Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Oxy – A Security Focused Remote Access Tool

oxy-secure.app

Post reply on HN
Print view View original

41–50 of 88 posts

Re: Oxy – A Security Focused Remote Access Tool

#41

Post by nickik »

LinuxBender wrote: post #37

Interesting! - Does this have the buffer limitations for file transfer that ssh has? i.e. Can I send near wire speed? - Which independent third party pen testing and code validation groups have reviewed this? - Since this does not depend on rsync helpers for file transfers, are there any plans to add multipart transfers similar to lftp's p-get or other mirror sub-system functions? i.e. split a 40gb file into 20 chunk…

U2F would be amazing. I hacked around with adding second factors to openssh and its possible but not great. There was even a hack to do it with U2F.

But to have a ssh like thing that supports U2F out of box would be amazing.

Re: Oxy – A Security Focused Remote Access Tool

#42

Post by akx »

raesene9 wrote: post #5

This is interesting, but shows some of the problems with the word "secure" The app. promises to be more secure than OpenSSH and provides a number of reasons why it thinks it will be. However the site is entirely anonymous, so you have no idea who wrote this tool and what their affiliations or background are. So either you audit the code to get some assurance, or you trust the author(s) without any evidence. Also the…

Re anonymity, the commits at https://github.com/oxy-secure/oxy are by @jennamagius, who seems to be https://twitter.com/jennamagius / https://octodon.social/@jennamagius . Still (probably) pseudonymous, but at least not anonymous.

Re: Oxy – A Security Focused Remote Access Tool

#43

Post by dcbadacd »

nine_k wrote: post #13
jandrese wrote: post #8

Earlier quoted context omitted.

It's a good start, but the problems with SSH lately have largely been things like timing attacks that even the smartest compiler won't catch. In fact a smart optimizing compiler can make that even harder to avoid since it is more difficult to know exactly what machine code it will produce.

I wonder how efficient a counter-measure would be adding small random delays in every part of code, possibly injected at MIR or LLVM level. It might drown any timing information in random noise. They will definitely lower the performance, but likely a bit slower and more secure connection process is preferable to a less secure one.

Making everything fixed-time, no matter how fast, would actually have the needed effect, random noise can be statistically removed.

Re: Oxy – A Security Focused Remote Access Tool

#44

Post by rkeene2 »

nickik wrote: post #41
LinuxBender wrote: post #37

Interesting! - Does this have the buffer limitations for file transfer that ssh has? i.e. Can I send near wire speed? - Which independent third party pen testing and code validation groups have reviewed this? - Since this does not depend on rsync helpers for file transfers, are there any plans to add multipart transfers similar to lftp's p-get or other mirror sub-system functions? i.e. split a 40gb file into 20 chunk…

U2F would be amazing. I hacked around with adding second factors to openssh and its possible but not great. There was even a hack to do it with U2F. But to have a ssh like thing that supports U2F out of box would be amazing.

OpenSSH supports, at the very least, PKCS#11 modules out of the box these days, which can be used with hardware security modules.

Re: Oxy – A Security Focused Remote Access Tool

#45

Post by Spivak »

scandox wrote: post #4

> Years of testing and battle hardening? No, it's super green. But hey, if you try it you'll help make it less green! I’m interested: how long does it take for a piece of critical software like this to gain widespread adoption with a non-shite incumbent?

You pretty much just have to demonstrate the benefits to the maintainers of a few major distros and that it should be the default and the rest will follow to avoid breaking interop.

Two major releases is a safe bet from the time the decision is made so <10 years.

Re: Oxy – A Security Focused Remote Access Tool

#48

Post by scandox »

al3xnull wrote: post #40
tptacek wrote: post #24

Earlier quoted context omitted.

I don't know that you read the definition you just quoted as carefully as you think you did.

The virtue signaling doesn't come off as genuine as you tried to convey it.

If it's virtue signalling to point out a lack of precision then...well...harrumph...etc

Re: Oxy – A Security Focused Remote Access Tool

#49

Post by mxuribe »

elliotpage wrote: post #15

I really enjoy the plain-text website. Bizarre font choices but perhaps the easiest to read site I have seen for a while!

If you meant the font choice for the general text of the website, than that's just whatever default font your web browser has chosen. In essence this website's code has not designated any font choice. So, whenever web browsers are not directed to use a certain font/typeface, they defer to their default font - usually some default system font. This has been the practice of web browsers since the very beginning of the web. As an example, for me on a windows 7 machine using chrome, it displays the font as Times New Roman; other browsers and OS combo might show different system fonts. I hope this helps!

Re: Oxy – A Security Focused Remote Access Tool

#50

Post by CGamesPlay »

snvzz wrote: post #20

>Well how does rsync work, then? rsync relies on executing a non-ssh helper program on the remote. And that's a bad idea why?

It is a "bad idea" in terms of attackable footprint, although I don't think it was being called out as a bad idea in this page, more of clarification that the stated feature really doesn't exist in SSH.
Post reply on HN