Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why OpenBSD Is Important to Me

ggr.com

Post reply on HN
Print view View original

111–120 of 162 posts

Re: Why OpenBSD Is Important to Me

#111

Post by hackuser »

Spooky23 wrote: post #11

End of the day, OpenBSD is a great example of the value of competition, and the necessity to maintain market rules that encourage it. How awesome is it that we have dedicated operation system geared towards the niche of the market that cares deeply about security?

> OpenBSD is a great example of the value of competition, and the necessity to maintain market rules that encourage it.

The market doesn't work here. The OpenBSD people aren't responding to market incentives; they aren't earning much (AFAICT). They appear to be responding to internal incentives. The market's incentive for talented developers is to work on something else and get paid more.

That is, they appear to be doing this despite the marketplace, not because of it.

Re: Why OpenBSD Is Important to Me

#112

Post by stcredzero »

To paraphrase:

Speaking freely is essential to democracy. The more restricted your conversations, the more careful you are about what you say. And being careful leads to less candor, less criticism, and less innovation. Thought and free speech are the breeding ground for new, sometimes controversial ideas. They are how we prototype, think new ideas through, refine them, and get them ready for wider distribution and discussion.

The actions of many 21st century activists seem to be diametrically opposed to this ethos and designed create a social landscape of civic censorship and extra-legal punishment for "thoughtcrime." I think a society with laws supporting free speech on the books, but largely made of authoritarian and censorial organizations is no more democratic in spirit than the Jim Crow south was inclusive with its "technically" enfranchised non-white population. (It doesn't so much matter what laws are on the books, if society at large thinks something opposed.)

For democracy to work, there needs to be freedom to dissent. I think many young people who grew up with web forums were exposed to so much draconian censorship, they've come to unconsciously feel that censorship is a key means of expressing power and "justice." I just hope that enough of them work out how intellectually bankrupt such a society would be.

Re: Why OpenBSD Is Important to Me

#113

Post by nickpsecurity »

neerdowell wrote: post #100
nickpsecurity wrote: post #90

Earlier quoted context omitted.

That's not trying to break the mitigations: it's simply testing if they stop an exploit which isn't designed to bypass the mitigations. Really easy to pull off. :) Below are examples of a clever scheme for stopping control flow attacks and a successful attempt to breaking it. When I say testing the mitigations, I mean work like what's in the second paper. https://www.usenix.org/system/files/conference/usenixsecurit..…

I'm not seeing your point. A vulnerability was found in OpenSMTPD. That vulnerability could not be exploited on OpenBSD because there was no way to overflow the buffer without smashing the stack canary. If you had the same version of OpenSMTPD running on a generic Linux kernel or on Mac OS X, it was vulnerable. On OpenBSD it was not. Ergo, OpenSMTPD running on OpenBSD is more secure than OpenSMTPD running on other pl…

What I'm saying is simple: there's the security of the code and the mitigation itself to consider. I know of no talented people interested in devrloping bypasses for OpenBSD mitigations since nobody uses OpenBSD. So, they break even more clever stuff in Chrome, Windows, etc. Given your example, lets change the mitigation to make it more obvious, though.

OpenSMTPD (email for short) is the target. Default are Windows, Linux, and OpenBSD on x86. OpenBSD devises a mitigation: use SPARC processor since x86 malware cant work. As you say, the malware works on everything but the SPARC box. You and others claim it means the mitigation is secure and so is what uses it.

Now, some guy named Nick claims it's no more secure than a BSD/Linux 0-day on x86: they just didn't target exploit for that environment. Sure, they have to learn SPARC ISA and how OBSD uses it. Sure there's work involved. Similar mitigations were beaten in the past by first person willing to invest effort, though. So, Nick posits reason SPARC is safe from x86 malware coders is that they don't care enough to deal with SPARC boxes. Maybe no market share.

See how that works now?

Re: Why OpenBSD Is Important to Me

#114

Post by quisquous »

update wrote: post #108

> I imagine the NSA has a bag full of OpenBSD exploits [...]. But OpenBSD has gifted to the world a fighting chance-- Doesn't the former sentence negate the latter? At this point, it seems just about all systems are hackable, given enough resources.

Reading Bruce Schneier made me especially aware that security has a strong economic component--its not that you can make your server secure against all threats, but with the right tools you may be able to make it uneconomic for the threats you are most worried about. There's probably not much you can do to defend against an NSA-scale attacker that's targeting you individually. But if you're more concerned about NSA-style dragnets or their corporate equivalents, OpenBSD can help.

Re: Why OpenBSD Is Important to Me

#115

Post by Qwertious »

nickysielicki wrote: post #107
dijit wrote: post #18

Earlier quoted context omitted.

it's not just that though, there's the push for systemd which was not welcomed and alienated a lot of sysadmin folk who frequent hackernews. personally I felt rather shafted by systemd, not because it's bad, but because my arguments were never even met, it was just a brushing off from some of the people who had already accepted it. So I tried the BSD's and they were significantly better than I imagined they would be,…

You don't have to be a sysadmin to think it's a bad idea for pid 1 to have a hard dependency on glibc . It's a nightmare. And it's incredibly ironic that the solution seems to be that you should migrate to operating systems where the userland and kernel are coupled together. And that's the crux of the argument against systemd. Is clean service management more important than portability? Of course not! Linux has alway…

"Linux has always been interesting because it's portable, not because it's easy or streamlined or standardized."

Pretty sure Tanenbaum would disagree. That said, I do agree that portability really is important. For that matter, I'd really like a decent FOSS microkernel.

Re: Why OpenBSD Is Important to Me

#116

Post by bch »

nickpsecurity wrote: post #48
cisstrd wrote: post #43

Earlier quoted context omitted.

