctly, you're good friends.
I think we have a mutual friend by the name of Knot Theory.
Have you got any news from him?
He's been working on some side things over there, bringing some things back.
Did you have any progress you wanted to report on that, or?
Absolutely nothing.
I haven't touched anything.
I haven't even used the computer machine in the past many months.
Okay.
I'm just messing around.
How do you upload your porn?
What's that?
How do you upload your porn, then?
Yeah, I have fluffers for that.
They take care of it all.
They're fluffers, and they're technically savvy.
Well, yeah.
You know, in this day and age, fluffers have to be personal assistants and do all that kind
of stuff.
And they do all their video editing on a Mac, so I don't want to touch it.
Oh, yeah.
I don't blame you on that one.
You know, I don't really care that, you know, they've been fluffing everybody and they're
touching their computer.
That's fine.
But it's the Mac, and that's the dirty part.
That's the part you don't want to touch it.
It's not all the jizz sticks.
Oh, all right.
Well, wait a minute.
The Macs have, like, those clear keyboards.
Like, don't they have some kind of coating that's, like, jizz protection that it just
all...
These things got a coating now.
I'll tell you that.
Man.
All right.
Well, let's do some housekeeping before we get too awful sick.
In case you haven't figured out, this might be a very not safe for work episode, so...
Or not safe for your cab, or wherever you happen to be.
You know, something we might have wanted to tell them that about five minutes ago.
Oh, well.
Better late than never.
That's true.
Oh.
All right.
So, what do you got?
Anything to announce?
Any progress?
Well, I've been...
I know I always say I'm chipping away at things, but we've been working on Freak Factor, of
all things.
We got a new interface planned.
Actually, the new interface is up and running.
We're doing a bunch of testing on it, and I hesitate to say it, but I'd say in the next
couple of weeks, we might be doing either a live test or an actual episode, so...
See, of all the projects, why Freak Factor?
I mean, that show sucks.
Yeah, it does suck.
But it's, you know, the only thing people ever email us about.
Right.
It's the most loved and hated show at the same time.
And actually, it is coming along.
It was looking pretty cool.
We did some testing late into last night, and it is definitely getting there.
I mean, I think we should probably clarify that, you know, we kind of still have the
same setup we had before.
And to reiterate, this was all an experimental thing from the beginning.
We didn't know what to expect.
We didn't have any big plans or anything like that for the show, other than the random
chaos that goes on.
And now, it's still going to happen, but we're adding some new interfaces.
And when I say we, I mean, of course, you.
Adding some new interfaces, some different...
Actually, I'm not even going to tell exactly what they are, because they're so cool.
People will definitely like them, but some registration so that we can get some people
more involved into it and have a little bit more control over what happens to prevent
things like toning and a little bit too much chaos at times.
So, it's a lot of interface stuff and control stuff over the show, right?
Yeah, definitely.
And one thing that, you know, kind of was a big problem with the first Carnation of Freak
Factor was the registration.
We had a separate registration where people would, like, record their name, and we would
go through there and set it up.
Nobody wanted to listen to the directions, so it got really annoying after a while.
So, now we're going to have, instead of a separate Freak Factor and Bell's Mind accounts,
just your Bell's Mind account will be your Freak Factor account.
And the registration will be back up, hopefully tonight, so that people can start registering
for Bell's Mind again.
I guess by the time you guys hear it, the registration will be up yesterday.
So, yeah.
Well, actually, it's, I don't know, one of the things I enjoyed most about the last registration
was, you know, when you'd call up and all they were supposed to do was say their name,
and you'd get five minutes of somebody saying their name, and they'd go, hello, is anyone
there?
Hello?
Oh, yeah.
My name is this?
Are you adding me right now?
I can't hear you.
Hello?
I think, actually, the best part about the registration last time was that we had people,
you know, the registration initially said, please record your name, right?
That's it.
And they would record their name, no big deal.
But then it became a problem because people would say, you know, my handle is, you know,
LitoX4 or something, and they would just babble some crazy handle, and we have no idea how
to spell it.
And then we would spell it, and they'd say, oh, you spelled it wrong.
You know, it's got seven threes in it instead of six.
Okay, fine.
So then the instructions changed to, please record your name, and, you know, record a
spelling of it, or your registration will be deleted.
Deleted.
But I would say probably 90% of people didn't record the spelling of their name, so it just
got ridiculous there for a while.
So you know what?
We take that whole thing out, people will sign up on Bell's Mind.
The first time they call, they may have to record their name or something like that,
just for fun.
But their name will show up on the show, however they type it in, and we don't have
to worry about it anymore.
Well, and speaking of Bell's Mind, Bell's Mind's back up and running.
The conferences are back alive, correct?
Yep, they are.
And, you know, things are starting to catch up, you know, back to date.
But there's some new features that actually are kind of tied into, not tied into directly
to Free Factor, but once you guys see the interface to Free Factor, you'll get a taste
of the new stuff that's coming from Bell's Mind.
And I'm pretty sure most of it, nobody out there is doing, or at least not in the same
way.
So it's kind of exciting, and I'm pretty amped about it.
But in the next couple of weeks, we'll see something.
I spent probably eight hours working on it alone just yesterday.
So there's a lot of work going into it.
And thankfully, I finished, you know, the biggest project, the biggest opal project I've
ever done for, you know, for work just about three or four days ago.
So I'm starting to see my time free up a little bit, unbelievably.
Wow.
So this was your first gig as an actual porn director then?
That's what was signing you up?
Oh, yeah, yeah.
And, you know, managing transgender midgets, you would think it'd be very easy because,
you know, they're so tiny and easy to toss around.
But they're real tough cookies, you know, they make a lot of demands.
Little people.
Yeah, sorry.
You know, sometimes they like to be called midgets, you know, it's a role-playing thing.
Oh, I see.
It's hot, actually.
Right, actually.
And in character.
I gotcha.
And for them, you know, they could be a midget or they could be a dwarf.
You call a dwarf a midget, and all of a sudden it takes not a whole new meaning.
Definitely role-playing.
All right.
Wow.
Do they dress up like the seven dwarves?
Was there a theme to the whole thing?
Or are they like Tolkien, like Lord of the Rings-type dwarves, or both?
Or are they like the Keebler elves?
You know, we do all those things.
We tie them together.
Dude, this massive orgy with Keebler elves and Tolkien elves.
Oh, man.
All right.
Well, I guess let's move on with the email portion of the show, or should I say the lack
of an email portion of the show, because we did not get any email this week, actually.
Now, of course, we're recording a day or two before we normally do, so that explains some
of it, but we got a couple emails, none of them that were really anything to read on
the air.
I think we got an email about the, what was it, the Bell South and AT&T, was it?
Something like that, yeah.
So, you know, there's not really much to say about that, except that it's happening.
So, there is one thing I wanted to kind of bring up in regards to email, though.
We got another, we did get one email this week of someone who was questioning or taking
exception with our IPv6 episode of the show a couple weeks ago with Verbal and I, where
they said that we had made some mistakes in the topic content, some of the things that
we said.
So, they sent a long email about that.
As it turns out, no, we were correct.
We checked and verified everything, what they explained, and it looks like everything was
fine.
It was on point.
It was just a misunderstanding in the way we spoke about it.
And like we said then, and this happens on the show, and not there, you can back me
up.
Sometimes it's very hard to explain things in this medium.
I mean, it's radio, and all you can do is try to verbalize things, and when you're
trying to verbalize, you know, the network stack and the math behind how IP addresses
are created and natting and just all these other things that go along with it, radio is
not exactly the best medium for that.
I mean, I'd even say that print, even though it's old school, is probably the best media
because diagrams help a lot.
Oh, yeah, I definitely agree.
You can't, there's a limit to how much you can explain just three points.
Definitely, visualization helps.
Yeah, and so, but I did want to point out that it is perfectly okay to send us an email
like that.
I mean, just because this one was a little misunderstanding, we're certainly not above
making the occasional mistake, so, or frequent mistake.
So, it's perfectly fine to email us if you think we have made a mistake because we'd
rather come on the next episode and correct it and get it right than leave information
out there that's not correct or unclear or whatever the case may be.
So, feel free to email us.
You know what?
Every magazine that gets published on shelves has mistakes, and the next month they'll put
an undo, I think is what Wired would call it, and different magazines do corrections.
Newspapers do corrections all the time.
Even Slashdot has Slashback, where they go back and clarify or touch on anything that
was incorrect from previous stories.
So, you were going to say something?
If we make mistakes, definitely let us know about it, especially me, because most of the
time I'm not making mistakes.
I just fabricate everything just to make myself sound smart.
Either that or you're shit-faced drunk.
You're completely drunk.
