Why OpenBSD Is Important to Me • Hacker News Board

Re: Why OpenBSD Is Important to Me

#101

Post by gkya » Mon, May 09, 2016, 8:36 PM UTC

dijit wrote: post #97

gkya wrote: post #70

Earlier quoted context omitted.

I'm 23, I used GNU/Linux since I was 11, and about at the beginning of this year (2016) I switched to FreeBSD. It was the first time I had an easily and consistently configurable, recreatable, understandable, enjoyable PC system that went out of the way once configured. It is so pleasurable that I don't even care I can't suspend and hibernate yet, even though I'd hardly turn of my computer and my workflow used to rel…

FWIW I did what you did, Linux -> FreeBSD, but when I moved "further" away from linux-land and went to openbsd I was surprised at how much more polished things are. My laptop (thinkpad X201s) used to idle very rough under FreeBSD and suspend didn't work, but under openbsd it did. Also there were some hardware drivers which appeared not to work at first but running 'fw_update' caused openbsd to download the device dri…

Well if only I could run OpenBSD on my X51RL... That is, it runs fine, but my wifi card doesn't work. I actually just asked a question on /r/openbsd about that: https://www.reddit.com/r/openbsd/comments/4ilko3/drivers_con... Hope to get some helpful answers there, the case with ath5k is so complicated, reading mailing list and glimpsing over the related C files (I know little C and no hardware) didn't provide any info.

Re: Why OpenBSD Is Important to Me

#102

Post by symtos » Mon, May 09, 2016, 8:36 PM UTC

corv wrote: post #94

symtos wrote: post #37

Earlier quoted context omitted.

why not freebsd? the freebsd project seem to focus exclusively on post-attack with jails and trustedbsd mac. fbsd has not implemented any of the modern exploit mitigation techniques. i mean, even os x has had full aslr since 2012 lol. some years ago fbsd was forked to hardenedbsd which has aslr, mprotect restrictions, non-exec pages on cpus w/o NX, randomized lib loading order, etc. i guess the freebsd project is too…

FreeBSD has ASLR. https://wiki.freebsd.org/AddressSpaceLayoutRandomization

no. did you read the first paragraph?

> FreeBSD lacks basic low-level exploit mitigation, such as Address Space Layout Randomization (ASLR)

the whitepaper you linked was published in 2014 by Shawn Webb, one of the people behind the hardenedbsd fork. that same year a submission for review was opened on phabricator[1] re. merging their aslr work in mainline fbsd.

it was closed on 2015-10-19:

> Closing this revision. FreeBSD is free to pull from HardenedBSD.

another aslr review request was then created on 2016-03-10 by Konstantin Belousov[2]:

> This revision needs review, but there are no reviewers specified.

that same day he sent a call for testing to freebsd-arch[3].

there is also a bugzilla ticket[4] for the people waiting for freebsd to catch up with 2001.

1: https://reviews.freebsd.org/D473

2: https://reviews.freebsd.org/D5603

3: https://lists.freebsd.org/pipermail/freebsd-arch/2016-March/...

4: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=181497

Re: Why OpenBSD Is Important to Me

#103

Post by [deleted] » Mon, May 09, 2016, 9:04 PM UTC

vox_mollis wrote: post #20

dijit wrote: post #18

Earlier quoted context omitted.

it's not just that though, there's the push for systemd which was not welcomed and alienated a lot of sysadmin folk who frequent hackernews. personally I felt rather shafted by systemd, not because it's bad, but because my arguments were never even met, it was just a brushing off from some of the people who had already accepted it. So I tried the BSD's and they were significantly better than I imagined they would be,…

Indeed. If systemd were just a parallelized init system with better unit management, far more would be okay with this shift. But that wasn't enough. They had to hijack bootloading, logging, device management, network, etc. For reasons that nobody seems to be able to actually explicate.

[deleted]

Re: Why OpenBSD Is Important to Me

#104

Post by PhantomGremlin » Mon, May 09, 2016, 9:06 PM UTC

tptacek wrote: post #71

PhantomGremlin wrote: post #59

Earlier quoted context omitted.

I'm not sure why tptacek was downvoted here Maybe because his comment had the tone of: "For this, I have found a truly wonderful proof, but the margin is too small to contain it."

