Yes, both of you are exactly right.
A Windows environment running in VM is the same as any other Windows environment, and can be subject to the same vulnerabilities.
However, it's much less likely to be problematic for the following reasons:
- The entire environment is "sandboxed", network-wise, within the host OS's networking. Most Windows XP installations will now be behind the integrated software firewall anyway, but this is just another layer of protection: it's essentially like being behind a NAT router.
- A virtual machine environment, being secondary to the primary environment, is typically only used for targeted tasks, not routinely used for things like web browsing, email, and downloading - the major vectors of infection for much spyware/malware
- Since the virtual machine's disk is just a file on the host OS's drive, it can be immediately trashed and restored from a known-good pristine backup in seconds
- If no filesystem sharing is done via the VM between the Windows environment and the host (Mac OS X) environment, there is no[1] way that even severe malware within the Windows environment can cause any damage to the Mac OS X environment
- If filesystems are shared, e.g., a folder on the Mac side is shared as a drive letter on the Windows side, any malware that alters filesystems could theoretically alter the shared filesystem. If a virus, for example, attempted to delete all files on drives other than C:, that would be affected. But, 1.) Most malware doesn't just arbitrarily delete files, because its goal is to spread itself, and 2.) ONLY files that are shared could even theoretically be affected. Also, Windows malware will typically target Windows OS features and filesystem elements. But if you really are paranoid and want to be safe, you probably wouldn't want to, say, share your entire Mac OS X volume as a drive letter into the PC environment.
The bottom line is that from a technical and practical usage standpoint, running Windows in a VM is probably the safest possible way to run Windows, and there aren't really any ways, except for very specific ways via the explicit filesystem sharing, that anything that happens in the Windows environment can even touch your Mac OS X installation. And even if something went horribly wrong in your Windows environment, you can just trash the file that represents it on the Mac side of things, and replace it with your most recent and/or pristine backup of that file.
You guys, and many, many others, are going to *love* virtualization on Mac OS X on Intel-based Macs: running other x86 OSes - Linux, Windows, FreeBSD, etc., at near-native speed of the hardware - right along side Mac OS X, instantly able to switch back and forth.
[1] Sure, you could argue that someone could make Windows malware that specifically also targets an unknown vulnerability in a particular piece of virtual machine software, thereby somehow gaining access to the host side. But that is *extremely* unlikely to the point that it's not even worth mentioning.
---
Dave Schroeder
University of Wisconsin - Madison
das@doit.wisc.edu
http://das.doit.wisc.edu
