Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why OpenBSD Is Important to Me

ggr.com

Post reply on HN
Print view View original

121–130 of 162 posts

Re: Why OpenBSD Is Important to Me

#121

Post by aortega »

gonzo wrote: post #76
aortega wrote: post #19

Earlier quoted context omitted.

>can be backdoored[1] with the same ease No, no with the same ease. Every OpenBSD commit is throughly reviewed, and there is only a bunch of commiters. Compared with linux, with thousands of commiters and tons of code added every day, OBSD is way more difficult to backdoor.

> Every OpenBSD commit is throughly reviewed, [...] You should observe that this didn't happen here. Sam Leffler found that bug, fixed it, and sent OpenBSD the patch while bringing the "fast IPSec"stack to FreeBSD. OpenBSD silently patched it. The whole thing only came to light years later, when the accusations were made.

>You should observe that this didn't happen here.

I bet it now happens.

Re: Why OpenBSD Is Important to Me

#122

Post by aortega »

PhantomGremlin wrote: post #104
tptacek wrote: post #71

Earlier quoted context omitted.

Do you need a "truly wonderful proof" for "the mainstream OS OpenBSD has not managed to render kernel vulnerabilities unexploitable, or to rid itself of those vulnerabilities entirely"? Because: that's an extraordinary claim for an OpenBSD supporter to make.

I was not responding to "the mainstream OS OpenBSD ...". Let's go back to your remark, which preceded his: kernel exploits for OpenBSD are neither theoretical nor impractical. You put that out there as a bare, standalone statement. No elaboration, no proof. Your comment might be true, but I would have liked to see some more "meat" in it. Some supporting evidence, some inkling of a truly wonderful proof.

I did write a remote kernel exploit for OpenBSD, it was not an easy task, and this was in a time when there were basically no exploit countermeasures in kernel (2007) (https://www.coresecurity.com/content/open-bsd-advisorie)

There are a bunch of local kernel exploits, all very practical and reliable. Kernel protections are something OpenBSD lacked until very recently.

Re: Why OpenBSD Is Important to Me

#123

Post by chris_wot »

nickpsecurity wrote: post #40
cisstrd wrote: post #29

I am an OpenBSD user, there is no OS I'd rather use currently (obviously) and I am sure there is no OS with a greater focus on security and clean code, the project as a whole deserves a great deal of respect and admiration for setting the bar when it comes to security, and for being the originator of great products that are used outside the boundaries of OpenBSD itself, however (with all due respect) what the author…

"As you have guessed by now I am some kind of allergic to this... those idealistic over-simplifications... drawing everything in black and white..." I avoid oversimplifications, too. Yet, most of what the author wrote was proven by precedent. Only grip I have is calling Linux anti-security and anti-privacy given how much good work in those used the platform. Gotta be a kernel by kernel and distro by distro judgment o…

I'm genuinely curious: what do you think of SIP on OS X? Do you think it is effective?

Re: Why OpenBSD Is Important to Me

#124

Post by nickpsecurity »

hamsterdam156 wrote: post #118
npsimons wrote: post #109

Earlier quoted context omitted.

> Only grip I have is calling Linux anti-security and anti-privacy given how much good work in those used the platform. Gotta be a kernel by kernel and distro by distro judgment on that. That caught my eye as well; lumping Linux in with Windows or even OSX is insulting in the extreme on the privacy front and only slightly less on the security front. To be sure, the focus on many Linux distros is not security at the f…

> Hell, can someone tell me if it's dead simple to install OpenBSD with full disk encryption? Dead simple. Full disk encryption on OpenBSD is a discipline of softraid(4). One bioctl command during the install will initialize a hard disk with true full disk encryption. When I say true, I mean, no separate un-encrypted /boot partition like LVM on LUKS requires.

Thanks for answer as I was curious too.

Re: Why OpenBSD Is Important to Me

#126

Post by jevinskie »

quisquous wrote: post #5
executesorder66 wrote: post #2

I'm curious why the author says Linux is "insecure, anti-secure, and anti-privacy software" Can anyone explain this? Also, why OpenBSD specifically, and not FreeBSD for example?