Do you need a "truly wonderful proof" for "the mainstream OS OpenBSD has not managed to render kernel vulnerabilities unexploitable, or to rid itself of those vulnerabilities entirely"? Because: that's an extraordinary claim for an OpenBSD supporter to make.

I was not responding to "the mainstream OS OpenBSD ...". Let's go back to your remark, which preceded his:

kernel exploits for OpenBSD are neither theoretical nor impractical.

You put that out there as a bare, standalone statement. No elaboration, no proof.

Your comment might be true, but I would have liked to see some more "meat" in it. Some supporting evidence, some inkling of a truly wonderful proof.

Re: Why OpenBSD Is Important to Me

#105

Post by dpv » Mon, May 09, 2016, 9:21 PM UTC

JoachimSchipper wrote: post #55

oarsinsync wrote: post #27

Earlier quoted context omitted.

Can you elaborate on what the alternatives are? The more we all know, the better!

For any Linux distro, applying the grsecurity patchset will make your box more secure. RHEL (and thus, CentOS) does a pretty good job of configuring and enabling SELinux for packaged software. There is a Hardened Gentoo. All the fun of normal Gentoo, but with fewer companions to find the compiler bugs. ;-) Still, they've built quite a stack of security patches, including grsecurity. There is (used to be?) Hardened Li…

The bad thing is there's hardly a generic "more secure" switch.

> applying the grsecurity patchset will make your box more secure.

It also might not. Correct me if I'm wrong, but while grsecurity does a good job in kernel hardening, it won't protect from attacks like recent imagemagick system() injections, or from something like wordpress exploits, where you don't necessary touch kernel space or even binaries at all -- so it might be possible to have grsec enabled system and still be part of a botnet, or leak user data.

> enabling SELinux for packaged software.

This is a double edged sword also. Good thing is that a lot of software does have SELinux policies for it. Bad thing is that a lot of software runs in unconfined domain and that can give a false sense of security. For instance, if I recall correctly, systemd runs unconfined, while being itself a a) rapidly changing and b) half a million plus LOC software. And to err is human, you know -- SELinux won't "contain the bomb as it goes off" in unconfined domain.

Another example of bad approach with SELinux would be grepping for something in the audit.log and making policy module, which is even recommended in the official docs [1]. I do understand that its a major PITA to find good balance between convenience and security, but this particular example trains users bad practice from the start. Its worse than dismissing UACs -- its as bad as grepping for dropped packets in firewall logs and autocreating permissive firewall rules. Attacker calls her rootkit "yoursoftware.sh", tries needed functionality so that denials appear in audit.log, waits until sysadmin greps for "yoursoftware" and voila -- SELinux is perfectly ok and silent with rootkit. Its simplified, but you get the idea.

> Hardened Linux From Scratch. Educational, but not practical.

If we disable unconfined domain -- and hence be forced to formalize literally every syscall in our access matrix -- then any MAC system also can be called unpractical.

I think every statement of a "Use X its more secure" kind is very dangerous, unless you explicitly specify against what kind of threats its more secure. Otherwise, statement just adds false sense of security, and then human laziness kicks in, and we end up with a mess. Like, if I harden the system kernel, but fail to protect the user data -- or vice versa -- I simply end up without any sensible result, while thinking otherwise. Or I can start with perfectly reasonable defaults (same examples like OpenBSD or SELinux) and with few "convenient" commands open up huge security holes, and again, end up with not what I expect.

[1] https://access.redhat.com/documentation/en-US/Red_Hat_Enterp...

Re: Why OpenBSD Is Important to Me

#106

Post by nickysielicki » Mon, May 09, 2016, 9:22 PM UTC

ktRolster wrote: post #45

cisstrd wrote: post #29

I am an OpenBSD user, there is no OS I'd rather use currently (obviously) and I am sure there is no OS with a greater focus on security and clean code, the project as a whole deserves a great deal of respect and admiration for setting the bar when it comes to security, and for being the originator of great products that are used outside the boundaries of OpenBSD itself, however (with all due respect) what the author…

The only thing lacking for me on OpenBSD is it doesn't run Wine. Otherwise I would jump to it in a heartbeat...

QEMU works fine, and the hypervisor is getting there.

