31–40 of 64 posts
While I love OpenBSD and what they do ... I have to admit, I get frustrated because many times OpenBSD is immune to security vulnerability simply because they don't implement modern tech advancements like AVX.
Not being as vulnerable doesn't make OpenBSD more "secure", it just makes them behind the times - like riding a horse & buggy in a world that's quickly evolving to electric vehicles.
On Linux, glibc has AVX-based optimizations for simple functions (string and memory copies) which will store secrets into the register file which can be extracted trivially, so the impact on glibc-based systems is HUGE."
Perhaps I missed something, but it appears musl does not use AVX instructions much if at all.
Earlier quoted context omitted.
Incorrect. They had explicit permission from the researcher involved to commit when they did. Here's the full discussion, if you want to read it yourself. https://marc.info/?l=openbsd-tech&m=152909822107104&w=2 More directly, from the KRACK FAQ: As a compromise, I allowed them to silently patch the vulnerability. https://www.krackattacks.com/#openbsd It's also worth noting that Microsoft violated the embargo as well:…
I mean, I just disagree with that interpretation of 2018 events. The embargo deadline was extended, OpenBSD violated that. They refused to play ball with the coordinated extension. The researcher is orthogonal to that. Their actions in 2018 are certainly not universally celebrated as a good way to participate in an embargo.
> "OpenBSD does not use the AVX instructions to the same extent that Linux and Microsoft do" While I love OpenBSD and what they do ... I have to admit, I get frustrated because many times OpenBSD is immune to security vulnerability simply because they don't implement modern tech advancements like AVX. Not being as vulnerable doesn't make OpenBSD more "secure", it just makes them behind the times - like riding a horse…
Having such lousy implementation bugs show that at least AMD doesn't care about it anymore, I'd wager there is something better coming round in the near future.
> "OpenBSD does not use the AVX instructions to the same extent that Linux and Microsoft do" While I love OpenBSD and what they do ... I have to admit, I get frustrated because many times OpenBSD is immune to security vulnerability simply because they don't implement modern tech advancements like AVX. Not being as vulnerable doesn't make OpenBSD more "secure", it just makes them behind the times - like riding a horse…
If you chose Open BSD you make that explicit choice. Their promise is to avoid technologies unless they are rock solid, even at the cost of performance or convenience (like the forking to LibreSSL).
> "OpenBSD does not use the AVX instructions to the same extent that Linux and Microsoft do" While I love OpenBSD and what they do ... I have to admit, I get frustrated because many times OpenBSD is immune to security vulnerability simply because they don't implement modern tech advancements like AVX. Not being as vulnerable doesn't make OpenBSD more "secure", it just makes them behind the times - like riding a horse…
More like a walkable city in a world that is quickly devolving into noisy, polluted, car-dependent cities. You may find that over a decade or a few hundred years negative externalities of a technical decision outweigh the benefits. When AVX dies a painful death in the next decade, projects like OpenBSD won't feel as much pain from it. Having such lousy implementation bugs show that at least AMD doesn't care about it…
> On Linux, glibc has AVX-based optimizations for simple functions (string and memory copies) which will store secrets into the register file which can be extracted trivially, so the impact on glibc-based systems is HUGE. Interesting. I would have expected it to be some amount of worse performance not using AVX. Though perhaps the past throttling effects from AVX-512 and friends made it so it was too complex to manag…
Full pipe string copies are not a frequent task for any OS.
> "OpenBSD does not use the AVX instructions to the same extent that Linux and Microsoft do" While I love OpenBSD and what they do ... I have to admit, I get frustrated because many times OpenBSD is immune to security vulnerability simply because they don't implement modern tech advancements like AVX. Not being as vulnerable doesn't make OpenBSD more "secure", it just makes them behind the times - like riding a horse…
> "OpenBSD does not use the AVX instructions to the same extent that Linux and Microsoft do" While I love OpenBSD and what they do ... I have to admit, I get frustrated because many times OpenBSD is immune to security vulnerability simply because they don't implement modern tech advancements like AVX. Not being as vulnerable doesn't make OpenBSD more "secure", it just makes them behind the times - like riding a horse…
More like a walkable city in a world that is quickly devolving into noisy, polluted, car-dependent cities. You may find that over a decade or a few hundred years negative externalities of a technical decision outweigh the benefits. When AVX dies a painful death in the next decade, projects like OpenBSD won't feel as much pain from it. Having such lousy implementation bugs show that at least AMD doesn't care about it…