Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HardenedBSD: Feature comparison vs other BSD distros

hardenedbsd.org

Post reply on HN
Print view View original

21–30 of 43 posts

Re: HardenedBSD: Feature comparison vs other BSD distros

#21

Post by Panino »

Random number generation, including arc4random() and /dev/*random:

  OpenBSD: ChaCha20
  FreeBSD: RC4
  NetBSD: NIST CTR_DRBG using AES-128
  HardenedBSD: ?
  Dragonfly BSD: xor of outputs ChaCha20 and IBAA
Also on OpenBSD, major 3rd party packages often come with security improvements. For example, nginx and Apache run chrooted, and Chrome is pledged.

I don't have the time to analyze privsep in base among the BSDs, but I can say it's extensive in OpenBSD.

I would love to see pledge support in HardenedBSD. I think they're doing good work. Hopefully FreeBSD can import some of it.

Also, Dragonfly is a first-class BSD citizen and should be included in comparisons. As a recent example, the project leader, Matthew Dillon, has done excellent work relating to Speculative Execution and collaborated with other BSDs which helped everyone. Also I'm pretty sure OpenBSD has imported a number of hardware drivers from Dragonfly.

Re: HardenedBSD: Feature comparison vs other BSD distros

#22

Post by Ensorceled »

craftyguy wrote: post #19
Ensorceled wrote: post #7

Kudos on a list where features HardenedBSD doesn't have but others (OpenBSD) do are also listed. Recently I've become accustomed to seeing overly tuned feature lists where the product in question has, apparently, all the things you could want.

Well, this does have an overwhelming number of 'the things you could want'. This serves the same purpose, while attempting to appear more credible by showing a tiny handful of shortcomings in an attempt to convince the reader that you can trust them.

What other shortcomings are missing from the list?

Re: HardenedBSD: Feature comparison vs other BSD distros

#23

Post by 4ad »

asveikau wrote: post #18
4ad wrote: post #10

Earlier quoted context omitted.

Unfortunately, OpenBSD normally requires booting into a special kernel for upgrading unless you do this: https://www.openbsd.org/faq/upgrade63.html#NoInstKern . This really makes it hard to use on AWS.

I agree it is tedious, however, I have found it is pretty simple to put those instructions in a shell script and use it across multiple machines.

My problem is not that it is tedious, but that it is not a recommended configuration. Stuff might break, it's much less tested, etc.

Re: HardenedBSD: Feature comparison vs other BSD distros

#24

Post by craftyguy »

Ensorceled wrote: post #22
craftyguy wrote: post #19

Earlier quoted context omitted.

Well, this does have an overwhelming number of 'the things you could want'. This serves the same purpose, while attempting to appear more credible by showing a tiny handful of shortcomings in an attempt to convince the reader that you can trust them.

What other shortcomings are missing from the list?

Regular code reviews like what the OpenBSD folks do. Also, they appear to be back on OpenSSL again[0], and not using LibreSSL like the list claims. If they can't even accurately reflect which SSL library they are using, what else on the list is incorrect?

0. https://hardenedbsd.org/article/shawn-webb/2018-04-30/harden...

Re: HardenedBSD: Feature comparison vs other BSD distros

#25

Post by krylon »

petee wrote: post #4
TheAceOfHearts wrote: post #3

I've never heard of HardenedBSD before. I thought OpenBSD was generally considered the best choice for serious security, but I'd be interesting in reading up more on how they compare. As someone that's not an expert on the subject, it would help to get some extra info that explains why certain features are useful for improving security. It's not clear that all these features impact real-world security, but maybe I'm…

Not only sandboxed, but many are pledge(2) 'd now also. One downside with OpenBSD is the result of lacking resources - they only support the latest 2 releases (one every 6mo) with only the most critical patches being back ported. I don't believe syspatch(8) changes this, although its certainly easier to apply kernel patches now (please correct me if I'm mistaken) Same with packages - unless you use mTier to get binar…

> Not only sandboxed, but many are pledge(2)'d now also.

And here I was thinking that pledge(2) was the sandbox. Did I miss something?

