I feel that, in fairness, one should at least read Adam’s response, though ideally all subsequent mails: https://marc.info/?l=openbsd-misc&m=119320496730314&w=2

Theos is a very opinionated and not necessarily wrong position, but I feel also a bit too reductive given we are eternally having to deal with compromises of some form. Also, lest we forget, it has been two decades in the interim and oh so much has changed. In any case, this originated from their code, not virtualization, so it doesn’t really apply either way…

The bug here is not related to virtualization, but a footgun as old as C stdlib: system() that doesn't take arguments separately, and instead relies on shell escaping by the application.

Looks like this has nothing to do with the hypervisor, it's not a traditional VM escape

Theo is a very insightful guy, but also very opinionated. I think the truth is somewhere in between.

Especially as more and more virtualization functions move into hardware, not using them as a second security barrier seems foolish.

Brutal

I hope when people read this though they understand this is a communication style; they're clearly trying to strongly discourage people from thinking they are suddenly protected. Effective? Maybe at one time, where "macho dev energy" was a thing. Today, not so much. You can tell they mean well because the intro sentence is actually pretty cheeky!

This is less of a virt/x86 bug and more of a "don't call system() on arbitrary user input" bug.

.. incidentally, OpenBSD also provides one of the clearest examples of how the excuse "calling system() is fine in my case, its totally not arbitrary user input" is deluded just the same, see CVE-2020-8794.

All I see is rudeness, insults, and arrogance sparkled with inklings of technical arguments. Worthless.

Peak Theo! This refreshing truth telling has been eradicated in 2026.