What's that?
I said either that or you're completely drunk.
You know, you have a couple of 40s of steel reserve every day, and it happens.
There you go.
All right.
Well, hopefully you're not too drunk this week, because we're going to move on to our
main topic quickly, and our topic this week is virtualization, which is something I've
mentioned on previous shows that I wanted to talk about, because I do think this is a very
big thing, and I think this is a lot of, you know, again, a lot of our listeners out there
probably are familiar with this and know a little bit about it, but we're going to talk
about what virtualization is and running virtual desktops, running virtual environments for whatever
reason, talk about what they are, how they work, give you some samples of different software packages out
there that will do that for you, and go into some detail of not only what they do, generally speaking, but what they
might be, what you might be able to do with them as a hacker, what interest you might have
as a hacker to have a virtual environment like that.
So, that is why we have Captain Rosebud, no, Johnny Swank on the show with us this week, because
you swear by virtualization now.
You absolutely refuse to do anything that's not virtualized now.
Yeah, it's kind of crazy, I got into it, you know, maybe a couple of years ago, and it worked all right, but the
way, the state of virtualization today, I literally have nothing installed on my machine other than my
virtualization package and my virtual machine, and that's it, and I don't know, it makes my life a lot easier,
because it's easier to reinstall on a virtual machine than it is to reinstall your actual machine, so that's why I do it.
So, each one of these virtual machines is completely 100% independent from your actual main machine, your main box?
Yeah, definitely.
Nothing, no overlap whatsoever, no way, nothing can sneak out at all?
Well, that's not entirely true.
Okay.
You can set it up so that you can go between the two, like you can set up file sharing between the two and all that kind of stuff.
You can actually, even with the latest version of VMware, you can drag and drop files from your desktop into the virtual machine onto its desktop,
and it basically, in the background, transfers it over Windows file sharing secretly, and that lets you copy things in there like that.
Well, it's really like a second box, then, is that it's really just a second box.
You're transferring files to a second machine, not into the virtual machine, per se.
Yeah, exactly.
As far as the machine, as far as your system knows.
Yeah.
But, have you used any virtualization products before, or anything at all?
I've used Microsoft's in a limited capacity.
We ran some Linux environments under Microsoft Virtual Server, and it was pretty much just a run dedicated, like, I think, Spam Assassin.
One time we had an interface with Exchange somehow.
Very limited.
Very limited, I'll say.
Well, when I got started using virtualization, I had kind of a, not such a great reputation, because it was slow.
It was all slow.
I think the first one that I used was called Fox, which is spelled B-O-C-H-S, and it appears that they still have this project alive and well, as of two months ago.
So, the big problem with them was they virtualized everything.
They virtualized the processor.
They virtualized all the hardware and everything like that, which has advantages and disadvantages.
The problem with virtualizing everything is that it's really slow.
Like, you have to build in software a little virtual processor and then run your software on top of that virtual processor.
So, every instruction that's being executed on this could be thousands or tens of thousands or even millions of instructions on your actual processor.
So, you're looking at a huge performance hit.
New virtualization products don't do that.
What they do is they run the code natively, and they have the hardware virtualized.
Not all of the code runs natively, but most of it as much as they possibly can.
So, the advantage of that is that it's faster.
The disadvantage is that you can't run other platforms.
Like, with the previous virtualization, like Box, you could take a Sun machine and you could run Linux on it because it virtualized the whole processor.
But with something like VMware, you can't do that.
If you want to run Mac software, although I don't know why you would want to do that, or if you wanted to run Sun software, you just can't do it on something like VMware.
But it's a lot faster.
So, the penalty for virtualization nowadays is minimal enough where I don't even notice it.
So, you said you've used Microsoft's virtualization package.
I've heard that it's actually pretty fast, comparable to VMware.
Some people even say faster, but I don't see the performance of that.
And what I used to clarify was like their very first generation of it.
So, I know it's come a long way since then.
This was the very first generation, gosh, three, four years ago, two, three years ago, something like that.
It was quite a while back, and really I worked in the – I had to work inside of the environment.
I didn't do any of the setup of it or installation or any of the stuff like that.
So, maybe we should back up and talk about – okay, we described kind of what it is.
But, I don't know, correct me if I'm wrong.
Is it wrong to think of it like when we create ISO files to burn CDs or something like that?
You'll burn something to an ISO, which is an image, a mountable image even if you use some of the tools out there that will let you mount it virtually.
It's doing kind of the same thing.
In virtual servers, you can create an image of whatever environment you want it to be, and you basically just – is the term mounted or just activated or what – how would you explain that?
Well, in VMware terms, I think the term is play.
So, you have a virtual image, and you can load that onto any VMware server or VMware workstation or VMware player instance and just pop it in there and hit play.
And the virtual – the image that you have basically specifies that I have a machine with X number of hard drives.
Each one is X number of gigabytes, and the machine has this amount of RAM.
You can also specify other virtual hardware like mice and other things like that, modems.
So, basically, your virtual machine file will say, okay, I've got a machine with one gigabyte of RAM, four 80-gig hard drives, and, you know, a USB mouse and a virtual CD-ROM drive, something like that.
So, then anybody that has at least a gigabyte of RAM and the hard drive space for that, they can copy that big image file, bring it to that machine, hit play, and start with the machine.
And it will run the same on your machine as it runs on my machine.
There are some exceptions to that, but they're few and far between.
And you were telling me one time, I believe, that you were actually taking images and using them on one box and taking them home and continuing working where you left off easily because of that?
Yeah, what I would do is I had an external hard drive, and I would take my images from my desktop machine, and I would put them on the external hard drive.
When I went traveling or something like that, because some of the images I have are bigger than the free space left on my laptop drive at this point.
So, then I would travel, and I'd be in a hotel room or whatever, and I'd plug in my drive and, you know, boot up my virtual machine that had been running on my desktop, but now boot it up on my laptop.
And it worked just fine.
And it's nice, because I always have the same environment wherever I go.
I don't have to worry about, you know, installing my development environment on two machines, worry about the licensing for two machines,
and then, you know, make sure that everything is matched up and all that.
You know, my source code, my development environment, all that stuff stays on one image, and I just move around wherever I need it.
And if I go to a friend's place or whatever, and they want to, you know, check out what I've been working on,
I can just bring my actual hard drive and boot it on a VMware player and show them what I've got.
So, it's basically like I can take all of my stuff, freeze it at any point in time, and bring it somewhere and say, this is exactly where I left off.
Now, you say freeze it at any point in time.
So, let's say you've got a virtual environment that's, I don't know, let's just say it's a Windows XP image with, I don't know,
15 apps installed to it, development, Visual Studio or something like that installed.
Do you keep your source trees and stuff like that on there as well, and they're part of the image?
And every time you make changes, do you update the image, or do you keep the source separately somewhere else?
Or kind of clarify that a little bit, because I think that's a little confusing.
Okay, well, actually what I do with my source code is I have it on a web server, on an Apache server that's running some version.
So, I check out my code and update my code through that.
So, even if I'm not using the same image, I can just check out my code and always have everything up to date.
You know, I check in.
Once I'm done working on it, I check it in, and then I can check it out from anywhere else.
But, yeah, the source code is local on the actual image.
I just check it out through Subversion.
You just need a client to connect to Subversion and pull it down.
Right, right, right.
Okay, and actually...
If I ever get out of date, I can just tell Subversion, go to my web server, update the code.
If I happen to have, you know, if I happen to be working on the same project on, like, multiple virtual machines, I can do that.
So, that's how I synchronize my source code.
That's a little confusing, but...
Well, and you mentioned something else, too, that's a factor to think about, and that's licensing.
Is there any issues?
Are there any issues, I should say, with licensing?
Let's say, again, using a simple example, you have Microsoft Office installed on your main box, but then you're running virtual machines, virtual...
You're playing different virtual environments there.
Can each one of those have Office installed as well, or is that illegal?
Is that breaking the licensing agreement?
You know, it all depends on the software company.
I think that Microsoft's license agreement lets you have two copies of Office.
I'm not totally sure, because I don't use Office, but I've been talking to somebody about it.
Don't hold us to this.
What's that?
I say, don't hold us to this.
We're not lawyers.
We're just...
Yeah, well, this person I was talking to seemed to be under the impression that you were allowed to have...
If you bought Microsoft Office, that you could have it on your desktop, and you were allowed to have a copy on your laptop so that you could travel with it.
But you should only be using one of them at a time.
So, technically, if you had a desktop and a virtual image, I would imagine that you'd be allowed to install it on your desktop and on your virtual image.
As long as you were only using one of them at a time, that you wouldn't be breaking the licensing agreement.