Re: HardenedBSD: Feature comparison vs other BSD distros

#26

Post by textmode »

Panino wrote: post #21

Random number generation, including arc4random() and /dev/*random: OpenBSD: ChaCha20 FreeBSD: RC4 NetBSD: NIST CTR_DRBG using AES-128 HardenedBSD: ? Dragonfly BSD: xor of outputs ChaCha20 and IBAA Also on OpenBSD, major 3rd party packages often come with security improvements. For example, nginx and Apache run chrooted, and Chrome is pledged. I don't have the time to analyze privsep in base among the BSDs, but I can…

The table in the parent comment lacks versions.

If I am not mistaken, NetBSD uses ChaCha20 since 2015.

https://github.com/NetBSD/src/blob/trunk/lib/libc/gen/arc4ra...

Re: HardenedBSD: Feature comparison vs other BSD distros

#27

Post by tachion »

I would advise taking any claims from HardenedBSD about HardenerBSD with a huge grain of salt. The main code author behind HBSD has a history of his patches to FreeBSD being rejected due to very poor implementation, coding errors, poor quality and not understanding OS and security features design and reasoning and not accepting their reviews and not listening to his peers. He is however very good at getting himself and HBSD a lot of PR attention for bold security claims, but has a very poor record when it comes to quality code.

This list is also not very accurate either: his ASLR patches to FreeBSD were rejected due to quality issues, then they were applied to HBSD. The lack of mark for base sandboxing is another one, where FreeBSD had Capsicum sandbox available for few years now and a lot of base is now Capsicum sandboxed, with more and more coming with every release. I could go on here, but that should give you the picture.

Take this advice with grain of salt as well - I'm a FreeBSD developer, so I might be biased.

Re: HardenedBSD: Feature comparison vs other BSD distros

#28

Post by Panino »

textmode wrote: post #26
Panino wrote: post #21

Random number generation, including arc4random() and /dev/*random: OpenBSD: ChaCha20 FreeBSD: RC4 NetBSD: NIST CTR_DRBG using AES-128 HardenedBSD: ? Dragonfly BSD: xor of outputs ChaCha20 and IBAA Also on OpenBSD, major 3rd party packages often come with security improvements. For example, nginx and Apache run chrooted, and Chrome is pledged. I don't have the time to analyze privsep in base among the BSDs, but I can…

The table in the parent comment lacks versions. If I am not mistaken, NetBSD uses ChaCha20 since 2015. https://github.com/NetBSD/src/blob/trunk/lib/libc/gen/arc4ra...

Thank you for the correction! I only looked at NetBSD's random(4) manual page:

http://netbsd.gw.com/cgi-bin/man-cgi?random+4+NetBSD-current

So NetBSD uses AES-128 in /dev/*random and ChaCha20 in arc4random(). I wonder why?

Re: HardenedBSD: Feature comparison vs other BSD distros

#29

Post by lattera »

Panino wrote: post #21

Random number generation, including arc4random() and /dev/*random: OpenBSD: ChaCha20 FreeBSD: RC4 NetBSD: NIST CTR_DRBG using AES-128 HardenedBSD: ? Dragonfly BSD: xor of outputs ChaCha20 and IBAA Also on OpenBSD, major 3rd party packages often come with security improvements. For example, nginx and Apache run chrooted, and Chrome is pledged. I don't have the time to analyze privsep in base among the BSDs, but I can…

HardenedBSD currently follows upstream FreeBSD with regards to in-kernel crypto.

Re: HardenedBSD: Feature comparison vs other BSD distros

#30

Post by lattera »

craftyguy wrote: post #24
Ensorceled wrote: post #22

Earlier quoted context omitted.

What other shortcomings are missing from the list?

Regular code reviews like what the OpenBSD folks do. Also, they appear to be back on OpenSSL again[0], and not using LibreSSL like the list claims. If they can't even accurately reflect which SSL library they are using, what else on the list is incorrect? 0. https://hardenedbsd.org/article/shawn-webb/2018-04-30/harden...

HardenedBSD still uses LibreSSL in base. The switch back to OpenSSL will be on 01 July 2018, as mentioned in the article you linked to.
Post reply on HN