Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Maybe you shouldn't install new software for a bit

xeiaso.net

Post reply on HN
Print view View original

471–480 of 497 posts

Re: Maybe you shouldn't install new software for a bit

#471

Post by mike_hearn »

josephg wrote: post #447
mike_hearn wrote: post #360

Earlier quoted context omitted.

The article talks about OS capabilities in the second part when it discusses Mojo, which is based on IPC. > The solution is to design a language such that if I import leftpad, then call it, my computer can't get hacked. That requirement may seem clear right now, but the moment you talk to other people about your language you'll find there's no agreement on what "get hacked" means. Some people will consider calling ex…

> We're talking about critical bugs in the filesystem so what the FS processes idea of a file handle is doesn't really matter. The copyfail bug wasn’t a bug in the filesystem code. It was a bug in the crypto algorithm code, which wrote to the filesystem page table without checking if the process invoking it had permission to write to the passed file handle. In a monolithic kernel like Linux, every subsystem can acces…

I don't recall making a performance argument against capabilities, but I think we're conflating microkernels and capability based languages. You can have capabilities without microkernels and that's often what people mean when they talk about passing caps into main(). Context switching at the hardware level does have a performance cost, so if you want to use lots of capabilities without a special programming language then you're going to pay for that yes.

I don't think there are any good mainstream capability based programming languages. At least I've never seen one. Actually the SecurityManager is I think the best implementation that has existed. I've not yet seen a credible proposal that's better. Stuff like Mojo and SEL4 is at least deployed to production but that's not a programming language.

> What are you even trying to do? Convince people to not explore different ideas in computer science?

No. Please go read the opening of the article again, which says: "In this essay I want to show you the challenges that you’ll face if you want to walk that path. This isn’t meant to put anyone off, just to draw a map of the territory you’re about to enter and explain why it’s currently deserted."

Lots of people have proposed capabilities as some silver bullet over the years, yet real systems hardly use them. Anyone who is serious about their own ideas should want to understand why that is and that's the goal of the article. It doesn't say nobody can do better! The whole point of writing it, is the hope that someone will. But to do better you have to understand why existing systems failed. It wasn't (primarily) about performance.

Re: Maybe you shouldn't install new software for a bit

#472

Post by asqueella »

CriticalRegion wrote: post #288
Phelinofist wrote: post #281

Earlier quoted context omitted.

Either my reading of your comment is wrong or you misunderstood the supply chain comment by OP I think: what they mean is that a supply chain attack that gets the exploit on a system would be great now because the reported vulns are unfixed pretty much everywhere

No, you read it right. I just misunderstood the post's message as "these exploits will enable more supply chain attacks". I'll probably delete my comment since it's debating a strawman. It is absolutely right that these exploits might enable these attacks to have a larger impact. I still don't think that I agree with the message since a malicious npm package already installed can get its payloads from a C2 server, it…

Thanks for not deleting your question — I misunderstood the OP in the same way.

Re: Maybe you shouldn't install new software for a bit

#473

Post by emodendroket »

coldtea wrote: post #235
emodendroket wrote: post #226

Earlier quoted context omitted.

Really? You think the alternate mode where you're running 5-year-old versions of stuff with tons of known security flaws is better?

What part of "We reviewed all relevant CVEs as they came out to make a call on if they apply to us or not and how we mitigate or address them" gave you that impression?

My experience with how such a strategy typically plays out in reality.

Re: Maybe you shouldn't install new software for a bit

#474

Post by krupan »

loloquwowndueo wrote: post #73
krupan wrote: post #42

Earlier quoted context omitted.

If you are switching to a BSD for security reasons, why FreeBSD? Isn't OpenBSD the super secure one? Sorry, it's been a while since I've looked at those projects

The person suggesting FreeBSD is a FreeBSD developer (Colin Percival - actually according to Wikipedia FreeBSD engineering lead), would be weird for him to suggest openbsd.

Why did you assume I didn't know that?