But, honestly, what I would do is I would forget installing it on your desktop altogether.
Just install it on the virtual image and bring the virtual image around to you.
I think you have fewer licensing problems when you do it like that.
As long as you're not making copies of the virtual machine and, like, handing it out to your friends,
then it's okay.
So, do you have anything really installed on your main machine?
Let's see.
I have VMware.
I have Verizon Access Manager, which is for my EVDO card, and that's it.
And everything else is installed via these sessions?
Yeah.
The only other stuff, the only application, actually, that I have to install on my main machine, I don't have to, but the performance is much better, is Google Earth.
For whatever reason, on my laptop, hardware acceleration, 3D acceleration, doesn't work.
VMware has support for it.
It's experimental.
But Google Earth runs really slowly.
So, I install that on my main machine.
So, I have kind of three applications.
There's some other miscellaneous crap that came up with my laptop that I'm too lazy to uninstall, but I don't use any of it.
So, I try to keep everything at a minimum, which is nice because my machine boots up really, really fast now.
Both my laptop and my desktop just boot up ridiculously fast.
And I can junk up my virtual machine and not worry about it.
If I ever need to reinstall it, just restore a previous image.
And I don't know, it's going to go through all the hassle of, you know, spending an hour reinstalling it so I can do it in five minutes.
Right now, and you'll create your image, your standard image that you want to mount each time with whatever your regular apps are.
And let's say a new app comes out that you want to install and keep on there persistently.
Is it easy to update that image or do you make a completely new image and trash the old one?
Or what do you do in that situation?
Well, there's two ways you can do it.
You can either kind of manage it yourself.
Like, you can have your virtual machine, install everything you want on it, and then power it off.
And then take the virtual machine file and just archive it somewhere.
You know, RAR it up, put it on a CD, and, you know, put it in your desk somewhere.
Just hold on to it for the next time you want to make a copy of it.
You can do that.
And then any time you add new applications, you know, you can do the same thing.
Add your new application, shut your machine down, archive the whole thing, and put it on a CD.
You can throw away the old CD or keep the old CD, whatever you want to do.
But that's one way to do it.
If you have VMware Player or VMware Server, that's really your only option.
Because they support what's called snapshotting, where I can say, I want to be able to go back to this point in time.
So I can be running my machine, install my application, create a snapshot, do whatever I want to do,
and then roll it back and go back to this one point in time.
But you can only do that once with VMware Server and VMware Player.
So you're better off archiving it yourself, like I said, on CDs or DVDs.
With VMware Workstation, you can create as many snapshots as you want.
So even what I do is I do my Windows installation, create a snapshot there, install my development environment,
create a snapshot there.
And then from there I start, you know, building my applications and doing whatever.
So if I ever need to go back to my pristine Windows installation or make another copy of it,
I can click on that installation, click clone, and have another copy without having to dig out my CDs or do anything funky.
So VMware Workstation, if you're going to be doing a lot of development, definitely the way to go.
Well, it sounds like the snapshot is a really cool feature.
I mean, it's like basically a rollback or a commit in database terms.
I mean, you can always roll back, especially if you've been working on something and just make a mistake.
You can roll back to the previous point that you have stored and not have to do –
it sounds like it would save a lot of time, but you say it only lets you do one of those?
Oh, yeah, on the free ones, VMware Server and VMware Player.
They're free.
But the pay version of VMware Workstation, you can do as many as you'd like.
And you can get complicated.
You can have trees of snapshots.
Like you create your development snapshot, and then you can roll back to your pristine snapshot
and then make, you know, some type of like desktop application snapshot and have those two in parallel.
So you can switch back and forth between those, whatever you'd like.
So you want it to develop it, you go to your development machine, which is just a snapshot,
or you can go back to your desktop application machine, which is just another snapshot.
And, I mean, that's really, really useful.
If you're working on a project and you either don't have source control
or you're working on something that's difficult to use source control with,
like a lot of binary files or something, you can use that kind of as your poor man's source control.
And if you blow something away by accident, before you think you're going to do something destructive
or something that might have, you know, something that you can't roll back,
just create a snapshot and then go and work along.
And then once you're done, if you need to, roll back the snapshot.
If you don't, delete the snapshot and reclaim all of this space.
Yeah, and you said, you know, source versioning.
I mean, that's exactly what it sounds like.
I mean, you can go back, especially with the different trees.
It's a perfect description.
You can go back and find at any point in time what code you want to go back and check
and see what changes were made.
So it's like the features of a versioning system, except applied towards virtual PC, virtual environment.
Yeah, exactly.
It really is source control for your game images.
For your applications, yeah.
So, all right, so we've mentioned a couple here as we've been talking,
but let's make a quick, it's probably a pretty short list, isn't it?
How many different virtual software packages?
I don't know if that, is there a proper term?
I don't know, it sounds kind of weird.
It sounds like a long title to call them, virtual environment software.
I don't know what else to call them.
Everyone I know calls them virtualization packages.
Okay, just virtualization.
Okay, so we know we've mentioned Microsoft Virtual Server and VMware.
Right.
Now, there are some other ones.
Like I said, there's Box, which who knows the status of that now.
But there was another one that somebody was telling me about the other day.
I thought it was called QEMU.
Yeah, processor emulator.
But I don't really know how well that works.
I haven't personally touched it.
It may be the greatest piece of software ever, but I've never used it.
But as far as I'm concerned, VMware works for me.
You know, it runs a little bit nicer than the Microsoft one that I've seen.
All the reviews I've seen say that VMware is light years ahead of Microsoft.
Really?
You know, I had to buy it for business anyway, so I figured, why not use it?
Right, right.
But that's kind of, I guess you could say I'm kind of stuck with VMware, but nobody's really
told me, like, oh, man, you've got to switch off VMware because this other platform is so
much better.
And once I hear somebody say that, I will definitely try it out.
But until that point in time, I just haven't really been looking around for anything else.
Well, I do know that, we mentioned license earlier.
I do remember that with Microsoft Virtual Server, that they did make, I mean, one of the benefits
that they pitch people to buy Microsoft Virtual Server was that it does save you money on licensing.
So I guess there is some sort of exception that they allow you to have, you know, if you're
going to install a bunch of virtual Windows NT environments or 2000 or whatever, that they're
not going to charge you for each extra one.
I guess with the Virtual Server, they allow you to have more images for less money or the
same money or something like that.
So that's, you know, if that's a factor at your, you know, for business application, if
you're an all-Microsoft shop, you know, even, it might just be better for you to go with
the Microsoft solution.
If you're already that much in bed with Microsoft, you're kind of screwed anyway.
Yeah.
But yeah, I've heard about those little loopholes where Microsoft says, you know, if you're using
VMware, you're going to have to save for extra licenses.
But if you use our package, you get a special deal on life.
Right, right.
Which I think is really the only way that they can sell their virtualization product.
Well.
Because I haven't heard anything great about it, really.
Everything I hear is that Microsoft can't catch up to VMware.
Well, I mean, it seems like I've read some articles where they're trying to.
They're certainly still putting a lot of development time into their virtual server package.
So I know they're trying.
Now, whether they do or not, I mean, you've got a lot of resources at Microsoft.
I mean, look how they've caught up in every other, they fall behind on so many applications.
They throw money at it and eventually catch up.
I mean, look at the browser wars from back in the day.
I mean, IE came out of nowhere and possibly through some shady means, they ended up dominating
the market and still do, as much as we all hate to admit it sometimes.
Office.
I mean, look at Microsoft Office.
I don't know if anybody remembers, but WordPerfect used to be the Office suite that you would use.
WordPerfect suite, WordPerfect with, what was that, Lotus 1, 2, 3?
And Microsoft comes in.
D-Base 4.
I remember, I learned D-Base 4 back in the day.
So Microsoft certainly can play cash up pretty well if they throw the money at it.
And I don't know if there's an, that's interesting.
I'm going to check that out after the show and see if they're coming out with a new version
of Virtual Server anytime soon.
What is the, I don't even know what the latest one is.
Is there, do they number them like everything else, Virtual Server 2003, 2005?
I don't know the answer to that.
I honestly don't know.
I just did a Google search for it and first hit is Microsoft Virtual Server 2005 R2.
So one thing I've got to say about it is that VMware seems to have more like cool features
for developers, but people tell me that the performance of Virtual Server, like I said
before, is equal to or better than VMware.
If performance is really an issue for me, I would probably check it out.
I'd probably look at Virtual Server a little more, but performance isn't really all that
important to me considering what I'm doing.
Well, all right, and let's talk about that a little bit and let's break down a little
bit more than we've already done about how these things work.
I mean, virtualization, it is taking every bit of hardware that you have and loading it
into memory, virtualizing the drivers for every bit of hardware, virtualizing, gosh,
I don't even know how to put it into words.
