Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why OpenBSD Is Important to Me

ggr.com

Post reply on HN
Print view View original

31–40 of 162 posts

Re: Why OpenBSD Is Important to Me

#31

Post by creshal »

peatmoss wrote: post #10
executesorder66 wrote: post #2

I'm curious why the author says Linux is "insecure, anti-secure, and anti-privacy software" Can anyone explain this? Also, why OpenBSD specifically, and not FreeBSD for example?

I think this line was meant mainly to refer to his closed source iPhone, OS X, and Windows use. Perhaps he means his Linux usage is one of the more mainstream distributions that readily facilitates installation of binary kernel blobs (e.g. wifi, video), or 3rd party closed source software. He may also be calling Linux insecure due to it being less uncompromisingly about security. Same could be said about FreeBSD--the…

> OpenBSD invests a great deal here. They have their own fork of Xorg (or was that XFree86?) that runs not as root. As far as I know that's unique amongst libre *nixen.

It's a standard feature of Xorg nowadays, but it's only a feature of vanilla Xorg for a few years.

Re: Why OpenBSD Is Important to Me

#32

Post by akerro »

mulander wrote: post #4
executesorder66 wrote: post #2

I'm curious why the author says Linux is "insecure, anti-secure, and anti-privacy software" Can anyone explain this? Also, why OpenBSD specifically, and not FreeBSD for example?

FreeBSD is pretty anti-secure too. https://vez.mrsk.me/freebsd-defaults.txt

Also this: http://networkfilter.blogspot.com/2014/12/security-openbsd-v...

Re: Why OpenBSD Is Important to Me

#34

Post by protomyth »

madars wrote: post #12
jayofdoom wrote: post #9

Probably worth noting as well how many software products OpenBSD has contributed back to the overall free software world; things like OpenSSH, (edit: NOT OpenSSL), a more secure ntpd and inetd. Even if you don't run OpenBSD, you benefit from it.

> how many software products OpenBSD has contributed back to the overall free software world; things like OpenSSH, OpenSSL, a more secure ntpd and inetd One of them is not like the others -- OpenSSL is not an OpenBSD project and the code quality is markedly different :-)

perhaps jayofdoom meant LibreSSL.

and yes, OpenSSL is a bit of a code quality difference than the OpenBSD norm.

Re: Why OpenBSD Is Important to Me

#35

Post by notaplumber »

tptacek wrote: post #30
notaplumber wrote: post #25

Earlier quoted context omitted.

No loadable kernel modules for OpenBSD either.

Not having a formal kernel module system does not actually mean the kernel is secure. Exploits to create module loading systems out of kernel vulnerabilities are approximately as old as stack overflow exploits.

NX enforced kernel W^X, SMEP/SMAP, always-on stack protector and a limited attack surface (..say, from pledge(2)), only serve to make such theoretical attacks impractical against OpenBSD.

Re: Why OpenBSD Is Important to Me

#36

Post by deprave »

leaveyou wrote: post #26

I wanted multiple times to study the OpenBSD source code and I've downloaded it but I never managed to navigate through it, to find the "head and the tail" or to find a reasonable "map" of the source code. I would like for example to follow the execution path in the source code, from the boot up to the login prompt. Does any documentation like this exist or could anyone give me some hints ? Thanks

There are three parts in this sequence:

1. Boot up - this is very machine-dependent ("MD") so you'll find it in each architecture's source code. Look for files named "locore.s" or "locore.S" in places like src/sys/i386/i386.

2. Kernel - the machine-independent ("MI") part, or where the fun begins... this is in src/sys/kern/init_main.c, look for the function main(). You'll see the different subsystems initialized, from the lowest level (auto configuration of hardware devices and console initialization) through fundamental subsystems (virtual memory, disk, network, processes, etc.), all the way to the scheduler. The scheduler will only have one process to work with (PID 1) which is init (src/sbin/init), so that's what gets executed.

3. Userland - /sbin/init is the first process that runs, and it takes care of running everything else, like daemons and eventually your login prompt. Your points of interest in init.c are runetcrc(), read_ttys(), and multi_user().

