Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why OpenBSD Is Important to Me

ggr.com

Post reply on HN
Print view View original

81–90 of 162 posts

Re: Why OpenBSD Is Important to Me

#81

Post by nickpsecurity »

neerdowell wrote: post #79
nickpsecurity wrote: post #44

Earlier quoted context omitted.

Then modify the claim to say "some Linux kernels/distros" instead of Linux as a whole. Meanwhile, thanks to CompSci, there's Linux's (eg Criswell's SVA-OS) and FreeBSD's (eg CheriBSD on CHERI) that run with way more security than OpenBSD. They push the state of the art. So, it's a mixed bag. OpenBSD is actually no different. The developers care a lot about security and quality. Yet, the mere fact that I see OpenBSD d…

> Yet, the mere fact that I see OpenBSD desktops in Google images running shoddy applications shows many OpenBSD users make similar tradeoffs to what you described of Linux camp. Are these "shoddy applications" not more secure on OpenBSD due to the various mitigations applied to userland software?

We don't know. OpenBSD has so little market share that virtually nobody is testing those mitigations. However, many are similar to mitigations developed on other platforms and beaten. So, they'd probably be beaten with effort, too.

Don't you love reasoning by precedent? Makes these judgment calls so much easier. :)

Re: Why OpenBSD Is Important to Me

#82

Post by neerdowell »

nickpsecurity wrote: post #81
neerdowell wrote: post #79

Earlier quoted context omitted.

> Yet, the mere fact that I see OpenBSD desktops in Google images running shoddy applications shows many OpenBSD users make similar tradeoffs to what you described of Linux camp. Are these "shoddy applications" not more secure on OpenBSD due to the various mitigations applied to userland software?

We don't know. OpenBSD has so little market share that virtually nobody is testing those mitigations. However, many are similar to mitigations developed on other platforms and beaten. So, they'd probably be beaten with effort, too. Don't you love reasoning by precedent? Makes these judgment calls so much easier. :)

People are testing the mitigations. For example Qualsys' audit of OpenSMTPD[0] noted that a buffer overflow they found was not exploitable on OpenBSD as even a single byte overflow would smash the stack canary.

[0] https://www.qualys.com/2015/10/02/opensmtpd-audit-report.txt

Re: Why OpenBSD Is Important to Me

#83

Post by gkya »

nickpsecurity wrote: post #75
gkya wrote: post #60

Earlier quoted context omitted.

I'll guess, totally uninformedly, that most PC users' data/privacy gets breached because of their use of insecure third party services and/or their insecure use of third party services. That is, their credentials get stolen, the databases of the services they use are leaked and the service is late to realise the attack, they do not sanitise input and pass it directly to the database, etc... If my guess is correct, th…

You are totally ignoring the malware problem that's been going on for quite some time. All those botnets with hundreds of thousands of computers started as flaws in the OS or applications. Something like OpenBSD will definitely reduce the amount of those. High-assurance security platforms that address root causes with rigorous analysis reduce it to almost nothing. Usually new attack classes discovered to breach those…

My intuition was that malware attacks were less prominent nowadays. I certainly cannot and will not deny the advantage of OpenBSD in front of malware, and I also cannot and do not ignore botnets, keyloggers, various code injection attacks, etc., but I believe nowadays what's at the highest risk is what we store on others' disks, i.e. the cloud, and what the commoners do, like emailing passwords in cleartext, using clumsy inept passwords, not caring about https, not knowing that one has to block JavaScript, etc. Aren't these more easily exploitable in practice than say a stack overflow somewhere in my programs (not a rhetoric question)? Though I'm no security expert. But I know that it's easier to get the bucks of a 50-year-old first-time-internet-user who's heartly disposed to enter their Gmail password to any box with a Password: label. I know many of them. To many the URL bar is linenoise. "bank.com.hackersdomain.tk"? Some cryptic crap, I don't know what it is, it looks like my bank.

The morale is an ignorant user can easily be exploited even on OpenBSD, while a security-savvy user can secure himself even on an insecure OS. Thing is, the former is way more prominent, they're in billions. I don't dismiss advantages to secure OSs, but say that the more important problem is inept users.