You can probably do it better than I can.
Yeah, it's kind of, you know, instead of having just a physical piece of hardware that's a
graphics card or, you know, a hard drive controller or something like that, you know, they just
write a piece of software that kind of emulates what that would do and then translates that
to your host operating system.
So when your virtual machine says, I need to write this block to this part of the disk,
it's really not writing to that part of the disk.
It's telling VMware, hey, find where this block of my virtual disk is on your host operating
system and write to it for me.
So that's where your performance gets impacted because you're not writing directly to any
piece of hardware.
There's always that layer that sits there and has to kind of translate in between the
two.
You're never drawing directly to the screen unless you're using an experimental acceleration.
You're never writing directly to the disk unless you're using, there is an option to do
that actually in VMware where you can, you know, tell this is my physical disk, write to it
directly.
You're never playing directly to the sound card, you never, you know, you've always got
to go through that layer.
So whatever software they've written there, unless it's really super efficient, you're
going to notice it.
But like I said, for me, the performance is so good for me that I don't notice it.
And if I was doing something that was really processor intensive or really graphics intensive
like Google Earth, then I would notice it.
And that's the only exception that there's been for me so far.
So for every piece of hardware, it has to load into memory all the support and everything
that it needs to interface with that virtual piece of hardware that it now has.
So performance-wise, and you and I have had this discussion, debate, argument a lot of
times, and you keep telling me over and over again that it's more efficient than I believe,
but it seems like that is a huge amount of overhead to add, especially in Windows operating
systems, which already has horrible, huge overhead and using lots of memory just to
boot up your standard desktop.
And then you're going to boot up or play or whatever term you want to use, your virtual
environment, which is going to do all the same thing, which is double in my mind, plus
whatever applications and other things you have running inside of that.
And then if you've got a lot of reads and writes to a virtual disk, to use your example,
that's going to eat up even more memory.
It just, it seems like, and again, I take, I trust that you're telling me that it's not
as bad as I think, but it just seems like that could really, really eat up your CPU,
that you would just be so slow that it doesn't seem like it would be usable.
Obviously, I'm wrong because I have seen in shops that I've worked at where they had two
or three virtual windows open at the same time.
So I'm sure, basically, it certainly cannot be as fast as running just drop your environment
natively.
It certainly can't be as fast as that.
But, I mean, what kind of degradation do you get?
And does it further with each extra window or each extra virtual environment that you
open, does it degrade exponentially or do you usually just use one?
I usually just use one, but there are a few things that I've needed to run multiple virtual
machines at the same time.
VMware calls them teams.
So you can have, like, let's say four machines in a team.
So I pop open, instead of just my one virtual file, I pop open my team file, I hit play,
and then all four machines start up.
You can notice that there is a slowdown, at least when the machines are starting up.
But, honestly, if you look at typical, you know, straight-up, you know, end-user usage
patterns, I mean, how often is your CPU really maxed out during daily use?
If you're, like, editing video or something, yeah, it's maxed out all the time.
But when you're sitting there, like, browsing the web or doing something like that, even
using Visual Studio, unless you're building, your CPU really isn't pegged.
Your disk really isn't pegged.
I'm thinking more memory.
Doing something processor-intensive or disk-intensive might be noticeable, but unless you're really
slamming the processor and disk all the time, I don't think the average user notices it.
Well, I'm thinking more along the lines of memory.
No, memory is, see, the part of the memory that's really not, that's not really too much
of a bottleneck.
Because what VMware does is it allocates, like, a huge chunk of memory.
You know, if you need 512 megs for your machine, it allocates a 512 meg chunk of memory, that's
a contiguous chunk of memory.
So it's addressing that memory directly.
So the translation there, the penalty is almost non-existent.
Well, and if you've got three virtual environments, each of them needing 512, you need 1.5 megs of
RAM just for those, plus whatever you're natively running.
So I guess let's go back to emphasize, or not go back, but let's emphasize the fact
that you really need some power to run this, too, right?
You can't really put this virtual server and run it on your, you know, your laptop that
has 512 megs of physical memory on it.
You're going to run into problems.
Maybe if you wanted to run some small, you know, Linux machines.
But if you're only on one machine, it's not a big deal.
You know, if you just, if you have a Windows affiliation like mine that has nothing on it,
you know, it really doesn't take that much RAM to boot.
You'd be surprised.
So that little bit of memory that it takes up, you know, plus your 512 megs, you know,
if you've got, if you want to run a 512 meg machine, you've got 768 megs of RAM, you're
going to be fine.
If you want to run multiple machines, yeah, you're going to need a lot of RAM.
You're going to need, you know, a decent processor.
But the thing is, you're getting four machines out of one.
Right, which is the whole main benefit, of course, that they're all touting and pushing
this towards businesses who are all about the bottom line.
If we can run four machines for the one machine, the price of one machine, but we can get
performance of four out of it, you know, in their minds, that's a great deal.
Yeah, and I know, I actually work with a couple of companies for my job, but they've, they're
running VMware ESX server, and we can get into that later, because it's a lot more involved
than just the regular VMware products.
They're running that, and they're virtualizing, you know, 20, 30 machines on one single box.
And performance is just, they know how to tune it really well, and, you know, they've got
serious horsepower behind it.
Performance is just awesome.
Really?
Well, I think this is probably a good point.
We're still talking about the different packages and performance.
So maybe, what is the ESX, you said?
Yeah, VMware ESX server.
VMware regular server and VMware workstation and VMware player that I was talking about
before, they're applications that run on either Linux or Windows.
VMware ESX server is its own operating system.
When you get ESX server, you don't install anything on a box other than that.
So when it comes up, I don't even know what the interface looks like on it, because I've
never seen one of these boxes in person.
I've only seen the administrative interface remotely.
But it's just running VMware, so there's much less crap in the way.
You're not asking Windows to write to the disk for you.
You're just, VMware ESX server is doing everything for you as efficiently as it possibly can.
That sounds brilliant to me.
Yeah, yeah, it's great.
And the really nice thing about it is, and what people really get excited about, is it
has this great administration tool.
So you can, let's say you have four or five ESX servers, you know, they're running 10 machines
apiece.
You can pop open this tool, and you can see, you know, how much disk activity is going on
on each server, how much the CPU is used, how much memory has been used, and all that.
And they have this thing called vMotion, which you have your four servers, and you notice that
one server really isn't doing much of anything, but the other servers are kind of pegged.
You can click on a virtual machine, and you can say, move this virtual machine to this
underutilized server.
In real time, it takes the image, moves it across the network, and without the machine
going down, and without the end users even disconnecting from it, it just moves to the
new machine.
How?
How in the hell does it pull that off?
It requires kind of a tricky network configuration.
All of these machines have to be sitting behind a particular type of switch so that they can
share IP addresses, but I've watched somebody do it, and it's amazing.
He pops open a window, and he's pinging this box, and he says, okay, now I'm going to move
this virtual box from one machine to another.
And the pings are going, like, you know, less than one millisecond.
As the machine's moving, a couple of the ping packets are, like, two, three, four, ten milliseconds,
and then it goes right back out to less than one millisecond.
And that's the only thing I noticed.
Like, he was on the machine, running applications, no problem.
That is uber.
Yeah, it is definitely uberleat.
That's so cool.
The things that are required for it are, obviously, fancy network config, like I said, where they
can share IP addresses, and the network won't freak out, gigabit connections between all
the machines, and you need a SAN.
The virtual image has to be stored on shared storage, which isn't really a big deal.
So these companies have, like, a SAN from EMC or EMC or something like that that's super
fast and just tuned to the max.
So one server, basically, all it's transferring is the content of RAM from one server to the
other.
And then once that content of the RAM removed, then it can just take over completely.
But magically, while it's transferring, it still works, which is just amazing to me.
Yeah, that's pretty damn cool, I have to say.
But let's reel it back a little bit, because maybe there's a few of our listeners that might
be able to bankroll something like that, but that sounds like some big money corporate
solution type stuff there.
I think when you get into the VMware ESX server, you're looking at, like, a starting cost of
somewhere around $25,000 to $30,000.
Good.
Googly moogly.
Yeah, and that's not including hardware.
I think that may just be the VMware licenses.
It's very expensive.
But huge companies that have, you know, that have, like, you know, eight processors, Xeon machines
with, you know, 64 gigabytes of RAM.
Right.
So they're looking, they don't want to spend the money on buying, you know, 40 machines.
The problem with that is you've got 40 times the hardware that can fail.
You've got, you know, 40 times the startup cost for buying all these machines, like each power
supply, you've got to figure, you're buying 40 machines, you're buying 40 power supplies.
