8 ms·

https://marc.info/?l=openbsd-misc&m=119318909016582 https://marc.info/?l=openbsd-misc&m=119318909016582 From: Theo de Raadt > Virtualization seems t

https://marc.info/?l=openbsd-misc&m=119318909016582 https://marc.info/?l=openbsd-misc&m=119318909016582 From: Theo de Raadt > Virtualization seems to have a lot of security benefits. You've been smoking something really mind altering, and I think you should share it. x86 virtualization is about basically placing another nearly full kernel, full of new bugs, on top of a nasty x86 architecture which barely has correct page protection. Then running your operating system on the other side of this brand new pile of shit. You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes. You've seen something on the shelf, and it has all sorts of pretty colours, and you've bought it. That's all x86 virtualization is.

brynet 11y ago
A mailing list post from 8 years ago. And a lot of virtualization implementations have had security issues. I don't think that precludes an attempt at getting it right in OpenBSD.
- atmosx 11y ago
  > [...] an attempt at getting it right in OpenBSD. So... The others got it wrong, and you're gonna get it right! :-) How do you justify the 1.3% share on servers[1]? There must be something GNU/Linux got right! There's not even a mention of OpenBSD[2], just Free and Net. People must be stupid, right? :-) [1] http://w3techs.com/technologies/details/os-unix/all/all http://w3techs.com/technologies/details/os-unix/all/all [2] http://w3techs.com/technologies/details/os-bsd/all/all http://w3techs.com/technologies/details/os-bsd/all/all
  - ascendantlogic 11y ago
    OpenBSD (collectively) has made a career out of getting it "right" where other people have not re: security. They've had their own missteps but that doesn't mean they shouldn't give it a try.
  - brynet 11y ago
    Appreciate the market share update, that confirms it. BSD is dying.
    - vezzy-fnord 11y ago
      We're right back to Slashdot golden-era Netcraft copypastas. (Also, when will people learn that market share is not a proxy for technical superiority?)
      - mikeash 11y ago
        People will learn that market share is not a proxy for technical superiority the precise moment they find themselves advocating something with a small market share, and not a moment before.
        BrainInAJar 11y ago
        and it will be heavily compartmentalized to that one thing.
      - jfb 11y ago
        > Also, when will people learn that market share is not a proxy for technical superiority? When they argue their point honestly, and not reach for ex post facto rationalizations?
      - mhurron 11y ago
        You know, I haven't seen that in forever. I feel nostalgic. =========================================================== It is now official. Netcraft has confirmed: BSD is dying One more crippling bombshell hit the already beleaguered BSD community when IDC confirmed that BSD market share has dropped yet again, now down to less than a fraction of 1 percent of all servers. Coming on the heels of a recent Netcraft survey which plainly states that BSD has lost more market share, this news serves to reinforce what we've known all along. BSD is collapsing in complete disarray, as fittingly exemplified by failing dead last [samag.com] in the recent Sys Admin comprehensive networking test. You don't need to be the Amazing Kreskin [amazingkreskin.com] to predict BSD's future. The hand writing is on the wall: BSD faces a bleak future. In fact there won't be any future at all for BSD because BSD is dying. Things are looking very bad for BSD. As many of us are already aware, BSD continues to lose market share. Red ink flows like a river of blood. FreeBSD is the most endangered of them all, having lost 93% of its core developers. The sudden and unpleasant departures of long time FreeBSD developers Jordan Hubbard and Mike Smith only serve to underscore the point more clearly. There can no longer be any doubt: FreeBSD is dying. Let's keep to the facts and look at the numbers. OpenBSD leader Theo states that there are 7000 users of OpenBSD. How many users of NetBSD are there? Let's see. The number of OpenBSD versus NetBSD posts on Usenet is roughly in ratio of 5 to 1. Therefore there are about 7000/5 = 1400 NetBSD users. BSD/OS posts on Usenet are about half of the volume of NetBSD posts. Therefore there are about 700 users of BSD/OS. A recent article put FreeBSD at about 80 percent of the BSD market. Therefore there are (7000+1400+700)*4 = 36400 FreeBSD users. This is consistent with the number of FreeBSD Usenet posts. Due to the troubles of Walnut Creek, abysmal sales and so on, FreeBSD went out of business and was taken over by BSDI who sell another troubled OS. Now BSDI is also dead, its corpse turned over to yet another charnel house. All major surveys show that BSD has steadily declined in market share. BSD is very sick and its long term survival prospects are very dim. If BSD is to survive at all it will be among OS dilettante dabblers. BSD continues to decay. Nothing short of a miracle could save it at this point in time. For all practical purposes, BSD is dead.
  - chrismsnz 11y ago
    > How do you justify the 1.3% share on servers[1]? OpenBSD is a research operating system. A lot of their development and deployment methods do not align with the needs/wants of large infrastructure deployments (e.g. biannual releases, supported for 1 year). Happy to cull/reinvent legacy to suit modern systems and practices (e.g. utf8, doas, opensmtpd/ntpd/bgpd/sshd etc...) Refusal to support hardware without documentation or binary kernel blobs. Focus on simplicity and correctness, rather than legacy and kludges, which often gets in the way of sysadmins wanting to Get Stuff Working. Take your pick?
    - atmosx 11y ago
      Truth is, I know ... But it gives me a small but substantial amount of pleasure teasing OpenBSD fans :-P That said, I am grateful to OpenBSD developers because I use their software daily: OpenSMTPd, PF, SPAMd and SSH.
kozukumi 11y ago
To be fair that post is from 2007 which is like 32 years in tech years. Virtualisation technologies both hardware and software have improved a lot since then.
