Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Theo de Raadt: "You've been smoking something mind altering" (2007)

marc.info

Post reply on HN
Print view View original

61–70 of 99 posts

Re: Theo de Raadt: "You've been smoking something mind altering" (2007)

#61

Post by hylaride »

znpy wrote: post #32

I think de Raadt and OpenBSD are hugely overrated and some takes are as dumb as the one in the post. OpenBSD is only secure because because it does pretty much nothing and does it very slowly (its firewall just recently broke the 4gbps firewalling capabilty, for example) but somehow a cult has formed around it ¯\_(ツ)_/¯

Counter-take:

Linux is only secure because of OpenSSH.

In all seriousness, the OpenBSD guys are very conservative with technology. The OpenBSD pf stack (as well as much of the kernel) isn't heavily threaded due to the risk of race conditions. They also (correctly) predicted a lot of the speculative CPU attacks by not supporting it by default.

They've done a lot of security research and pioneered a lot of open source work around OS-level stack smashing technologies, like memory executable-space protection (W^X), early process privilege separation, memory space randomization, etc. Some of these features are not great for performance, but do help and have been adopted by other systems.

You're basically arguing that an armoured car sucks because a Ferrari can smoke it on a race track. There are times you want a Ferrari and there are times you want a Brinks truck.

Re: Theo de Raadt: "You've been smoking something mind altering" (2007)

#62

Post by Gud »

I don't understand the constant (almost always unsubstantiated) criticism of the *BSDs from many Linux advocates.

Personally I evaluate each OS by it's merit, and I've concluded that OpenBSD, FreeBSD and some Linux distributions(I use arch btw) are solid operating systems.

On the server I prefer FreeBSD because of it's amazing flexibility, and stable yet evolutionary base system and in my opinion, superior init system. Simple RC scripts FTW.

I use Arch Linux for superior software and hardware support, related to client usage.

I use OpenBSD for various network appliances.

Re: Theo de Raadt: "You've been smoking something mind altering" (2007)

#63

Post by justsomehnguy »

boricj wrote: post #18
tptacek wrote: post #13

One of his dumber takes. Virtualization replaces an ultra-functional general-purpose kernel evolved over decades to support every conceivable application with a drastically smaller "kernel" (KVM and the userland hypervisor). It's a drastic attack surface reduction, and the empirical data bears that out: kernel LPEs aren't even newsworthy (there's whole repos full of unnamed, unremarked-upon LPEs), and KVM escapes are…

Doesn't that message date back to a time that either predates or is almost concurrent with the introduction of x86 hardware-assisted virtualization? I wasn't around playing with VMs back then, but I'm not sure that the track record of x86 virtualization 20 years ago was that great.

The letter is dated 2007-10.

AMD released (ie commercially available) Pacifica on May 23, 2006 while Intel did released their Vanderpool a half of year earlier November 14, 2005. [0]

Windows Server 2008 was RTM'ed on February 2008 which provided Hyper-V as a first class component. [1]

Virtual Server 2005 R2 SP1 added support for both Intel VT (IVT) and AMD Virtualization (AMD-V) and was released 11 June 2007. [2]

https://en.wikipedia.org/wiki/X86_virtualization#AMD_virtual...

https://en.wikipedia.org/wiki/Windows_Server_2008

https://en.wikipedia.org/wiki/Microsoft_Virtual_Server#Versi...

Re: Theo de Raadt: "You've been smoking something mind altering" (2007)

#64

Post by dehrmann »

xattt wrote: post #46
tptacek wrote: post #13

One of his dumber takes. Virtualization replaces an ultra-functional general-purpose kernel evolved over decades to support every conceivable application with a drastically smaller "kernel" (KVM and the userland hypervisor). It's a drastic attack surface reduction, and the empirical data bears that out: kernel LPEs aren't even newsworthy (there's whole repos full of unnamed, unremarked-upon LPEs), and KVM escapes are…

> replaces an ultra-functional general-purpose kernel evolved over decades to support every conceivable application with a drastically smaller "kernel" Is a Proxmox kernel that much smaller than a typical Linux kernel?

Isn't Proxmox a management layover over Debian and KVM? I doubt the kernel is even smaller.

Re: Theo de Raadt: "You've been smoking something mind altering" (2007)

#65

Post by ranger_danger »

I wished more people would take issue with developers' bad attitudes.

I know this is an extremely unpopular take, but I refuse to use software where the main dev(s) are openly abusive to others. Sadly this includes the majority of open source operating systems and many other very popular applications... but it's my decision and you're welcome to disagree with me. I am not trying to prevent others from using said software, and I don't look down on them for it.

I think if everyone was always forced to separate the art from the artist, then boycotting wouldn't even be a thing, so there should probably be some kind of middle ground.

Re: Theo de Raadt: "You've been smoking something mind altering" (2007)

#67

Post by znpy »

bawolff wrote: post #43
znpy wrote: post #32

I think de Raadt and OpenBSD are hugely overrated and some takes are as dumb as the one in the post. OpenBSD is only secure because because it does pretty much nothing and does it very slowly (its firewall just recently broke the 4gbps firewalling capabilty, for example) but somehow a cult has formed around it ¯\_(ツ)_/¯

In fairness, minimizing surface area (doing nothing unless you need to) is security 101, so i hardly think that is a criticism.

Yeah it’s one way to look at it for sure…

Re: Theo de Raadt: "You've been smoking something mind altering" (2007)

#69

Post by rurban »

ranger_danger wrote: post #65

I wished more people would take issue with developers' bad attitudes. I know this is an extremely unpopular take, but I refuse to use software where the main dev(s) are openly abusive to others. Sadly this includes the majority of open source operating systems and many other very popular applications... but it's my decision and you're welcome to disagree with me. I am not trying to prevent others from using said soft…

There was no abuse and bad attitude. He was telling the truth about Linux hypervisors. And it got worse since then. Then they talked Xen, which at least has a security boundary. Now everybody switched to kvm with none. Only speed matters, security not at all.
Post reply on HN