Re: Why OpenBSD Is Important to Me

#107

Post by nickysielicki » Mon, May 09, 2016, 9:37 PM UTC

dijit wrote: post #18

zxcvcxz wrote: post #15

I don't know how anyone can lump Linux in with Windows when it comes to security from NSA spying and then say OpenBSD is a good alternative. HN seems to love the anti-Linux FUD though. Anything that further fractures the OSS community is upvoted fast. I like the BSDs too, but there are a ton of reasons Linux is the most popular kernel in the world, it's not just because the NSA makes it so.

it's not just that though, there's the push for systemd which was not welcomed and alienated a lot of sysadmin folk who frequent hackernews. personally I felt rather shafted by systemd, not because it's bad, but because my arguments were never even met, it was just a brushing off from some of the people who had already accepted it. So I tried the BSD's and they were significantly better than I imagined they would be,…

You don't have to be a sysadmin to think it's a bad idea for pid 1 to have a hard dependency on glibc.

It's a nightmare. And it's incredibly ironic that the solution seems to be that you should migrate to operating systems where the userland and kernel are coupled together.

And that's the crux of the argument against systemd. Is clean service management more important than portability? Of course not! Linux has always been interesting because it's portable, not because it's easy or streamlined or standardized.

Re: Why OpenBSD Is Important to Me

#108

Post by update » Mon, May 09, 2016, 9:52 PM UTC

> I imagine the NSA has a bag full of OpenBSD exploits [...]. But OpenBSD has gifted to the world a fighting chance--

Doesn't the former sentence negate the latter?

At this point, it seems just about all systems are hackable, given enough resources.

Re: Why OpenBSD Is Important to Me

#109

Post by npsimons » Mon, May 09, 2016, 10:23 PM UTC

nickpsecurity wrote: post #40

cisstrd wrote: post #29

I am an OpenBSD user, there is no OS I'd rather use currently (obviously) and I am sure there is no OS with a greater focus on security and clean code, the project as a whole deserves a great deal of respect and admiration for setting the bar when it comes to security, and for being the originator of great products that are used outside the boundaries of OpenBSD itself, however (with all due respect) what the author…

"As you have guessed by now I am some kind of allergic to this... those idealistic over-simplifications... drawing everything in black and white..." I avoid oversimplifications, too. Yet, most of what the author wrote was proven by precedent. Only grip I have is calling Linux anti-security and anti-privacy given how much good work in those used the platform. Gotta be a kernel by kernel and distro by distro judgment o…

> Only grip I have is calling Linux anti-security and anti-privacy given how much good work in those used the platform. Gotta be a kernel by kernel and distro by distro judgment on that.

That caught my eye as well; lumping Linux in with Windows or even OSX is insulting in the extreme on the privacy front and only slightly less on the security front. To be sure, the focus on many Linux distros is not security at the forefront, and there are some that you definitely shouldn't trust if you're paranoid (those that use binary only kernel modules), but just being on Linux is a step in the right direction if you value privacy, freedom and security. Hell, can someone tell me if it's dead simple to install OpenBSD with full disk encryption? Debian has offered this for quite some time, and it's why I wipe and re-install even pre-installed Linux systems with it.

Re: Why OpenBSD Is Important to Me

#110

Post by hackuser » Mon, May 09, 2016, 10:32 PM UTC

nickpsecurity wrote: post #44

quisquous wrote: post #5

Earlier quoted context omitted.

I'm lumping Linux in that group because my impression is that Linus is ambivalent about security--it seems to be just another feature to him (see http://www.washingtonpost.com/sf/business/2015/11/05/net-of-... ). Additionally, with most of the popular distros, once I install the OS, I have to spend a bunch of time locking things down before I do anything else, whereas OpenBSD has pretty good defaults that I can build…

Then modify the claim to say "some Linux kernels/distros" instead of Linux as a whole. Meanwhile, thanks to CompSci, there's Linux's (eg Criswell's SVA-OS) and FreeBSD's (eg CheriBSD on CHERI) that run with way more security than OpenBSD. They push the state of the art. So, it's a mixed bag. OpenBSD is actually no different. The developers care a lot about security and quality. Yet, the mere fact that I see OpenBSD d…

> thanks to CompSci ...

Dumb question: Do you mean the field of computer science in general, or some specific tech or organization that uses that name? The former doesn't exactly make sense, but I've not heard of the latter and would be interested ...