- venomsnake 11y ago
  But visualization also does more nowadays. We have a lot more surface area to get hit.
duaneb 11y ago
Just another iteration in the constant cycle of adding abstractions. What's another layer?
- nickpsecurity 11y ago
  The benefit was explained in an early, secure-virtualization project: http://www.cse.psu.edu/~trj1/cse543-f06/papers/vax_vmm.pdf http://www.cse.psu.edu/~trj1/cse543-f06/papers/vax_vmm.pdf Allows easier enforcement of isolation-based policies, easier verification of TCB, compatibility with existing OS/applications/tools, and optional debugging of above OS. Attempts to build secure UNIX's totally failed because it was inherently insecure in so many ways and took many API modifications. Many VM's, separation kernels, etc were built with strong security. Abstraction helps if applied correctly.
JustSomeNobody 11y ago
Exactly! We should all just give up and go home! /S
tedunangst 11y ago
That's not nearly as contradictory as it seems at first. Mike didn't say running OpenBSD on vmm would be more secure than running on hardware. Without commenting directly on the security of vmm, it can be simultaneously less secure and still useful.
- somedutchguy 11y ago
  Ted, can I ask a question? what's your opinion about network sockets and 9P?
protomyth 11y ago
your link is from 2007-10-24. more recently: from ruBSD in 2013 https://www.youtube.com/watch?v=OXS8ljif9b8 https://www.youtube.com/watch?v=OXS8ljif9b8 (6:36 mark) People do change their minds as they learn new things or the world changes.
Sanddancer 11y ago
The past several years have brought many additions to the x86 architecture that makes it more than shit atop shit. When he wrote it, things like Xen required you to build a kernel with special options for it to run, with all kinds of new and exciting bugs to discover. Things like page table virtualization, which provide a lot better page protection, or being able to shadow the vm control structures, which allow for nested VMs, or IOMMUs, which allow vms to access explicit pieces of hardware, just didn't exist. x86 is in a better condition for virtualization now, and layouts can finally done in a semi-sane way.
- jnky 11y ago
  Yeah, but on the other hand one might argue that there is no reason to believe Intel's hardware implementation of such features is more correct and less prone to errors than Xen's implementation in software.
jfb 11y ago
Without gainsaying what de Raadt says there, it's important to keep in mind that virtualization opens up the possibility to do things other than running a giant pile of Unix slop on top of a different giant pile of Unix slop -- see, for instance, projects like Mirage [1] [1] https://mirage.io https://mirage.io
mtgx 11y ago
Qubes OS [1] must've shown him the way. Many already consider it a more secure alternative to OpenBSD, and I don't think Theo likes his OS being called "second best" in security. [1] https://www.qubes-os.org/ https://www.qubes-os.org/
- nickpsecurity 11y ago
  Unlikely: there were a ton of server, desktop, and embedded virtualization projects and products before QubesOS. I listed them on their mailing list asking why they were reinventing the wheel instead of building on established work or improving hardware after they showed it was so flawed. Joanna's counter-arguments were disturbing and easily countered. Then she just started censoring any of my critiques on her blog while allowing positive comments lol. Promotes confidence in its security and her comment section's accuracy... Anyway, if OpenBSD copies anyone, I'd say copy the Nizza Security or Genode Architectures. They leverage the kind of good components (eg Nitpicker/NOVA) and tactics (eg resource management) I mentioned to QubesOS. I see Qubes since adopted a similar tactic in their graphics system. Has a few novelties but mostly a rehash of virtualization and CMW stuff good against common malware. Need stronger TCB and methods to stop nation-states. Other work at least goes in that direction although not there yet either. Nizza Security Architecture https://os.inf.tu-dresden.de/papers_ps/nizza.pdf https://os.inf.tu-dresden.de/papers_ps/nizza.pdf Genode http://genode.org/ http://genode.org/ EROS (example of one of best approaches) http://www.eros-os.org/papers/IEEE-Software-Jan-2002.pdf http://www.eros-os.org/papers/IEEE-Software-Jan-2002.pdf
  - mirimir 11y ago
    It would be very useful if you could post some links to relevant threads about Qubes.
    - nickpsecurity 11y ago
      Couldn't find it last I Google'd for whatever reason. Could've been lost, moved, or another thing she censored. Started with a conversation on one forum where I mentioned prior work and separation kernels. A reader brought it up on QubesOS mailing list with Joanna dismissing it and cutting our comments down. So, if you're wondering about my tone, that's why. She exploded on me with ranting nonsense mixed with some useful points about her position. Went back and forth a few rounds. Anyway, my cross-domain system saved a copy of my end of the conversation. My style is to fairly quote other person before each reply so context is obvious to readers. Anything else was ranting filler that was unimportant. You'll be able to clearly see what she was saying. Here's a Pastebin of the two logs. http://pastebin.com/dVYcexT4 http://pastebin.com/dVYcexT4
ChuckMcM 11y ago
It is one of my favorite posts of Theo's but it is a bit dated. Still what is advocated is not really practical (building a secure computer system (ISA, System Architecture, OS)). Something security folks have wanted to do for years and years, I even got to bid on one for some Maryland agency when I was at Sun. That said, you could do a lot worse than just running OpenBSD out of the box on your servers connected to the Internet security wise, and be hard pressed to do better without a lot of training.
chrismsnz 11y ago
Theo has been softening on x86 virt for a long time. Additionally, he's still right. Don't rely on it to enforce security boundries (e.g. host untrusted systems and trusted systems on different tin) and his rant is totally congruent with virtualisation having a place in OpenBSD

