Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fun with Gentoo: Why don't we just shuffle those ROP gadgets away?

quitesimple.org

Post reply on HN
Print view View original

71–80 of 84 posts

Re: Fun with Gentoo: Why don't we just shuffle those ROP gadgets away?

#71

Post by ShredKazoo »

lxgr wrote: post #68
ShredKazoo wrote: post #65

Lack of reproducible builds seems like a big cost here. I wonder if there's a way to do just-in-time random relinking such that the performance cost is low, but the security benefit is still strong. Just-in-time gets you reproducible builds, and also addresses the "local attackers who can read the binary or library" problem. There would be a performance cost in terms of startup time, but since the number of possible…

Do reproducible builds even matter if you're building/linking and executing a binary on the same system? The biggest benefit seems to be in making it infeasible/dangerous for a malicious actor to distribute binary versions containing different behavior from the published source. On a local machine, when and with what would you compare your binaries?

Sure, just think of it as a way to get the same benefit on a precompiled system like Ubuntu I guess.

Re: Fun with Gentoo: Why don't we just shuffle those ROP gadgets away?

#72

Post by chlorion »

lmz wrote: post #66
chemicalnovae wrote: post #50

Earlier quoted context omitted.

Don't be embarrassed, its what computers are for! I've done the same thing recently too. It honestly feels like a better use of a high-core desktop CPU than have it sit idle 99% of the time.

I wonder which is more wasteful - compiling these packages for the nth time vs mining cryptocurrency...

These aren't even close to comparable, and I am very tired of hearing people complain about this!

My current Gentoo system seems to have existed since 03/29/21, so roughly two years now. In the time period, the time spent compiling packages has accumulated to 5 days, and my CPU takes ~140W at max load (Ryzen 3900x).

If I did my math correctly, this comes out to roughly 16KWH accumulated energy across two years.

We can compare this to a gamer, who spends 1 hour per day gaming, for 2 years, on a system that takes 300w while running a game, and this comes out to 230KWH in total. That about 15x as much energy spent by a fairly lightweight gamer on a very average system.

It's also worth noting that the majority of packages build in under 1 minute on my system, the vast majority of compile time is spent on things like Firefox, Rust, GCC and a few more.

This is just a very silly thing to be concerned over, and if we are going to be offended at people for being wasteful there are much larger targets than someone building packages from source.

Re: Fun with Gentoo: Why don't we just shuffle those ROP gadgets away?

#73

Post by chithanh »

withinboredom wrote: post #27
ectopod wrote: post #16

Earlier quoted context omitted.

You can bootstrap the compiler. It's a chore but not impossible. More usefully, you can check that your builds are identical to other people's, so at least your compiler isn't uniquely compromised.

I don’t think it’s possible since you’d need the original compilers from the 70’s and bootstrap other compilers up to a modern one. Otherwise your existing compiler could taint your new one.

No, you only need two compilers that have not been subverted by the same adversary.

https://www.schneier.com/blog/archives/2006/01/countering_tr...

Re: Fun with Gentoo: Why don't we just shuffle those ROP gadgets away?

#74

Post by withinboredom »

chithanh wrote: post #73
withinboredom wrote: post #27

Earlier quoted context omitted.

I don’t think it’s possible since you’d need the original compilers from the 70’s and bootstrap other compilers up to a modern one. Otherwise your existing compiler could taint your new one.

No, you only need two compilers that have not been subverted by the same adversary. https://www.schneier.com/blog/archives/2006/01/countering_tr...

That’s a good point

Re: Fun with Gentoo: Why don't we just shuffle those ROP gadgets away?

#75

Post by withinboredom »

ectopod wrote: post #33
withinboredom wrote: post #27

Earlier quoted context omitted.

I don’t think it’s possible since you’d need the original compilers from the 70’s and bootstrap other compilers up to a modern one. Otherwise your existing compiler could taint your new one.

Many years ago I wrote a C compiler in assembly language. It wasn't hard, and C hasn't changed that much. The complexity in modern compilers is in the optimisation, which you don't need if you're bootstrapping. It's not impossible.

A pragmatic approach!

Re: Fun with Gentoo: Why don't we just shuffle those ROP gadgets away?

#76

Post by saagarjha »

blibble wrote: post #58
saagarjha wrote: post #55

Earlier quoted context omitted.

Relinking glibc would block the boot process.

how? it's a dynamic library, and this isn't windoze with awful mandatory locking as long as the underlying version is unchanged: there should be no problem whatsoever

glibc is going to get used by everything in userspace, so you’ll need it when you boot.

Re: Fun with Gentoo: Why don't we just shuffle those ROP gadgets away?

#77

Post by account42 »

atlgator wrote: post #34

I remember my Gentoo days freshman year in college. I spent more time compiling updates than actually using the computer.

How? Were you watching the compile output? Because you don't need to spend much time when your computer is doing all the work.

Re: Fun with Gentoo: Why don't we just shuffle those ROP gadgets away?

#78

Post by account42 »

gerdesj wrote: post #48
dzmien wrote: post #45

Earlier quoted context omitted.

I do all world updates overnight for this very reason. But on my R5 3600, the longest emerge is, by far, qtwebengine, which takes just under 1.5 hours. Plus, Gentoo provides -bin versions of many packages notorious for protracted build times, such as Rust, Chromium, Firefox, etc...

-bin seems like a strange thing when you are doing Gentoo, which is all about compile locally. Gentoo has always been about choice and -bin is a choice. However you lose USE flag choice decision with a -bin. The possible combinations that Gentoo allows looks to me like a sort of Linux immune system in action. Quite a few "unpopular" flags will get used (lol USEd) somewhere by someone that will be more motivated on av…

Sure, binary packages don't reduce choice though since they are available in addition to the normal packages (except for stuff that is not open source at all).

Wanting to have control over config via use flags for your system doesn't mean that there aren't packages were you don't really need that. Like if you only use Libre Office a couple times per year on your aging laptop, do you really care enough about the exact USE config to justify compiling it yourself? Even more so if you need it on short notice. Or if you only use Chromium/whatever to check that your website works with that browser but don't actually use it yourself, why bother compiling it.

IIRC there used to be a Gentoo fork (forgot the name) that extended this concept to all packages, so if you used default USE flags you did not need to compile things yourself.

Re: Fun with Gentoo: Why don't we just shuffle those ROP gadgets away?

#79

Post by blibble »

saagarjha wrote: post #76
blibble wrote: post #58

Earlier quoted context omitted.

how? it's a dynamic library, and this isn't windoze with awful mandatory locking as long as the underlying version is unchanged: there should be no problem whatsoever

glibc is going to get used by everything in userspace, so you’ll need it when you boot.

yes... it is there at boot

then after boot you relink for next boot

Re: Fun with Gentoo: Why don't we just shuffle those ROP gadgets away?

#80

Post by account42 »

saagarjha wrote: post #76
blibble wrote: post #58

Earlier quoted context omitted.

how? it's a dynamic library, and this isn't windoze with awful mandatory locking as long as the underlying version is unchanged: there should be no problem whatsoever

glibc is going to get used by everything in userspace, so you’ll need it when you boot.

Yes, but this thread is about doing the linking after boot. It doesn't matter if you link synchronously before you start the program or link asynchronously after you start the program - you will still get a new unique binary for each boot.
Post reply on HN