I'm lumping Linux in that group because my impression is that Linus is ambivalent about security--it seems to be just another feature to him (see http://www.washingtonpost.com/sf/business/2015/11/05/net-of-... ). Additionally, with most of the popular distros, once I install the OS, I have to spend a bunch of time locking things down before I do anything else, whereas OpenBSD has pretty good defaults that I can build…

An example of Linus' attitude:

> Nobody really objected to the patch series as a whole, but Linus hated the name of the configuration option; he asked that it be called CONFIG_LEGACY_VSYSCALLS instead. Or, even better, the change could just be done unconditionally. That led to a fairly predictable response from the PaX developer on how the kernel community likes to hide security problems, to which Linus said:

>> Calling the old vdso "UNSAFE" as a config option is just plain stupid. It's a politicized name, with no good reason except for your political agenda. And when I call it out as such, you just spout the same tired old security nonsense.

https://lwn.net/Articles/446528/

Re: Why OpenBSD Is Important to Me

#128

Post by woodman »

gkya wrote: post #60
cisstrd wrote: post #29

I am an OpenBSD user, there is no OS I'd rather use currently (obviously) and I am sure there is no OS with a greater focus on security and clean code, the project as a whole deserves a great deal of respect and admiration for setting the bar when it comes to security, and for being the originator of great products that are used outside the boundaries of OpenBSD itself, however (with all due respect) what the author…

I'll guess, totally uninformedly, that most PC users' data/privacy gets breached because of their use of insecure third party services and/or their insecure use of third party services. That is, their credentials get stolen, the databases of the services they use are leaked and the service is late to realise the attack, they do not sanitise input and pass it directly to the database, etc... If my guess is correct, th…

> ...because of their use of insecure third party services...

The OS is partially to blame for that. I've got all my external services separately jailed in FreeBSD, with firewalls tuned to each service. Unless they come packing a 0day jailbreak exploit - a compromised service will spread no further, the web server isn't going to be SSHing into the kerberos server. Having your DB dumped sucks, but the really embarrassing compromises (HackingTeam, AshleyMadison, HBGary, etc) involved establishing a beachhead on a vulnerable service and then pushing in further.

You can manually set these thing up in any OS, but the easier an OS makes it to be secure - the more likely it is that the machine will be secure.

Re: Why OpenBSD Is Important to Me

#129

Post by JoachimSchipper »

dpv wrote: post #105
JoachimSchipper wrote: post #55

Earlier quoted context omitted.

For any Linux distro, applying the grsecurity patchset will make your box more secure. RHEL (and thus, CentOS) does a pretty good job of configuring and enabling SELinux for packaged software. There is a Hardened Gentoo. All the fun of normal Gentoo, but with fewer companions to find the compiler bugs. ;-) Still, they've built quite a stack of security patches, including grsecurity. There is (used to be?) Hardened Li…

The bad thing is there's hardly a generic "more secure" switch. > applying the grsecurity patchset will make your box more secure. It also might not. Correct me if I'm wrong, but while grsecurity does a good job in kernel hardening, it won't protect from attacks like recent imagemagick system() injections, or from something like wordpress exploits, where you don't necessary touch kernel space or even binaries at all…

You're right, but I just wanted to give some pointers, not write a novel on software security (modelling). ;-)

With respect to SELinux: I'm not a fan in all regards, but if you want to use SELinux, the fact that RHEL has pre-made policies for you does help.

Re: Why OpenBSD Is Important to Me

#130

Post by marios »

leaveyou wrote: post #26

I wanted multiple times to study the OpenBSD source code and I've downloaded it but I never managed to navigate through it, to find the "head and the tail" or to find a reasonable "map" of the source code. I would like for example to follow the execution path in the source code, from the boot up to the login prompt. Does any documentation like this exist or could anyone give me some hints ? Thanks

Not a map per se, but I find bxr.su is a great resource to browse *BSD source code. OpenBSD is quite close to its' 4.4BSD roots, so "The Design and Implementation of the 4.4 BSD Operating System" book should still be pretty accurate.

There is also a presentation on openbsd.org/papers that seems relevant "OpenBSD Kernel Internals: The Hitchhiker's Guide". Direct link to PDF : http://atmnis.com/~proger/openkyiv/openkyiv2009_proger_sys.p...

Post reply on HN