If you can just buy one big, efficient power supply, you're making out like a bandit.
And just power consumption is another thing that people are really conscious about now.
It's just getting really expensive.
Right.
VMware markets that, and they say, you know what, you'll cut your power utilization by,
you know, 50% or even 75% at some places like that.
So they can give you a return on investment statement that really impresses a lot of business
people.
And it's no bullshit.
You know, you really do save money when you do it right.
So VMware ESX, definitely, like you said, it's not for just any user.
It's for a big business that needs to save money or needs to be more efficient or needs
their admin to, you know, be able to administer more machines and, you know, squeeze even more
pennies out of people's pockets.
But not quite for the end users.
All right.
Well, let's back up.
And what do we propose then?
Let's say our listeners are intrigued by this.
If they weren't already using it and want to try it out, they're not going to buy this
ESX server or anything.
So what options are there available for free or cheap or reasonable price that they can
download?
It was the VMware.
There's a free version.
Yeah.
There's two free versions of VMware.
There's VMware server and there's VMware player.
VMware server basically lets you install multiple operating systems on some machine remotely.
And you can have a bunch of users connect to it remotely and use what they call the VM
console to do it.
It's kind of like VNC, but, you know, you can, you know, you're not tied to just the
GUI.
You can, like, reboot your virtual machine and get into the BIOS and do all that kind
of stuff.
It's really cool.
So if you need to share virtual machines between a bunch of users, VMware server is the way
to go.
If you're just looking for something quick and dirty on your own machine to play with,
you can check out VMware player, which is very bare bones, very simple.
Like I said, it only supports a single snapshot.
But user interface is very simple.
You do file, open, you give it the virtual machine file, and you click play, and it starts.
What's the format?
What's the extension or the format for those files?
They're not ISOs, right?
There's something else?
No, there's a couple.
There's the VMware file that you do file open on is a VMX file.
So there's the VMX, which describes the virtual machine.
There's the VMDK, which is the virtual machine disk files.
And there's a VMM file.
So if you pause your machine while it's running, it takes the contents of memory and dumps it
into a file.
So you'll have a VMM file in the directory.
If the machine's powered off, there's no VMM file.
It's only for pausing and restoring.
So if you intend on moving a file, if you intend on moving a virtual machine, you've got to
move all of those files from your current machine to whatever machine you're putting on.
Otherwise, it just won't work.
But, yeah, in any case, VMX is the file extension.
All right.
And you would recommend, then, what minimum hardware to run that free VM player?
Well, it depends what type of images you're going to use.
And for a lot of people, you know, we haven't even gotten to how you create an image or how
you go through the whole install process of an operating system on this.
But the nice thing about the VMware community, as they call it, is that people out there have
already created virtual machines that you can just go on to VMware's site and download.
Now, obviously, they're not Windows machines.
They're Linux machines.
They call them VMware appliances, I believe, or virtual appliances.
You can go on there.
If you want to experiment with Gentoo, if you've never used Gentoo before, it's the best Linux
distro ever, you can just go on there and download a bare-bones Gentoo virtual machine.
You don't have to worry about learning how to install it or any of that crap.
You just grab the file, put it into VMware player, click play, and it boots up.
You follow the directions.
It says, hey, I created this Gentoo image.
And you can log on.
The root account is root, obviously.
The password is root.
And get right in and play around.
It's got, you know, applications, x, y, and z installed.
Well, that's cool.
Now, I have to take exception with your best distro ever, because I think all of our listeners
know that you swear by Lenspire.
So let's not joke around.
Well, you know, I really, I always want to promote Lenspire, because I own a big portion
of the company.
But I didn't feel like I could get away with pimping that.
But since you brought it up, yeah, Lenspire is the ultimate distro.
It's actually going to be our slogan in the next couple of months, once I take over the
company.
Lenspire, the ultimate distro.
Well, that's why you're so big into LAMP, because the L doesn't stand for Linux for
you.
It stands for Lenspire.
You're damn right, it does.
And MySQL, your other favorite.
No.
MySQL is the worst piece of software ever.
Oh, man.
Yeah, hate mail, you can direct that straight to him.
Now, send it in to radio at binrev.com.
We didn't get an email, so we'll take hate mail, whatever.
All right, so that's kind of a cool thing, though, that you can download.
So, instead of downloading a full ISO and installing it on a box of your own, you can
download the virtual ISO.
I don't know if that's a good term to use, but a virtual session of it.
Now, you said obviously not Windows, and that's, again, because of licensing, right?
Obviously.
Right, exactly.
Yeah, they're not going to let you download copies of Windows under any formats or
circumstances.
So, a lot of different Linux distros, probably like Solaris 10, which was released as a free.
There might be one for that, that sort of thing.
Well, that's kind of cool.
Well, I'll tell you what.
Let's get into, then, some applications of this.
We've kind of briefly passed over them as some examples, but you talked about development
and developing how you keep your source code off somewhere else.
What benefits do you get out of, what kind of benefits do you get from testing?
I mean, you're testing your code on here, and I guess, obviously, if you just completely
screw up your data or screw up your environment somehow, you can just kind of reboot it, for
lack of a better word, or stop it and replay it.
Yeah, you know, when I'm developing applications, every once in a while, I'll get myself in
a situation where I say, oh, you know, I need to, you know, do some type of, you know,
let's say I need to just edit an image or something like that.
I don't have any image editing software, so I go in and Google around, and I find a bunch
of stupid packages.
But I'm always afraid on Windows to install anything, because I know as soon as I install
it, it's married to my machine forever.
Even if I uninstall it, it's still there, you know, collecting my credit card information,
sending it off to Russia, and doing all that kind of stuff.
Right.
So, what I like to do is, if I say, okay, I'm stuck, I need a word utility that I've
never used before, I've never heard of the other people who've written it before, I take
my VMware workstation, I create a snapshot, and I call the snapshot, you know, about to
install Wacky Paint 2000, and then I go and install Wacky Paint 2000, I mess around with
the image, I do what I need to do, see if the application even does what I want it to
do, and once I'm done with it, I revert back, and it's like I never, I mean, it's not
like I never installed it, I really did never install it on my virtual machine.
So, if you need to go and get any piece of questionable software, or even any piece of
software that you know you're just going to use once and don't want to use again, and
don't want to be stuck with it forever, snapshots.
That's the best thing in the world for me, because I never feel like my machine's just
going to get cracked up, because of somebody's fully written application.
And if you decide you actually like Wacky Paint, and you want to keep that on the image,
you just update the image to include that install on it.
Yeah, you know, I just, I can just take the snapshot that was called before Wacky Paint,
and just delete it, and that's it.
You know, then my current, my current snapshot is, you know, is my working copy.
Okay, so anything that's questionable, you can install on there, anything you've never heard
of. As a matter of fact, and we're probably crossing into some, like, why is this interesting
to hackers? You know, we're talking about virtualization, and we're even, you know,
talking about it from a business standpoint. We're viewing it from all different angles.
But from a hacker's standpoint, you know, what would be in it for a hacker? What would a
hacker like to, you know, benefit out of that? And one of the things is, you know, if you
want to do some reverse engineering, decompiling, sniffing, I mean, any kind of tool that you
want to run on a piece of software, but you don't want to corrupt your own box. Like, for
example, like, I've been doing a lot of research lately. I don't know if I want to say this.
I guess I will. I've been, I think it's no secret. I've been doing some research on Alexa
and the Alexa toolbar lately. So, obviously, that's most anti-spyware packages, and virus
will pick that up to spyware and want to clean it and delete it and stuff like that, and I
don't want that because I'm actually researching it. So, a virtual environment would be great
for that because I could go and install that into the virtual environment, sniff all the
traffic, because as far as, you know, as far as anything knows, that is a real environment.
It's not virtual. It's, I can do everything in there that I can in my normal environment,
do all the sniffing that I want, do all the reverse engineering, and save those files.
Just like you save your source code, I can save those off somewhere. I can record, put
them on my normal desktop, on a normal disk where I can recover them, and then just kill
the image, and there's still no sign. I'm not corrupted or infected with any of the
spyware or anything like that. Right. Is that a good example of one way to use it? And
obviously, that's just one toolbar, but any toolbar, any application, you know, we all
know how much we hate those bundled where you try to download, I don't know, whatever file
sharing app of the day is these days, and it comes bundled with fucking Gator, or fucking
that purple dinosaur puppet thing that dances around the screen. Oh, you know what? That's
funny you mention that. Bonzi Buddy you're talking about, right? Yeah, Bonzi, that's
his name. I forgot about that, yeah. Well, you know, somebody I was working with wanted
to, you know, I told them how great virtualization was, and they just didn't believe in it, so
I said, you know what? I believe in virtualization so much, I'll create a snapshot, and I'll install
Bonzi Buddy right now to prove to you that I'm not afraid that it's going to destroy my system.
