Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why OpenBSD Is Important to Me

ggr.com

Post reply on HN
Print view View original

71–80 of 162 posts

Re: Why OpenBSD Is Important to Me

#71

Post by tptacek »

PhantomGremlin wrote: post #59
JoachimSchipper wrote: post #50

Earlier quoted context omitted.

Even as an OpenBSD fan, I'm not sure why tptacek was downvoted here. W^X etc. make it harder to write an exploit, but sufficiently-bad bugs can still yield arbitrary code execution. (Or confused-deputy problems allowing escalation to root, etc.; there's more than one way to pwn a box.) And - architecturally - OpenBSD's kernel isn't that different from Linux, both being UNIX-style kernels; to the extent that OpenBSD's…

I'm not sure why tptacek was downvoted here Maybe because his comment had the tone of: "For this, I have found a truly wonderful proof, but the margin is too small to contain it."

Do you need a "truly wonderful proof" for "the mainstream OS OpenBSD has not managed to render kernel vulnerabilities unexploitable, or to rid itself of those vulnerabilities entirely"? Because: that's an extraordinary claim for an OpenBSD supporter to make.

Re: Why OpenBSD Is Important to Me

#72

Post by mbrock »

tomcam wrote: post #66
deprave wrote: post #36

Earlier quoted context omitted.

There are three parts in this sequence: 1. Boot up - this is very machine-dependent ("MD") so you'll find it in each architecture's source code. Look for files named "locore.s" or "locore.S" in places like src/sys/i386/i386. 2. Kernel - the machine-independent ("MI") part, or where the fun begins... this is in src/sys/kern/init_main.c, look for the function main(). You'll see the different subsystems initialized, fro…

What a relief! Thanks for scratching that itch. Also turns out to be good code organization, but I needed that post to boot me up.

Someone should make a site for sharing little "guided tours" of open source code bases...

Re: Why OpenBSD Is Important to Me

#73

Post by nickpsecurity »

JoachimSchipper wrote: post #55
oarsinsync wrote: post #27

Earlier quoted context omitted.

Can you elaborate on what the alternatives are? The more we all know, the better!

For any Linux distro, applying the grsecurity patchset will make your box more secure. RHEL (and thus, CentOS) does a pretty good job of configuring and enabling SELinux for packaged software. There is a Hardened Gentoo. All the fun of normal Gentoo, but with fewer companions to find the compiler bugs. ;-) Still, they've built quite a stack of security patches, including grsecurity. There is (used to be?) Hardened Li…

Oh darn, you beat me to OpenWall. It's one of the earliest attempts at securing the Linux mess that many forget about. Solar Designer deserves some credit for his effort. Modern stuff, esp hardened RHEL or Gentoo, is far better option due to maintenance if nothing else.

Re: Why OpenBSD Is Important to Me

#74

Post by mulander »

ktRolster wrote: post #45
cisstrd wrote: post #29

I am an OpenBSD user, there is no OS I'd rather use currently (obviously) and I am sure there is no OS with a greater focus on security and clean code, the project as a whole deserves a great deal of respect and admiration for setting the bar when it comes to security, and for being the originator of great products that are used outside the boundaries of OpenBSD itself, however (with all due respect) what the author…

The only thing lacking for me on OpenBSD is it doesn't run Wine. Otherwise I would jump to it in a heartbeat...

Wine doesn't and probably never will work on OpenBSD.

- http://lwn.net/Articles/360312/

- https://www.winehq.org/docs/winedev-guide/x2803

Re: Why OpenBSD Is Important to Me

#75

Post by nickpsecurity »

gkya wrote: post #60
cisstrd wrote: post #29

I am an OpenBSD user, there is no OS I'd rather use currently (obviously) and I am sure there is no OS with a greater focus on security and clean code, the project as a whole deserves a great deal of respect and admiration for setting the bar when it comes to security, and for being the originator of great products that are used outside the boundaries of OpenBSD itself, however (with all due respect) what the author…

I'll guess, totally uninformedly, that most PC users' data/privacy gets breached because of their use of insecure third party services and/or their insecure use of third party services. That is, their credentials get stolen, the databases of the services they use are leaked and the service is late to realise the attack, they do not sanitise input and pass it directly to the database, etc... If my guess is correct, th…

You are totally ignoring the malware problem that's been going on for quite some time. All those botnets with hundreds of thousands of computers started as flaws in the OS or applications. Something like OpenBSD will definitely reduce the amount of those. High-assurance security platforms that address root causes with rigorous analysis reduce it to almost nothing. Usually new attack classes discovered to breach those.

