91–100 of 162 posts
Earlier quoted context omitted.
What a relief! Thanks for scratching that itch. Also turns out to be good code organization, but I needed that post to boot me up.
Someone should make a site for sharing little "guided tours" of open source code bases...
Earlier quoted context omitted.
There's also systemd's constant regressions and awkward interfaces and limited functionality when they replace existing solutions. It should have stopped at unifying init scripts, although upstart had that, SMF had it, so it's great to see nosh being cross-platform and able to import system unit files.
Speaking of SMF, it's interesting that the seemingly little effort to recreate it led to systemd, while nobody attempts to create a read/write implementation of ZFS. I mean, if you can accept the license of ZFS (huge piece of code), we could have just as well forked SMF, but a clean slate with a different license may have been a favorable choice.
Earlier quoted context omitted.
Just fyi we actually have multiple operating systems dedicated to security.
Can you elaborate on what the alternatives are? The more we all know, the better!
1: https://www.qubes-os.org/ 2: https://en.wikipedia.org/wiki/Chrome_OS#Security
I'm curious why the author says Linux is "insecure, anti-secure, and anti-privacy software" Can anyone explain this? Also, why OpenBSD specifically, and not FreeBSD for example?
why not freebsd? the freebsd project seem to focus exclusively on post-attack with jails and trustedbsd mac. fbsd has not implemented any of the modern exploit mitigation techniques. i mean, even os x has had full aslr since 2012 lol. some years ago fbsd was forked to hardenedbsd which has aslr, mprotect restrictions, non-exec pages on cpus w/o NX, randomized lib loading order, etc. i guess the freebsd project is too…
Earlier quoted context omitted.
Speaking of SMF, it's interesting that the seemingly little effort to recreate it led to systemd, while nobody attempts to create a read/write implementation of ZFS. I mean, if you can accept the license of ZFS (huge piece of code), we could have just as well forked SMF, but a clean slate with a different license may have been a favorable choice.
as to other init systems, OpenBSD did some work on their's http://undeadly.org/cgi?action=article&sid=20160508140927&mo...
Earlier quoted context omitted.
My intuition was that malware attacks were less prominent nowadays. I certainly cannot and will not deny the advantage of OpenBSD in front of malware, and I also cannot and do not ignore botnets, keyloggers, various code injection attacks, etc., but I believe nowadays what's at the highest risk is what we store on others' disks, i.e. the cloud , and what the commoners do, like emailing passwords in cleartext, using c…
"My intuition was that malware attacks were less prominent nowadays." They are and they aren't. What you're seeing is a combination of economics and improvements in software quality. Economics says they focus on whatever gets them the most zombified PC's since competition drives prices of each individual PC down in black market. To get this, they target apps with most widespread use. This is why almost all 0-days wer…
Earlier quoted context omitted.
it's not just that though, there's the push for systemd which was not welcomed and alienated a lot of sysadmin folk who frequent hackernews. personally I felt rather shafted by systemd, not because it's bad, but because my arguments were never even met, it was just a brushing off from some of the people who had already accepted it. So I tried the BSD's and they were significantly better than I imagined they would be,…
I'm 23, I used GNU/Linux since I was 11, and about at the beginning of this year (2016) I switched to FreeBSD. It was the first time I had an easily and consistently configurable, recreatable, understandable, enjoyable PC system that went out of the way once configured. It is so pleasurable that I don't even care I can't suspend and hibernate yet, even though I'd hardly turn of my computer and my workflow used to rel…
My laptop (thinkpad X201s) used to idle very rough under FreeBSD and suspend didn't work, but under openbsd it did.
Also there were some hardware drivers which appeared not to work at first but running 'fw_update' caused openbsd to download the device drivers I needed and they started working perfectly.
I'm still shocked how easy it was, sure I miss all my software that depends on /proc and I miss zfs.. but I can't think of an operating system that would fit my thinkpad better.
Earlier quoted context omitted.
"My intuition was that malware attacks were less prominent nowadays." They are and they aren't. What you're seeing is a combination of economics and improvements in software quality. Economics says they focus on whatever gets them the most zombified PC's since competition drives prices of each individual PC down in black market. To get this, they target apps with most widespread use. This is why almost all 0-days wer…
I do see what you're saying and I agree completely. But maybe I'm bad at telling my point: How can a secure OS help keep me from putting my credentials into a phishing webpage? How can it prevent me from setting my Facebook/Gmail password as riley89angel? How can it keep me from writing my passwords into plain text files? This is why I think user education is at least as important as a secure stack, and should be con…
I'll add that user education has mostly failed. The recent consensus in INFOSEC is we need to design solutions where it's hard to do it insecurely and still easy to use. Signal messaging app is a great example of that. Another is Combex's PowerBox scheme for permissions on files where file dialog transparently grants a single file's access to app when user uses it. OS or runtimr protects its security. But, what user is giving to what application is clear even without technical knowledge.
So, education plus better design like I described is next steps.
I'm curious why the author says Linux is "insecure, anti-secure, and anti-privacy software" Can anyone explain this? Also, why OpenBSD specifically, and not FreeBSD for example?
Since OpenBSD can be backdoored[1] with the same ease that the Linux kernel could be backdoored, I have no idea why all the fuss. Debian is pretty thorough in NOT including proprietary software if that's what we're talking about. As far as I'm concerned, it's good to have options and the OpenBSD developers have created software that I use daily (OpenSMTPd, SSH, PF, etc.) and for that, I'm thankful! ps. I know that de…
And you link to that not happening? Seems a bit silly.
Earlier quoted context omitted.
People are testing the mitigations. For example Qualsys' audit of OpenSMTPD[0] noted that a buffer overflow they found was not exploitable on OpenBSD as even a single byte overflow would smash the stack canary. [0] https://www.qualys.com/2015/10/02/opensmtpd-audit-report.txt
That's not trying to break the mitigations: it's simply testing if they stop an exploit which isn't designed to bypass the mitigations. Really easy to pull off. :) Below are examples of a clever scheme for stopping control flow attacks and a successful attempt to breaking it. When I say testing the mitigations, I mean work like what's in the second paper. https://www.usenix.org/system/files/conference/usenixsecurit..…
At least, that's the way I see it.
Now, are you saying that because it's possible to bypass the mitigations in some other cases, preventing that vulnerability (and others) doesn't matter?
Or, are you saying that it would be possible to craft an exploit that bypassed the stack protection for that particular vulnerability? In which case I would love to see your PoC.
Or something else?