Now, here's the really sad part. I actually went out, Googled Bonzi Buddy, and could not
find the virtual app for it. When you actually want the spyware, you can't
find it. Oh yeah, there was just no hope. So all I did was basically, I searched for Bonzi
Buddy, and I saw all the sponsored ads that came up, and I clicked to every single site,
I accepted every comment cursor, every single piece of crap they wanted to give me, they
wanted to, and they told me my machine was full of spyware, I was like, okay, sure, fine,
I'll click on that. I went to all the poker sites, everything. My machine was so crapped
up, it couldn't do anything. It was a total disaster. Right. So all I did was revert, snap
shot, bam, my machine's perfect again, which to me is just awesome. You know, I like getting
to check out something and say, you know what? I don't have to be afraid of this crappy
software. I can see, you know, whatever spyware is out there, I can see what it does, I can
check it out and play with it, and then just be done with it. Well, and it's kind of a
cool idea too that, so you went ahead and did all that in your virtual environment. You
could run AdWare or something in your native environment, and it would never see any of
that stuff that's down in the virtual environment, correct? Exactly. And if you run AdWare inside
the virtual environment, it's going to go ape shit because of all that stuff you've got
installed in there. Yeah, pretty much. And of course, it won't clean its success. Actually,
that's a good thing. That'd be a good testing area to put your AdWare in that virtual environment
and try to clean it. Can you go, can you take, say, a, all right, this may be a stretch here.
Let's say you've got a client or somebody that, your friend, a neighbor says, oh, my computer's
got tons of spyware. Can you help me clean it? Can you go and get an image of their computer
as it is somehow? Can you take your laptop over there and say, image this other computer
and then take it home and play with it at your own leisure in a virtual environment, all
infected, and run all these tools against it and see which ones work or don't work before
you ever go back and actually try to clean their machine?
You know, there's a, there's a utility that, that VMware has. It's called P2V, which is
physical to virtual, which does pretty much exactly what you're talking about. The problem
is it only comes with a paid version of VMware. You can kind of hack it yourself. And I did
it a long time ago. I didn't do it with a Windows machine. I don't believe that it really works
hopefully with a Windows machine, but I wanted to copy a Linux machine. So I used it, this
account utility, DD, and I just copied the whole contents of the drive, copied it into
a big file, and then told VMware, use this big file as my hard drive, and it worked. I haven't
done that in a long time. It worked with the old version of VMware. No idea it works with
the new version. But yeah, I think you can use possibly Norton Ghost and create VMware files
from it, but I'm not totally sure about it. But yeah, that's, that's one of the things
that when you, when you pay for it, you definitely get a tool that does that and it works pretty
well. So you can, you can grab any machine and just copy it and play around with it.
Yeah. So if you, if you're in the side business of doing that, I know a lot of people make
a little money on the side cleaning up spyware and doing little computer errands and upgrades
and stuff that might actually be worth, might be a benefit worth, worth doing. So that way
you don't have to sit at a client's place and run spy bot search and destroy and add a
wear and then go in and try to hack store the registry and all this other junk. And you can
take it and do it at your own leisure. Yeah. I hadn't really thought about it. You
could, you know, take that snapshot at the beginning, go through your steps to do all
the, all the recovery. And once you find, you know, snapshot it, each time you, you make
some progress and then you have kind of like a map that says, okay, you want to get all
the spyware from the machine, run this, this and this in this order. And I know that it's
going to work for you. Right. Exactly. Pretty slick. Pretty good stuff. Um, it's pretty
smart for a redneck. Yeah. Well, you know, I, I try to get by. I, uh, I, uh, I was also
kind of thinking, uh, actually maybe let's, let's clarify. I think we've said this as well
and it's probably abundantly clear, but just to reiterate, cause we haven't said it straight
forward, you can run any environment, any operating system in one of these windows. And
that's true for the Microsoft or the VMware or most others, just because you're running
Microsoft virtual server doesn't mean you have to run only virtual Microsoft environments.
You don't have to run just windows XP and windows NT. You can run Linux inside of there.
You can run a red hat distro inside a virtual window inside of your office or your windows
2003 server running virtual server. And in VMware, you can run, as, as we said earlier, you
can download a lot of Linux distros online that are already set up for you, but you can
also put on windows XP or anything for that matter. So just to clarify that the, the versatility
that you have with this is incredible. I mean, there's really not much you can't do other
than maybe if there's no, you couldn't run something like a OS 400 or something that's
architecture driven. If the, the hardware is not going to be supported, there's no drivers.
It doesn't work on that hardware. Right. Not, not with a product like VMware or a Microsoft
or virtual server, but the older products that do pure virtualization, they virtualize
the process and things like that. If they made a version, if they made a, you know,
an IBM AS 400 virtualization product. Right. You could, you could do that. It would just
be so slow. It'd be unusable. Yeah. Right. Right. Um, and also, and here's another interesting
question. Because of the simple fact that you know you can undo anything, it seems to me
like another neat application you might want to do. And again, sticking with the fact that
you say that performance is not that bad. Can you set it up so that you're not really
using the virtualization to open up windows and test things like we're applying it? What
about at home user? Could there be a way to set it up so that when windows, let's say you're
running windows XP at home with VMware, that it automatically boots into your virtual environment
every time, like make it transparent and invisible. And every time you boot your machine,
you're not really booting into your native windows XP environment. You're voting into your
imaged XP environment, which is safe and doesn't have any of the spyware and stuff like that on it.
That way, if you ever do get screwed, all you have to do is back out of it, reboot your machine,
you come back up to where you had a safe environment. But can you make that invisible so that most
users wouldn't notice it? Actually, it's funny you mentioned that. There was a company a while ago
that did just that, but not exactly for that reason. They were at Hope, I think it was Hope 2000.
They had a product where they used VMware on Linux and they encrypted your whole disk file so that if
anybody found your laptop, they'd get an encrypted disk, an encrypted VMware image and they wouldn't
be able to view it. But that was exactly what happened. When you booted it up, it would give
you a list of your Windows installations. You'd select one and that was it. You were into your
box and if you were a dumb user, you wouldn't really know that it was VMware. But you could
take encrypted snapshots and you could revert to these cryptosnapshots too. So when you knew you
had a stable environment, take a snapshot and that's it. You wouldn't have to ever worry about
loading VMware and starting your image and all that. It did it all right from the Linux
district. I don't know anybody that's really doing that now, but it definitely is possible
because I've seen it before.
Well, and especially, you know, within the past few years is when the spyware problem's
really, really, really taken off. You know, it seems like now would be a better time than
any to have a solution like that in place.
Yeah, definitely. I don't know. The only reason I can think that more people don't do it
is because with VMware, if you want to run Windows, you're going to need a license for Windows
that comes with your laptop and you're going to need another license to run it there a second
time.
Yeah.
I'm pretty sure that's the way the Windows licensing works with VMware.
Possibly, but you know what? The truth, the fact of the matter is, and of course we're
not endorsing anything here, but they'd never know the difference. Microsoft would never
know the difference.
I don't think...
You never know.
Well, true.
You're always coming up with new ways to screw you. There's been a lot of work actually in
virtualization detection, and products can now detect that they are running in a virtual
environment.
Oh, man.
Well, let's go back on that direction we were heading off on about, you know, why is this
interesting to hackers? What can hackers do with this? Well, like for example, one thing
that jumps to mind is things like penetration testing or any kind of tools you're developing,
security tools. You know, we don't condone going out and DOSing sites or DOSing other
networks, but you know, certainly to computers that you own or that you're responsible for,
you might want to test and see if you're secure against different things. So you might find
a new tool out there. You can't go DOS some random site to test it. You don't really want
to risk DOSing your own site and screwing it up to test it. You could open up two virtual
sessions, install the tool to one, and attack the other. Is that right?
Yeah, exactly. And that would be what they'd consider a VMware team if you were using
Workstation. You boot up both boxes simultaneously, and you can actually even create a virtual
network segment that isolates it from everything else. You can even simulate, and one of the
cool things it does, you can simulate packet loss and all kinds of weird things like that
in your virtual network segment. But if you wanted to do some DOS testing, you could create
an internal virtual network segment between two, three, four, five machines and use that
to do your penetration testing or, you know, exploit testing and all that.
And a lot of researchers, yeah, a lot of researchers are looking into botnets and how they work and
how to prevent them. You know, a lot of security companies are making that their major point
of research. Well, you could actually install a controlled botnet. You know, have a team of
five, ten, however many you can handle running, and have all them attacking one of the images
and see what the effect is and how incremental it is and test how to control it and stop it
and things along those lines. I mean, the possibilities as far as that go are endless.
