31–40 of 43 posts
HardenedBSD no longer uses LibreSSL, they switched back to OpenSSL in April. https://hardenedbsd.org/article/shawn-webb/2018-04-30/harden...
> Restrictions on mprotect to prevent switching pages between writable and executable. No JIT then? I could see a locked down server process wanting to drop access to this, but I feel like it's unreasonable to have on by default. (Also looking at you, Apple.)
I would advise taking any claims from HardenedBSD about HardenerBSD with a huge grain of salt. The main code author behind HBSD has a history of his patches to FreeBSD being rejected due to very poor implementation, coding errors, poor quality and not understanding OS and security features design and reasoning and not accepting their reviews and not listening to his peers. He is however very good at getting himself a…
Random number generation, including arc4random() and /dev/*random: OpenBSD: ChaCha20 FreeBSD: RC4 NetBSD: NIST CTR_DRBG using AES-128 HardenedBSD: ? Dragonfly BSD: xor of outputs ChaCha20 and IBAA Also on OpenBSD, major 3rd party packages often come with security improvements. For example, nginx and Apache run chrooted, and Chrome is pledged. I don't have the time to analyze privsep in base among the BSDs, but I can…
Kernel random (read_random_uio(9) / sysctl kern.arandom / /dev/*random / getrandom(2) / getentropy(3)) has been Fortuna since v10, and Yarrow before that.
> Restrictions on mprotect to prevent switching pages between writable and executable. No JIT then? I could see a locked down server process wanting to drop access to this, but I feel like it's unreasonable to have on by default. (Also looking at you, Apple.)
https://github.com/HardenedBSD/secadm-rules/blob/master/fire...
I've never heard of HardenedBSD before. I thought OpenBSD was generally considered the best choice for serious security, but I'd be interesting in reading up more on how they compare. As someone that's not an expert on the subject, it would help to get some extra info that explains why certain features are useful for improving security. It's not clear that all these features impact real-world security, but maybe I'm…
Because people need things other than security to actually do useful things with computers :)
- more ports
- more features (ZFS, DTrace, Jails, RCTL/RACCT, netgraph, Capsicum, CloudABI, Linuxulator)
- more drivers (lots of >=10GbE NICs, AMD GPUs, evdev for input devices)
- more SMP scalability (even NUMA work is ongoing on FreeBSD, while OpenBSD still has lots of things under giant lock AFAIK)
Hmm no DragonflyBSD
No insult to the BSDs, but running a less popular OS can help too.
"Adobe's Flash plugin is distributed in binary form only, and they do not provide a native OpenBSD version. Considering their security record, we thank them for this neglect." - https://www.openbsd.org/faq/faq13.html#plugins
Earlier quoted context omitted.
What other shortcomings are missing from the list?
Regular code reviews like what the OpenBSD folks do. Also, they appear to be back on OpenSSL again[0], and not using LibreSSL like the list claims. If they can't even accurately reflect which SSL library they are using, what else on the list is incorrect? 0. https://hardenedbsd.org/article/shawn-webb/2018-04-30/harden...
Any actual features that support your cynicism?
Hmm no DragonflyBSD
would probably need to add special list entries for how far behind dragonflybsd is.
I just finished setting up a number of simple dev/test environments for a simple jdk8-based backed service, on DragonFly 5.2.2, using default DF configs. So wanted to understand what I might need to look for hardening (I am still rather far from production, though) ).