Re: Maybe you shouldn't install new software for a bit

#475

Post by fsflover »

cperciva wrote: post #11

Alternatively, switch to an operating system like FreeBSD which doesn't take a YOLO approach to security. Security fixes don't just get tossed into the FreeBSD kernel without coordination; they go through the FreeBSD security team and we have binary updates (via FreeBSD Update, and via pkgbase for 15.0-RELEASE) published within a couple minutes of the patches hitting the src tree. (Roughly speaking, a few seconds for…

https://news.ycombinator.com/item?id=48077971

Re: Maybe you shouldn't install new software for a bit

#476

Post by radiator »

tom_alexander wrote: post #337
stackghost wrote: post #133

Earlier quoted context omitted.

What does the D in BSD stand for again?

That's more of a historical artifact. The BSDs started as just "BSD": a set of patches for AT&T Unix that were _distributed_ by Berkeley. Eventually the patches became complete enough to be an entire operating system. _Then_ the various BSDs that we know today (FreeBSD, OpenBSD, NetBSD, DragonflyBSD) all forked and became completely independent operating systems. For decades, FreeBSD's kernel and userland has been de…

This seems too long and it does not even answer the question. The question was specific, and the answer could be only one word long.

Re: Maybe you shouldn't install new software for a bit

#477

Post by wolvoleo »

homebrewer wrote: post #220
cperciva wrote: post #11

Alternatively, switch to an operating system like FreeBSD which doesn't take a YOLO approach to security. Security fixes don't just get tossed into the FreeBSD kernel without coordination; they go through the FreeBSD security team and we have binary updates (via FreeBSD Update, and via pkgbase for 15.0-RELEASE) published within a couple minutes of the patches hitting the src tree. (Roughly speaking, a few seconds for…

Has everyone here already forgotten about the WireGuard tire fire? https://lwn.net/Articles/850098 https://news.ycombinator.com/item?id=26507507 tl;dr: deeply insecure WireGuard implementation committed directly into the FreeBSD kernel with zero review. Was this process problem fixed?

Ars also has a great writeup on this: https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice...

But yeah as I understand lessons were learned.

Re: Maybe you shouldn't install new software for a bit

#478

Post by wolvoleo »

voidUpdate wrote: post #347
cperciva wrote: post #11

Alternatively, switch to an operating system like FreeBSD which doesn't take a YOLO approach to security. Security fixes don't just get tossed into the FreeBSD kernel without coordination; they go through the FreeBSD security team and we have binary updates (via FreeBSD Update, and via pkgbase for 15.0-RELEASE) published within a couple minutes of the patches hitting the src tree. (Roughly speaking, a few seconds for…

I've kept hearing about BSD recently, how hard is it to actually switch to? I'm guessing Linux executables don't work on it since it's not Linux, do all your packages have to be made specifically for BSD?

Yes they do but there's a team of maintainers that do just that. There's even ports of software which isn't officially supported on FreeBSD.

Re: Maybe you shouldn't install new software for a bit

#479

Post by wolvoleo »

brewmarche wrote: post #389
voidUpdate wrote: post #347

Earlier quoted context omitted.

I've kept hearing about BSD recently, how hard is it to actually switch to? I'm guessing Linux executables don't work on it since it's not Linux, do all your packages have to be made specifically for BSD?

My experiences from dabbling with it a few months ago: In general everything needs to be compiled for FreeBSD, but the ports collection is quite extensive. For example you will find Firefox, wayland, GNOME, KDE, xfce, … even dotnet was on there. Problems arise with properietary stuff like Spotify, Widevine DRM etc. However, FreeBSD has a Linux emulation layer (providing syscalls), dubbed ‘Linuxulator’. I managed to r…

For spotify, just use spotify-qt :)

I don't think docker works in the linuxulator though. That's the one thing I miss sometimes.

Re: Maybe you shouldn't install new software for a bit

#480

Post by hn_throwaway_99 »

davidjkerber wrote: post #394
hn_throwaway_99 wrote: post #393

I always wondered why it wasn't super easy to have a version specification in NPM that basically said "give me the latest version of this dependency as of X weeks ago ". That is, hijacked modules usually were revealed within a week, and there are some groups (like security researchers) that are fine with being on the bleeding edge, but a lot of more conservative companies would rather hold back a week or two. I know…

Just sharing for awareness, NPM does support that as of February: https://socket.dev/blog/npm-introduces-minimumreleaseage-and... It must have been a very quiet announcement because I just found out about it this week.

Thanks, didn't know this was added!
Post reply on HN