Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenBSD 6.0 released

undeadly.org

Post reply on HN
Print view View original

61–70 of 139 posts

Re: OpenBSD 6.0 released

#61

Post by pjmlp »

aruggirello wrote: post #58
agumonkey wrote: post #22

Earlier quoted context omitted.

I only do to enjoy the pleasure of old ways. Interacting with CDs and CD drives reminds me of when it was cutting edge. Tray mechanics, the speed intake of spinning motors. Even the latency and seek sounds. And somehow, the (almost since it's on DVD RW) immutability. In some ways, the sheer speed of SSD is ... boring when you're not in a hurry. ps: a bit like vynil lovers who take their player out for similar reasons…

Reminds me of my old faithful Amiga, and its 3,5" floppy drive...it made a distinct, almost musical sound. You just turned the machine on and that famous splash screen would appear, then the empty drive would start ticking regularly, waiting for an 880Kb disk. As soon as a disk was inserted, you could hear its typical seek noise while the system booted, track after track...

And the famous click of death.

Re: OpenBSD 6.0 released

#62

Post by CraigJPerry »

armitron wrote: post #60
mrb wrote: post #33

"To deter code reuse exploits, rc(8) re-links libc.so on startup, placing the objects in a random order." I love this defense in depth, buried in the release notes... https://www.openbsd.org/60.html

This is pretty much useless. Attackers have moved on to using information leaks in order to determine memory layout and placement of objects. So in practice, this doesn't really deter anything. Information leaks are everywhere.

I don't know why you're being down voted. We've had ASLR in Linux for years and various attacks have been successful.

The string format attack is the one I remember most clearly which basically renders ASLR useless.

Re: OpenBSD 6.0 released

#63

Post by nanolith »

pedrocr wrote: post #36
zzzcpan wrote: post #35

Talking about security, I'm hoping for a bound-checking memory-safe C compiler to eventually made it into something like OpenBSD or FreeBSD and be used by default for all ports and packages. Almost no software there would suffer from the overhead, and OpenBSD doesn't even promise or try to be very fast, it's a perfect place for it.

Is a "bound-checking memory-safe C compiler" even possible in the general case without implementing a new Rust-like language?

Yes. But, you typically have to use a theorem prover to build up static checking for functions, and then enforce proof obligations on callers to said functions. If done in a system like Coq or Isabelle, the proof obligations become a parallel markup to C that is used in conjunction with the source code to enforce policies. Bounds checking is one policy -- and a relatively easy one to implement at that -- and other policies can be stacked.

Take a look at VST for an example already in the wild. I'm currently working on a somewhat different approach that does not have the severe license restrictions that CompCert has.

http://vst.cs.princeton.edu/download/

Re: OpenBSD 6.0 released

#64

Post by jimktrains2 »

ue_ wrote: post #6
jasonkostempski wrote: post #3

Earlier quoted context omitted.

It does? I was under the impression the only reason anyone still did that was to give something physical to donators.

Perhaps I'm the only person using computers in 2016 who only installs OpenBSD via CD :-)

The last couple installs of any OS I've done have been a few off of USB and the rest off PXE.

Re: OpenBSD 6.0 released

#65

Post by [deleted] »

mrb wrote: post #33

"To deter code reuse exploits, rc(8) re-links libc.so on startup, placing the objects in a random order." I love this defense in depth, buried in the release notes... https://www.openbsd.org/60.html

[deleted]

Re: OpenBSD 6.0 released

#66

Post by peatmoss »

Johnny_Brahms wrote: post #45

For those of you who are looking at a reason to play around with openBSD, there might be some progress at getting it to run at the Raspberry pi 2 and 3: http://marc.info/?l=openbsd-cvs&m=147059203101111&w=2 Probably not going to happen, but it runs on some other ARM7 SBCs. Mine is running FreeBSD currently, but where is the geek cred in that?

I've wondered about OpenBSD on the NTC CHIP computer. I have one that I haven't quite gotten around to doing anything with that I'd love to OpenBSD-ify.

Re: OpenBSD 6.0 released

#67

Post by willvarfar »

dmm wrote: post #43
willvarfar wrote: post #28

Earlier quoted context omitted.

So they should create a writeable mmapping, write the code into it, then change it to W^X using mprotect? How does this stop an attacker doing the same via ROP? ADDED: The approach that comes to my mind is that they could have two processes. One process has the sourcecode, and pages where it can write code. The other process can execute the code. The code updates performance counters which the JITing process can read…

> How does this stop an attacker doing the same via ROP? Wait, isn't that backwards? Doesn't the use of W^X necessitate the use of ROP? Right now a JIT has lots of memory that is W&X so you just need a memory exploit to inject some code and then find a way to jump to it, no need for ROP. But if you implement W^X this won't work because now you can't inject code with just a memory exploit, you also have to set it to e…

Forgive me for dreaming of a world where CPI or other approaches close the ROP vector too :)

Re: OpenBSD 6.0 released

#68

Post by gkya »

CraigJPerry wrote: post #62
armitron wrote: post #60

Earlier quoted context omitted.

This is pretty much useless. Attackers have moved on to using information leaks in order to determine memory layout and placement of objects. So in practice, this doesn't really deter anything. Information leaks are everywhere.

I don't know why you're being down voted. We've had ASLR in Linux for years and various attacks have been successful. The string format attack is the one I remember most clearly which basically renders ASLR useless.

Obviously it's not useless. Not all attackers have agreed collectively to use differents methods. Also, if it leaks in multiple points, it's better to start from a hole instead of letting it all go before finding a patch big enough for all.

Re: OpenBSD 6.0 released

#69

Post by 20yrs_no_equity »

I love BSD and would like to use it, but we're kinda in a Linux world.

Question: If I am building a custom hardware device (and we will be in the future, I believe) can we run OpenBSD on it using the ARM port, but also invoke binaries created for linux?

It appears that support was removed.

In the near term I need to build for Linux, But eventually we'll be able to target our own hardware, and one of our toolchain items doesn't support BSD right now (and is closed source, though we are considering an open source alternative.)

Any thoughts?

Re: OpenBSD 6.0 released

#70

Post by olp2 »

nn3 wrote: post #46

It's good that they have their priorities straight. No more Linux binaries support (who need compatibility anyways?), but instead you get 5 songs sung by the project leader.

Only the "Goodbye" song is sung by Theo de Raadt.
Post reply on HN