Why would you ever trust something like this that will helpfully pull images from the internet? I'm sure whomever is running it today is perfectly honest and none of their computers have been compromised, but there's no reason to expect it to stay that way, is there?
Firewalling the application so that only local images are available seems like the only safe way to use this.
> Why would you ever trust something like this that will helpfully pull images from the internet?
How is that different than pulling an ISO image of your favorite distro, or using a package manager like apt?
Yes, I know that Linux ISOs have checksums and apt uses digital signatures, but so does iPXE. The only difference here would be that for some reason you trust the websites of your Linux distro vendor, but not netboot.xyz?
just because you're one of today's lucky 10,000, that shouldn't impugne the project. It's been around since 2016. if you need verified boot, you'd not be using this in the first place.
> you trust the websites of your Linux distro vendor, but not netboot.xyz
Well... yeah... that's not that crazy of a position to take.
Not saying there's anything wrong with netboot.xyz, but it's a question of how many cooks to let in the kitchen, and how many public eyes are on each cook.
If I read the the docs correctly, since source locations are printer, it’s about as trustworthy as trusting “wget $ISO_URL” on your installation to not download anything malicious. Unfortunately what seems to be missing is a hash check after the fact - a missed opportunity since images are loaded to RAM anyway.
(The limitation here is that you have to be able to load the installer image into RAM, which does exclude a lot of smaller nettop/thin/SoC clients unfortunately.)
Firewalling the application so that only local images are available seems like the only safe way to use this.