So, yes, configurations and sharing will still be a problem compromising many users. But, no, the malware problem would be greatly reduced. That everything else is built on top of that integrity guarantee makes it the most important. Then, users can choose what they share, how they configure, and so on from there. Also, systems can be designed without need to share secrets to operate. Systems can also be largely self-configuring. We've seen both in market and FOSS. So, it's common issue but not inherent.

Re: Why OpenBSD Is Important to Me

#76

Post by gonzo »

aortega wrote: post #19
atmosx wrote: post #3

Earlier quoted context omitted.

Since OpenBSD can be backdoored[1] with the same ease that the Linux kernel could be backdoored, I have no idea why all the fuss. Debian is pretty thorough in NOT including proprietary software if that's what we're talking about. As far as I'm concerned, it's good to have options and the OpenBSD developers have created software that I use daily (OpenSMTPd, SSH, PF, etc.) and for that, I'm thankful! ps. I know that de…

>can be backdoored[1] with the same ease No, no with the same ease. Every OpenBSD commit is throughly reviewed, and there is only a bunch of commiters. Compared with linux, with thousands of commiters and tons of code added every day, OBSD is way more difficult to backdoor.

> Every OpenBSD commit is throughly reviewed, [...]

You should observe that this didn't happen here.

Sam Leffler found that bug, fixed it, and sent OpenBSD the patch while bringing the "fast IPSec"stack to FreeBSD.

OpenBSD silently patched it.

The whole thing only came to light years later, when the accusations were made.

Re: Why OpenBSD Is Important to Me

#78

Post by krylon »

cisstrd wrote: post #29

I am an OpenBSD user, there is no OS I'd rather use currently (obviously) and I am sure there is no OS with a greater focus on security and clean code, the project as a whole deserves a great deal of respect and admiration for setting the bar when it comes to security, and for being the originator of great products that are used outside the boundaries of OpenBSD itself, however (with all due respect) what the author…

I tend to agree, at least partially.

There are, to me, good reasons for using OpenBSD that have little to do with security. (I don't use OpenBSD as my primary OS, but that is a different story.)

What is most important to me is that the system is relatively simple as far as configuration/administration goes, and that it has very good documentation. It seems rather spartan at first, but on the other hand that means there is no hidden magic, which I have come to appreciate.

Also, the general approach OpenBSD takes towards security does not only improve security, it tends to result in software that is more reliable in general. One does not need to be paranoid to appreciate all that.

Re: Why OpenBSD Is Important to Me

#79

Post by neerdowell »

nickpsecurity wrote: post #44
quisquous wrote: post #5

Earlier quoted context omitted.

I'm lumping Linux in that group because my impression is that Linus is ambivalent about security--it seems to be just another feature to him (see http://www.washingtonpost.com/sf/business/2015/11/05/net-of-... ). Additionally, with most of the popular distros, once I install the OS, I have to spend a bunch of time locking things down before I do anything else, whereas OpenBSD has pretty good defaults that I can build…

Then modify the claim to say "some Linux kernels/distros" instead of Linux as a whole. Meanwhile, thanks to CompSci, there's Linux's (eg Criswell's SVA-OS) and FreeBSD's (eg CheriBSD on CHERI) that run with way more security than OpenBSD. They push the state of the art. So, it's a mixed bag. OpenBSD is actually no different. The developers care a lot about security and quality. Yet, the mere fact that I see OpenBSD d…

> Yet, the mere fact that I see OpenBSD desktops in Google images running shoddy applications shows many OpenBSD users make similar tradeoffs to what you described of Linux camp.

Are these "shoddy applications" not more secure on OpenBSD due to the various mitigations applied to userland software?

Re: Why OpenBSD Is Important to Me

#80

Post by drblast »

I just want to shake the hand of the person who made the OpenBSD installer the way it is.

In case you haven't used it, it's dead-simple, command-line based, and it may take a few times to get it right if you don't know what you're doing. It's nearly featureless.

But after you figure it out, you can automate installs, and roll your own distro by changing the contents of tar files, or add your own software and configuration the same way.

It's quite possibly the most satisfyingly transparent OS install method I've ever used.

Post reply on HN