Also, what about sniffing traffic? If you wanted to do some, you know, test some tools for fingerprinting
or active sniffing, I mean, would these virtual environments throw off fingerprinting very much?
If I ran Nmap against a virtual environment, would it give me any false responses or is it
pretty accurate?
No, it's accurate. I do it all the time at work because we, at my job, we use almost all
virtual environments just because, you know, it makes sense for the business.
Right.
And I can Nmap those machines and it's right all the time.
Cool. So any kind of tool that you're used to using is not going to change in the virtual
environment. So you can do all kinds of tracing. You can do all kinds of sniffing traffic between
these servers. Does each one of these environments get an IP address or how does that work?
Well, that's an interesting question. There's a couple ways you can set it up. You can set
up your environment so that they're either doing bridge networking or NAT. So basically, your
Windows host or your Linux host would be like a NAT server for all of your virtual machines.
But if you do bridging, what happens is it actually, each virtual machine has its own
MAC address and they'll request DHCP IP addresses and your DHCP server on the network will actually
see all of these requests as if they're from completely different machines and issue IP
addresses.
Oh, that's cool.
So to the network, it just looks like you have, you know, four or five machines on the
same network port if your network's managed like that. But they all have different MAC addresses
and, you know, they don't see each other's traffic, except for the host machine obviously
can see all the other machines' traffic, but the other machines can't see each other's.
Well, that'd be an interesting try to sniff what's coming through the host machine also
just to see if it can pick up and what it can pick up. Yeah, I wouldn't even, I didn't
really, that's kind of cool. I was just assuming that they were all being NATed, that's all.
Yeah, they've NATed. Bridge networking is really cool. So you can, and you can even, one of the
really, really cool things about it is, let's say I have a wireless connection on my laptop,
but my virtual machine, I only have, you know, a virtual wired connection, I can just tell
it's a bridge of my wireless connection, and it'll request IP addresses over my wireless.
So it doesn't really need to know what type of network it's on. It just, you know, it just
goes out there and says, I need a DHCP address, and your wireless call and your host will do
all the translation for you and get you a legitimate DHCP address from the wireless access point.
It's pretty awesome. Yeah, and you know, another great application would be to open up, and maybe
you could do this as a team, but let's say you were a security professional and your job
was to go out and demonstrate different exploits and things like that. You could set up a team
of prepared environments. I'm going to run a version of Red Hat 7, or I don't know, with
a known vulnerability and make an image of that. Then I'm going to run a copy of Windows
NT running IIS, which has a known vulnerability. You're going to have a bunch of different
ones, and then very easily and very visually, which again is a key to a lot of this is more
is better visually, show people, hey, here's like a tool like Metasploit or Core Impact or
whatever tool, and actually attack your virtual servers or virtual environments and say, okay,
that one's exploited. Let me run the Metasploit script and show you that I can root that virtual
session as though, you know, instead of using a real box or having to set up a bunch of complicated
network infrastructure just to demonstrate and test things, you could certainly do that.
Right, right. And then one of the nice things is when you're running a VMware team, if you
have a workstation, you'll see your main window that you're working on. But all of the other
machines that are running in the background, you get like this little postage size, you
know, kind of thumbnail of what's going on on their screen. So if you're trying to do some
type of exploit, you know, blue screens, Windows, or some other kind of silly thing like that,
you're working on your machine, and you can see in this little preview window, you can see when
something happens on the host machine without actually having all of these things cluttering
up the machine. So it'd be very effective if you were trying to do some type of exploit
that was a visual to the person receiving the exploit. You know, pop up a window or something
like that, or if the machine's reboot, you can see all that going on.
Right. Well, and if you're also, well, I guess that's, yeah, I guess that's the same thing.
If you wanted to write or develop an application, or actually, let's say you wanted to do some
reverse engineering on Windows itself. Windows is very volatile. It's very unstable. What
are you, cooking pots and pans banging around there?
Sorry, sorry, I poured something out in the sink, dropped an ice cube.
There you go.
No big deal.
That's helping out with that little medical problem you had earlier that's keeping you
out of the porn action right now. I got a little ice cube.
Yeah, I got to keep ice on it.
I got you. No, understood. Say no more.
Doesn't that cause shrinkage, though, or?
Depends on what body part we're talking about.
Oh, well, I guess I made an assumption I shouldn't have.
Oh, Jesus.
Anyway, Windows is pretty volatile in that if you go messing around with some of its binaries,
it's going to freak out and die. And by having this virtualization, you can go in there
and start really tinkering with stuff, trying to reverse engineer or recompiling.
Like, you know, like one thing I've never, ever had good luck with are different shell
replacements for Windows. And I've tried several of them, so please don't email me and telling
me that this one's great and I use this all the time. I've never had good luck because
they're going in there and they're modifying. Well, the Windows shell, they're actually modifying
the existing binaries and you don't know all the interaction that Windows has put in
there and the interrelationships and the dependencies and blah, blah, blah. I've never had good luck
with any of those things. So this would be a way for developers to actually go in there
and really do some hardcore testing of it and really change these EXEs and see how stable
Windows is without, you know, ruining or risking blue screening or destroying their Windows and
having to start all over and reinstall everything or try to uninstall, which never works, as you
said before, because it's still got crap in your registry from 1977 before you ever installed
the damn software. It's just ridiculous. So this gives you an option that you can do that
and then when it, if it screws up, you're like, okay, well, let me mark that in the didn't
work column, restart my virtual image and carry on with my testing. It would make that a whole
lot faster and the resulting software that you end up with would be a whole lot more stable
because you were able to better test it. Yeah, exactly. If you, if you got your system
to a point and you saw some weird bug that you couldn't, you know, just happened periodically
that you couldn't really reproduce it, well, you could just keep reverting your snapshot
and watching the machine and saying, well, why is this happening? Right. You know, there's
a lot of things that happen in Windows that, okay, it crashes one day, but then it doesn't crash
for the next three weeks and there's no way to get in there and figure out what the hell
happened. So did you fix the bug or did it just not happen again? Right. So rolling back
gives you a lot of, a lot of ability to, to find all of these weird quirks that happen
randomly, which for Windows is pretty much everything is a random quirk. It just happens
to, uh, to somehow get things done. It's a miracle. And any programmer will tell you
that the worst thing to try to debug or figure out is intermittent problems. If you can't reproduce
it easily, consistently, regularly so that you can watch and see what's causing it, it's
the biggest pain in the ass to try to figure out what in the world is happening and what's
going on. And it's the biggest, hardest bug. Anytime you've ever like reported a bug to
a site or you've ever gone and sent a thing, sent a, filled out one of those forms of, of
the problem that you've run into with a software, one of the questions is always, is it reproducible?
Can you recreate it? Because that makes it a lot easier to test it over and over again.
But if it's an intermittent problem, boy, that's a pain in the ass.
Yeah. And you know what? A lot of places that I've seen, a lot of companies that I've dealt
with that, you know, like different packages of software, if you submit a bug report to
them without a way to reproduce it, it comes straight off the list. It's not, it's not considered
a bug unless there's a way to reproduce it.
Wow.
Because they have no proof that it even happened.
Right. And you know, as long as we're on a little tangent, a little rant here, you know
the other thing that I really, really hate is how people don't seem to understand that
you can't go back in fucking time. I hate it when somebody tries to tell me that, oh
yeah, I need you to go back and give me a report or give me a file with the data from two weeks
ago. Um, no, the data has changed. We don't have data from two weeks ago. It's not there
anymore because it's in the fucking past. What don't you get about that? Do I have like
a fucking time travel device? Oh, that's my pet peeve. That is my pet peeve. I hate
it when people ask me that. And how can you politely explain to people, no, we can't go
back in time.
I think you did a very good job of politely explaining it.
That was, that was polite.
That's going to be my canned response. I'm going to get that on a little voice recorder
and just play it for people.
Oh, well, the outtakes from this show is going to be, going to be made into some songs
like, uh, anyway, maybe I'll actually play some outtakes at the end of this episode.