And I appreciate it, I don't doubt that OS X isn't the best choice, and for sure there is some kind of trade-off going on, most likely, yet I assume a lot of it also has to do with how those products are used, meaning an inexperienced users fall into the pitfalls of maybe any system, while an experienced user will use the product rather differently? Since you are a security researcher, aren't a lot of people of "your…

"Since you are a security researcher, aren't a lot of people of "your breed" using Macs as well?" I use Linux, BSD's, and custom systems. From what I've gathered, the people using Mac's do it for usability and apps more than anything. The Mac OS is pretty, well-designed components for GUI/desktop on top of a hybrid between a microkernel and UNIX (BSD). Let's ignore their bad choice of microkernel. The real benefit is…

> The Mac OS is pretty, well-designed components for GUI/desktop on top of a hybrid between a microkernel and UNIX (BSD). Let's ignore their bad choice of microkernel.

Is it necessary to ignore the microkernel choice? Isn't MacOS X -not- microkernel, even though (or "because") it uses an old version of Mach? [0][1][2]

[0] https://en.wikipedia.org/wiki/Mach_%28kernel%29

[1] http://www.roughlydrafted.com/0506.mk1.html

[2] https://www.youtube.com/watch?v=8RwlEZ88rKM&t=445

Re: Why OpenBSD Is Important to Me

#117

Post by update »

quisquous wrote: post #114
update wrote: post #108

> I imagine the NSA has a bag full of OpenBSD exploits [...]. But OpenBSD has gifted to the world a fighting chance-- Doesn't the former sentence negate the latter? At this point, it seems just about all systems are hackable, given enough resources.

Reading Bruce Schneier made me especially aware that security has a strong economic component--its not that you can make your server secure against all threats, but with the right tools you may be able to make it uneconomic for the threats you are most worried about. There's probably not much you can do to defend against an NSA-scale attacker that's targeting you individually. But if you're more concerned about NSA-s…

> There's probably not much you can do to defend against an NSA-scale attacker that's targeting you individually.

Hm. How is Phineas Fisher[1] is still on the loose then?

[1] https://news.ycombinator.com/item?id=11512845

Re: Why OpenBSD Is Important to Me

#118

Post by hamsterdam156 »

npsimons wrote: post #109
nickpsecurity wrote: post #40

Earlier quoted context omitted.

"As you have guessed by now I am some kind of allergic to this... those idealistic over-simplifications... drawing everything in black and white..." I avoid oversimplifications, too. Yet, most of what the author wrote was proven by precedent. Only grip I have is calling Linux anti-security and anti-privacy given how much good work in those used the platform. Gotta be a kernel by kernel and distro by distro judgment o…

> Only grip I have is calling Linux anti-security and anti-privacy given how much good work in those used the platform. Gotta be a kernel by kernel and distro by distro judgment on that. That caught my eye as well; lumping Linux in with Windows or even OSX is insulting in the extreme on the privacy front and only slightly less on the security front. To be sure, the focus on many Linux distros is not security at the f…

> Hell, can someone tell me if it's dead simple to install OpenBSD with full disk encryption?

Dead simple. Full disk encryption on OpenBSD is a discipline of softraid(4). One bioctl command during the install will initialize a hard disk with true full disk encryption. When I say true, I mean, no separate un-encrypted /boot partition like LVM on LUKS requires.

Re: Why OpenBSD Is Important to Me

#119

Post by morganvachon »

drblast wrote: post #80

I just want to shake the hand of the person who made the OpenBSD installer the way it is. In case you haven't used it, it's dead-simple, command-line based, and it may take a few times to get it right if you don't know what you're doing. It's nearly featureless. But after you figure it out, you can automate installs, and roll your own distro by changing the contents of tar files, or add your own software and configur…

Indeed, the only distros in the Linux world with installers that even come close are Alpine Linux (which is obviously heavily influenced by the OpenBSD installer) and Slackware Linux, coincidentally two of the better Linux distros for those who prefer a more BSD-style approach to managing the OS proper.

Alpine needs a little work in the desktop OS department, and is painfully lacking in a few essential packages for daily computing, but it's come a long way in a short time. Meanwhile, Slackware is due to drop 14.2 on us any day now, and has seen vast improvements over the past few years. Both are worth a look if OpenBSD for some reason doesn't work on one's system.

But having said that, OpenBSD is a cut above any other open source OS when it comes to stability, clean code, and well written, complete, thorough documentation.

Re: Why OpenBSD Is Important to Me

#120

Post by eugeneionesco »

neerdowell wrote: post #100
nickpsecurity wrote: post #90

Earlier quoted context omitted.

That's not trying to break the mitigations: it's simply testing if they stop an exploit which isn't designed to bypass the mitigations. Really easy to pull off. :) Below are examples of a clever scheme for stopping control flow attacks and a successful attempt to breaking it. When I say testing the mitigations, I mean work like what's in the second paper. https://www.usenix.org/system/files/conference/usenixsecurit..…

I'm not seeing your point. A vulnerability was found in OpenSMTPD. That vulnerability could not be exploited on OpenBSD because there was no way to overflow the buffer without smashing the stack canary. If you had the same version of OpenSMTPD running on a generic Linux kernel or on Mac OS X, it was vulnerable. On OpenBSD it was not. Ergo, OpenSMTPD running on OpenBSD is more secure than OpenSMTPD running on other pl…

>If you had the same version of OpenSMTPD running on a generic Linux kernel or on Mac OS X, it was vulnerable

You're completely wrong, stack canaries have nothing to do with kernels, they're a compiler option, gcc has them enabled by default, clang has them enabled by default. So no, running OpenSMTPD on Linux or OS X would not make that vulnerability exploitable.

Post reply on HN