Re: Why OpenBSD Is Important to Me

#84

Post by ben_bai »

peatmoss wrote: post #14
pyritschard wrote: post #8

We also owe the OpenBSD team OpenSSH, which greatly benefits from their attention to detail and commitment to small improvements towards better security. Of course software is never perfect, but it's nice to know the (small) subset of OpenBSD developers working on OpenSSH are still working on keeping the proverbial doors locked.

Yes, the OpenBSD team's willingness to roll up their sleeves for software that I consider core to a functional Internet is pretty remarkable. Even though the last OpenSSL vulnerability also affected LibreSSL, in the past others haven't. EDIT: Morning brain made context shift unclear. They do OpenSSH and now LibreSSL. Also pf and more too.

http://www.openbsd.org/innovations.html AnonCVS, OpenNTPd, OpenSMTPd, ...

Re: Why OpenBSD Is Important to Me

#85

Post by niroze »

Great opinion piece. I think this is mostly the opinion of anyone that really discovers OpenBSD and gets caught up in it. Security does matter, and the developers accept nothing less than what they want.

My main problem with OpenBSD development is that all development is decided solely by the developers and there doesn't seem to be much care for what others want.. which is fine, they're doing all the work for peanuts.

Sometimes you just have to do things that aren't well suited for OpenBSD (imagine updating and ensuring hundreds of OpenBSD machines are up-to-date, and running high performant threaded applications). Many things work, but that is all they do. Sure it may be much more secure than other unix or linux offerings, it may be all there is. Much of the ports are just "get this to compile and work". That isn't always good enough. Truly evaluate if it fits your needs. If there is something you want on the platform, it may be up to you to fix it.

--

Unrelated, I find it interesting that NetBSD isn't mentioned once in this entire thread.

Re: Why OpenBSD Is Important to Me

#86

Post by creshal »

Santosh83 wrote: post #39
creshal wrote: post #31

Earlier quoted context omitted.

> OpenBSD invests a great deal here. They have their own fork of Xorg (or was that XFree86?) that runs not as root. As far as I know that's unique amongst libre *nixen. It's a standard feature of Xorg nowadays, but it's only a feature of vanilla Xorg for a few years.

I'm probably misunderstanding something but on my system (Ubuntu 14.04 LTS) the X server runs as root & not as my user.

Ubuntu does not enable it by default, as it mixes poorly with some drivers: https://wiki.ubuntu.com/X/Rootless

AMD only added KMS to their proprietary driver last year, and Nvidia this year (and IIRC only in a beta driver so far); and systemd makes the permission handling a lot easier. So Ubuntu will transition to it eventually, but didn't have all puzzle pieces until too recently for even 16.04 LTS.

Re: Why OpenBSD Is Important to Me

#87

Post by niroze »

dwc wrote: post #54
zymhan wrote: post #23

I'm just getting started on setting up an OpenBSD router that I want to be the basis for making sure much of my data is secure. I figure I can start with the edge of my network and work in. And for such an important device as an internet gateway, I want to be able to trust it.

> I'm just getting started on setting up an OpenBSD router that I want to be the basis for making sure much of my data is secure. A bit of warning... I've seen this go wrong when people who don't know OpenBSD do this. Adding an additional OS means learning and "supporting" it. * If learn your way around, get it set up well, keep your system updated the way you do for anything else, then you'll be in good shape. * If…

Indeed! Spoken by someone that seems to have experience maintaining many machines.

As secure as the machine is, its security slowly degrades the longer it is out-of-sync with updates (especially security ones) and/or admins administering the machines aren't good enough.

System administration isn't a set-it-and-forget-it type of thing.

Re: Why OpenBSD Is Important to Me

#88

Post by nickpsecurity »

gkya wrote: post #83
nickpsecurity wrote: post #75

Earlier quoted context omitted.