Re: Why OpenBSD Is Important to Me

#37

Post by symtos »

executesorder66 wrote: post #2

I'm curious why the author says Linux is "insecure, anti-secure, and anti-privacy software" Can anyone explain this? Also, why OpenBSD specifically, and not FreeBSD for example?

why not freebsd? the freebsd project seem to focus exclusively on post-attack with jails and trustedbsd mac. fbsd has not implemented any of the modern exploit mitigation techniques. i mean, even os x has had full aslr since 2012 lol.

some years ago fbsd was forked to hardenedbsd which has aslr, mprotect restrictions, non-exec pages on cpus w/o NX, randomized lib loading order, etc. i guess the freebsd project is too busy fighting meritocracy cus none of it has been merged as far as i can tell.

as for linux, plenty has been written on linus' stance on what he considers to be a "security circus"; and the mantra on lkml is still that "a bug is a bug". just watch oss-sec and see distro people wading through kernel commit logs (hyperbole) cus sec-related bugs usually aren't reported downstream

Re: Why OpenBSD Is Important to Me

#38

Post by tptacek »

notaplumber wrote: post #35
tptacek wrote: post #30

Earlier quoted context omitted.

Not having a formal kernel module system does not actually mean the kernel is secure. Exploits to create module loading systems out of kernel vulnerabilities are approximately as old as stack overflow exploits.

NX enforced kernel W^X, SMEP/SMAP, always-on stack protector and a limited attack surface (..say, from pledge(2)), only serve to make such theoretical attacks impractical against OpenBSD.

No. Those are useful countermeasures, but kernel exploits for OpenBSD are neither theoretical nor impractical.

Re: Why OpenBSD Is Important to Me

#39

Post by Santosh83 »

creshal wrote: post #31
peatmoss wrote: post #10

Earlier quoted context omitted.

I think this line was meant mainly to refer to his closed source iPhone, OS X, and Windows use. Perhaps he means his Linux usage is one of the more mainstream distributions that readily facilitates installation of binary kernel blobs (e.g. wifi, video), or 3rd party closed source software. He may also be calling Linux insecure due to it being less uncompromisingly about security. Same could be said about FreeBSD--the…

> OpenBSD invests a great deal here. They have their own fork of Xorg (or was that XFree86?) that runs not as root. As far as I know that's unique amongst libre *nixen. It's a standard feature of Xorg nowadays, but it's only a feature of vanilla Xorg for a few years.

I'm probably misunderstanding something but on my system (Ubuntu 14.04 LTS) the X server runs as root & not as my user.

Re: Why OpenBSD Is Important to Me

#40

Post by nickpsecurity »

cisstrd wrote: post #29

I am an OpenBSD user, there is no OS I'd rather use currently (obviously) and I am sure there is no OS with a greater focus on security and clean code, the project as a whole deserves a great deal of respect and admiration for setting the bar when it comes to security, and for being the originator of great products that are used outside the boundaries of OpenBSD itself, however (with all due respect) what the author…

"As you have guessed by now I am some kind of allergic to this... those idealistic over-simplifications... drawing everything in black and white..."

I avoid oversimplifications, too. Yet, most of what the author wrote was proven by precedent. Only grip I have is calling Linux anti-security and anti-privacy given how much good work in those used the platform. Gotta be a kernel by kernel and distro by distro judgment on that. Rest seems accurate.

"Some of the OS X users I know are incredible technology-orientated and privacy concerned people, should I draw the conclusion they are being overly naive by not using OpenBSD for everything?"

The conclusion is that they prefer to use OS X. That simple. Far as its security, it's made by a company that spent a long time lying to its users that they were immune to malware because Mac's were just inherently secure. They added lots of mitigations sometimes 10 years behind Windows and UNIX per one firm. I recall one vulnerability where an administrative service required a username and password for log-in but didn't check it against database. If you entered any password, you got in.

Such a history of absolutely, terrible security plus deception of customers means Apple products shouldn't be trusted for security by default. Any "privacy concerned people" using it are making a foolish mistake or intentionally trading away privacy for some other benefit.

Now, what you just saw me do was the evidence-based approach to these things. Helps cut through the noise nicely.

Post reply on HN