Who knows? Oh, anyway. Um, well, and another thing is, you know, not only code development,
but let's say you're, for some reason you're developing some malicious code or you're testing
at your research company or whatever, and you're trying to test, I don't know, anything
from viruses to, um, something that's going to exploit and crash windows or IIS or anything
along those lines, you know that it's destructive in nature. Yeah, that's going to be a huge
pain in the ass. Even if you have your own controlled network or environment or servers
or stuff, you'll have to manually and physically reboot them all the freaking time. Whereas
if you have a virtual environment and you want to release your, your source code into that
environment and see if it, you know, an attack and see what it does, see if it does what you
expect. Um, you can do that and easily restart it, restop it. It's all self contained. So
it doesn't spread out and infect other computers or your, the rest of your network or the rest
of the global interweb for that matter. Right. So, and you know, it's, it's a little
scary because every time we talk about something, uh, it always seems to come out that, oh yeah,
there's a, you know, you can use it to develop something malicious, but a legitimate use for
developing something malicious is, you know, Microsoft's notoriously slow.
for, for patching their own software. But there are companies now that are doing third
party patches to things. So Microsoft doesn't release a patch or something. There's a company
that does a third party patch and you can fix it, you know, a month before Microsoft ever
gets to it. Well, I'm sure that a lot of these companies are using virtualization,
taking the exploit, running it against the machine, trying a patch, you know, reverting
things and just going over and over and hammering it away until they've got a patch for it. So,
you know, developing malicious software actually has a use if you're, if you're also in the
business of developing patches. And again, if you're not, you know, maybe you're just
trying to steal money out of people's bank accounts, but there are, there are legitimate
uses for, um, for virtualization in order to, uh, develop and, and monitor malicious code.
Yeah. And I think, I think the most of the people that would listen to this show know the
difference that we're, you know, there, there can be, uh, bad applications or intent with some
of the things that you want to do, but no matter what the case is, that doesn't mean we shouldn't
talk about something because somebody might use it for ill purposes. I don't know. I mean,
you can't shy away from talking about things or at least talking about ideas. I mean, if somebody
out there goes out and, you know, writes a virus and in a virtual environment and then comes back
and says, Oh, I heard about it on BinRev Radio. Well, no, we're talking about it, you know,
in a productive way and how you can stop that from happening and how you can test. Like,
you know, I'm saying the people is semantic. This would be a great tool for them to use if
they're not already, which they probably are. I would imagine they can let these things loose
into these virtual environments and see how they work and test them and therefore figure out how
to prevent them and stop them in the future. You know? So, you know, we're talking about
researchers. We're talking about companies. We're also talking to hackers. There's also,
you know, and I know I kind of go out on a limb when I say this. I know Rax and I have had
conversation about this before. To me, there's nothing wrong with researching and looking
into how viruses work. It's your intent of what you're going to do. If you intend to
release that virus and do something with it, you know, and there's different types of viruses.
The harmless type of virus, like remember, I don't know if you remember back in the day
the old stoned virus? Oh, yeah.
And it would just pop up a message that says, Your computer is stoned. And I think it would
go away after a minute or two. I don't remember. I think there's some variations. So it was,
I won't say harmless. I mean, it was a virus. And of course, you know, it's nothing good comes out
of them for the most part. But, um, you know, we don't shy away from talking about stuff just
because, you know, it may or may not be taboo, you know, for example.
Oh, yeah. No, I just, I always like to make the point for somebody who may have been listening to
the show for the first time.
Right.
But yet, we're not talking about how to root your box and be Uberlito and build botnets. Like,
there are legitimate reasons. So before you go and run off and tell all your friends,
Oh, my God. These guys told me that you can use VMware to hack the planet. There's more to it
than that.
Is there a VMware image for the Gibson?
Uh, yeah. But you need VMware Gibson Edition, which is like 50 grand.
Oh, damn it. Damn it. So close. So close.
Yeah, I know. I know. But you get that cool three-dimensional towers, whatever the hell those
things are short to represent.
Oh. All right. Well, actually, but we're kind of time to wrap up. Actually, this was not an abbreviated
edition at all. We're full-time, just about. I did have one other kind of thing. I don't
know. I think I know this, but maybe I'm wrong about this. But talking about the physical
limitations versus the virtual limitations. What I mean by that is, for example, we kind
of briefly talked about memory earlier and how much physical you have versus how much you
shave off for your different images. But let's go back to something. Let's go to something
like, let's say for some reason you have an old network card, a physical network card in
this machine that you're running that's only an old 10 megabit per second card. Okay?
For some reason, it's just an old card that you had laying around. And let's say in your
native session, you haven't opened up any virtual windows. You start up peer-to-peer and you're
just absolutely using all that bandwidth. Now, when you start up two, three, four virtual
sessions, that bandwidth is still physically being used. So aren't those four images going to
suffer because the physical capacity has been reached by that piece of hardware? And that's
kind of what I was getting to earlier about the memory. When you physically run out of
memory, you can't shave off but so much and it seems like it would cause performance issues.
Well, like networking, is this a better example? If you've got a limited bandwidth and you've
got four sessions, you're not really going to be able to get any more bandwidth. You're
still limited to whatever the constraints of the hardware are. Is that correct?
Oh, yeah. I mean, there's no way of getting around that. Right. It's got to give at some
point. If it didn't, we would all just be running the whole planet off of some 286
somewhere. Right. Right. And as a matter of fact, yeah, kind of the, we were talking
about earlier about the CPU. I could, along the same lines, I could run that folding at
home or whatever, which uses 100% CPU. And I can run that in one virtual session or in
the native session. There's not going to be a whole lot of CPU to spare for all the other
sessions out there. So you can overload your hardware so that it will cripple your
virtual session. So you do have to do it smart. Right. But it's certainly not a problem if
you do it well, if you do it smart. And that's why you, your example is you just have a very
bare bones, no frills Windows installation that doesn't have a lot of extra stuff in it
and you do everything virtually so that you avoid that problem. Exactly. So, all right.
So I thought that was a good point to reiterate as we close out here. So let's, um, I guess
jump into the shouts. Um, I'll just give shouts to Natas again this week because again, a
cool article in 2600 Magazine, which I actually finally got. Haven't had too much time to read
it yet, but a very cool article in there. So shouts to him again. And, uh, how about
you there? Oh, I got to give shouts to Mr. Pink also. Oh, and wait a minute, I'll give
it to him. Well, that was, that was yours. Mr. Pink, uh, Buster, Cheek Spreader and, oh
man, what was Duel's? I forgot Duel's porn name. Well, anyway, shouts to Duel Parallel
anyway. Yeah. Um, I don't, I guess my, uh, my shouts go to, uh, Black Ratchet because
he's going to be, uh, helping out with some freak fact stuff in the very near future. Hopefully.
Hopefully. Shouts to him. I think I'm done.
Yeah. Good deal. Good deal. And in keeping with our prawn theme this week, um, as much
as I really wanted to find a, uh, a, um, Rosebud website to promote, I couldn't bring myself
to look at them, but I found another great one. Um, and actually Johnny, Johnny Swank, uh,
our mutual friend, um, not theory mentioned this to me because he subscribes to this, uh, publication.
It's, it's called bulkmail.com. It's B-U-L-K-M-A-L-E.com.
Uh, yes. For all your George Costanza needs.
Great, great, uh, site. Not safe for work, but of course this show never is. If you have
any feedback on this show or any other episode of the show, if you're a new listener, if you're
an old listener, if you're an ugly listener, if you're a fat listener, if you're a hot
chick especially, email us radio at BinRev.com. Our closing music this week is actually, uh,
one of those viral video type deals, one of those things that people are passing around
YouTube, whatever. It's called Canon Rock by Fun2, F-U-N-T-W-O. And this is actually a remake
or remastery or whatever you want to call it of Canon and D-measure, which is an old, uh,
classical song by Johan Pachelbel, written in the late 1600s, but it's kind of been brought
back here. A couple people have made some guitar versions of it and distributed them out on YouTube
and other similar sites, which was just bought by Google. We're not going to talk about that.
My good friend's Google. Uh, and this was posted in our forums by Right Coast is why it came to my
attention, so I ripped the audio off of that, and that's what we're going to close with. And that
is going to do it. So, uh, Johnny Swank, a.k.a. Captain Rosebud, help me close out the show this
week. I am Buck Dangler telling you that we will see everyone next week. Same prawn time.
Same prawn channel.
Mm-hmm.
.
Thank you.
I was such a cocksucker.
Hey, I don't know if you've heard the stuff that people have been, the remix songs people have been making of me lately using clips from the show where I say I'm a fucking moron.
Oh, they're awesome.
I did hear some of that, actually.
Well, now they're going to use the one where you say I'm a big cocksucker or whatever you just said.
Oh, crap.
Now they're going to use me too.
Damn it.
Like a bitch?
They're going to mix you and I into a song, both of us talking about what huge cocksuckers we are.
And they're going to call it, and they're going to call it, and they're going to call it, and they're going to call it, and they're going to call it Dueling Homos.
Oh, shit, dude.
I'm now scared to ever release this outtake in the wild.
Oh, shit.
I'm now scared to ever release this outtake in the wild.