You are totally ignoring the malware problem that's been going on for quite some time. All those botnets with hundreds of thousands of computers started as flaws in the OS or applications. Something like OpenBSD will definitely reduce the amount of those. High-assurance security platforms that address root causes with rigorous analysis reduce it to almost nothing. Usually new attack classes discovered to breach those…

My intuition was that malware attacks were less prominent nowadays. I certainly cannot and will not deny the advantage of OpenBSD in front of malware, and I also cannot and do not ignore botnets, keyloggers, various code injection attacks, etc., but I believe nowadays what's at the highest risk is what we store on others' disks, i.e. the cloud , and what the commoners do, like emailing passwords in cleartext, using c…

"My intuition was that malware attacks were less prominent nowadays."

They are and they aren't. What you're seeing is a combination of economics and improvements in software quality. Economics says they focus on whatever gets them the most zombified PC's since competition drives prices of each individual PC down in black market. To get this, they target apps with most widespread use. This is why almost all 0-days were found in Windows, IE, Firefox, Java, Adobe Acrobat, etc.

Microsoft's SDL & QA tools did them a 180 on code quality. Low-hanging fruit in major apps might be drying up because so many bugs were found. Attackers shifted focus to backend databases via hits on web apps as that's new low-hanging fruit (read: shit security) with huge rewards (eg million records at once) for success. So, it's not that it's gone away so much as not as popular while low-hanging fruit exists for their purposes. Organized crime, esp targeting online banking, plus nation-states continue to find, sell, and use 0-days for malware. It's still a thing except stealthier and more targeted.

"Aren't these more easily exploitable in practice than say a stack overflow somewhere in my programs (not a rhetoric question)?"

Oh yeah. Skilled hackers look for all of that. They'll look for that kind of stuff first since it saves time.

"The morale is an ignorant user can easily be exploited even on OpenBSD"

No argument from me there.

"while a security-savvy user can secure himself even on an insecure OS"

That's been disproven by too many pentests. You can cover lots of known risks but then get hit by something inherent in poor foundation you built on. I liken it to building your castle on foundation of quicksand. Security properties work layer by layer, piece by piece, from bottom up plus interactions with other systems via protocols. I might be able to secure DOS apps but DOS's intrinsic properties might eventually do me in. See what I'm talking about?

Re: Why OpenBSD Is Important to Me

#89

Post by floatboth »

cisstrd wrote: post #49
ktRolster wrote: post #45

Earlier quoted context omitted.

The only thing lacking for me on OpenBSD is it doesn't run Wine. Otherwise I would jump to it in a heartbeat...

I don't know it from the top of my head, but FreeBSD runs Wine iirc and afaik FreeBSD 11 (I know, not OpenBSD) will introduce bhyve, a hugely hyped hypervisor/virtual machine manager supporting among other things Windows Operating Systems, also there should be some improvements to the Linux Emulation Layer. Also there is this https://github.com/tony/steam-freebsd-client but not sure how good it works. This might or m…

bhyve already shipped in 10-RELEASE!

Re: Why OpenBSD Is Important to Me

#90

Post by nickpsecurity »

neerdowell wrote: post #82
nickpsecurity wrote: post #81

Earlier quoted context omitted.

We don't know. OpenBSD has so little market share that virtually nobody is testing those mitigations. However, many are similar to mitigations developed on other platforms and beaten. So, they'd probably be beaten with effort, too. Don't you love reasoning by precedent? Makes these judgment calls so much easier. :)

People are testing the mitigations. For example Qualsys' audit of OpenSMTPD[0] noted that a buffer overflow they found was not exploitable on OpenBSD as even a single byte overflow would smash the stack canary. [0] https://www.qualys.com/2015/10/02/opensmtpd-audit-report.txt

That's not trying to break the mitigations: it's simply testing if they stop an exploit which isn't designed to bypass the mitigations. Really easy to pull off. :) Below are examples of a clever scheme for stopping control flow attacks and a successful attempt to breaking it. When I say testing the mitigations, I mean work like what's in the second paper.

https://www.usenix.org/system/files/conference/usenixsecurit...

http://www.cs.berkeley.edu/~daw/papers/cfi-sec15.pdf

Note: Native Client, which protects Chrome, is a form of Control-flow Integrity. Hence, me using it as an example.

Post reply on HN