Viewing profile — notaplumber1

> I will say, though, that single VCPU guests would not have met our immediate needs in the Oxide product! Could Oxide not have helped push multi-vcpu guests out the door by sponso…

OpenBSD developers are making a serious effort to kill off indirect syscalls, the base system is completely clean, take a look at the work Andrew Fresh did to adapt Perl. He wrote …

OpenBSD disables jump tables in Clang on amd64 due to IBT, some architectures also had jump tables disabled as part of the switch to --execute-only ("xonly") binaries by default, e…

All of those are examples of privilege seperated software imported from OpenBSD, pf and thus pflogd(8), dhclient(8) and yplapd(8). https://www.openbsd.org/innovations.html

Won't help you with Docker containers, but OpenBSD/arm64 will run OOTB on the MS Dev Kit, NVMe works, USB-3 works, 2.5Gbe Realtek NIC is supported by the ure(4) driver. The ath11k …

I didn't say it wasn't a problem. I said it was not the problem here. Important distinction. Licensing is not the reason for the sanitizers not being enabled in the default build, …

I'm pretty sure parsing ELF binaries is out of scope for kdump(1), sorry, but I don't think that's going to happen. It's not that difficult to run addr2line yourself with the infor…

OpenBSD begrudgingly made an exception for LLVM/Clang, after vocal opposition to the re-licencing. It currently uses LLVM/Clang 13 and has been making progress towards 15. Licensin…

Are you asking why doesn't it execv(2) addr2line deep within the libc malloc implementation? Because calling execv(2) within libraries is frowned upon.. ;-) The leak report is bein…

Dragos Ruiu (@dragosr) also provided the video recording on his Twitter account. https://twitter.com/dragosr/status/1639015014177841153

OpenSSH developers documented some issues they found with PAM, in implementation and design. https://www.dtucker.net/pam/ BSD Authentication is much nicer, but has only been adopte…

Additional context, and status about recent developments in OpenBSD. BROP: https://www.scs.stanford.edu/brop/ (paper "Hacking Blind" (2014): https://www.scs.stanford.edu/brop/bitta…

I will agree that you have chosen your words carefully, and with obvious intent.

> I'd argue that things like msyscall and mstack don't at all because they cost attackers only a couple of minutes of time once to develop a bypass technique (ie move the stack poi…

> As others have mentioned as well using ROP to jump to the syscall instructions in libc with your own arguments (it’s not special…) bypasses restrictions in the current design. ..…

If you look at the mitigations OpenBSD is doing as attack surface reduction, it means ultimately fewer tools in the attackers toolbox. It seems many of you are missing the forest f…

> But using it to prevent the introduction of new code is not all that effective, unless you are far more stringent about how you allow processes to allocate executable regions. Fo…

Apologies, I was pointing out the commit message itself rather than the contents of the commit, it's indeed full of magic numbers. It's reverse engineered, there are no docs from Q…

Appreciate the additional context. It does seem like though a lot of magic is contained in the Qualcomm Windows drivers, with large parts of the ACPI tables being stubs or broken (…

I believe the Samsung Galaxy Book Go was tested with OpenBSD during the initial development for the ThinkPad x13s, keyboard support was added in this commit. https://github.com/ope…