brynet 11y ago

A mailing list post from 8 years ago. And a lot of virtualization implementations have had security issues. I don't think that precludes an attempt at getting it right in OpenBSD.

atmosx 11y ago
> [...] an attempt at getting it right in OpenBSD. So... The others got it wrong, and you're gonna get it right! :-) How do you justify the 1.3% share on servers[1]? There must be something GNU/Linux got right! There's not even a mention of OpenBSD[2], just Free and Net. People must be stupid, right? :-) [1] http://w3techs.com/technologies/details/os-unix/all/all http://w3techs.com/technologies/details/os-unix/all/all [2] http://w3techs.com/technologies/details/os-bsd/all/all http://w3techs.com/technologies/details/os-bsd/all/all
- ascendantlogic 11y ago
  OpenBSD (collectively) has made a career out of getting it "right" where other people have not re: security. They've had their own missteps but that doesn't mean they shouldn't give it a try.
- brynet 11y ago
  Appreciate the market share update, that confirms it. BSD is dying.
  - vezzy-fnord 11y ago
    We're right back to Slashdot golden-era Netcraft copypastas. (Also, when will people learn that market share is not a proxy for technical superiority?)
    - mikeash 11y ago
      People will learn that market share is not a proxy for technical superiority the precise moment they find themselves advocating something with a small market share, and not a moment before.
      - BrainInAJar 11y ago
        and it will be heavily compartmentalized to that one thing.
    - jfb 11y ago
      > Also, when will people learn that market share is not a proxy for technical superiority? When they argue their point honestly, and not reach for ex post facto rationalizations?
    - mhurron 11y ago
      You know, I haven't seen that in forever. I feel nostalgic. =========================================================== It is now official. Netcraft has confirmed: BSD is dying One more crippling bombshell hit the already beleaguered BSD community when IDC confirmed that BSD market share has dropped yet again, now down to less than a fraction of 1 percent of all servers. Coming on the heels of a recent Netcraft survey which plainly states that BSD has lost more market share, this news serves to reinforce what we've known all along. BSD is collapsing in complete disarray, as fittingly exemplified by failing dead last [samag.com] in the recent Sys Admin comprehensive networking test. You don't need to be the Amazing Kreskin [amazingkreskin.com] to predict BSD's future. The hand writing is on the wall: BSD faces a bleak future. In fact there won't be any future at all for BSD because BSD is dying. Things are looking very bad for BSD. As many of us are already aware, BSD continues to lose market share. Red ink flows like a river of blood. FreeBSD is the most endangered of them all, having lost 93% of its core developers. The sudden and unpleasant departures of long time FreeBSD developers Jordan Hubbard and Mike Smith only serve to underscore the point more clearly. There can no longer be any doubt: FreeBSD is dying. Let's keep to the facts and look at the numbers. OpenBSD leader Theo states that there are 7000 users of OpenBSD. How many users of NetBSD are there? Let's see. The number of OpenBSD versus NetBSD posts on Usenet is roughly in ratio of 5 to 1. Therefore there are about 7000/5 = 1400 NetBSD users. BSD/OS posts on Usenet are about half of the volume of NetBSD posts. Therefore there are about 700 users of BSD/OS. A recent article put FreeBSD at about 80 percent of the BSD market. Therefore there are (7000+1400+700)*4 = 36400 FreeBSD users. This is consistent with the number of FreeBSD Usenet posts. Due to the troubles of Walnut Creek, abysmal sales and so on, FreeBSD went out of business and was taken over by BSDI who sell another troubled OS. Now BSDI is also dead, its corpse turned over to yet another charnel house. All major surveys show that BSD has steadily declined in market share. BSD is very sick and its long term survival prospects are very dim. If BSD is to survive at all it will be among OS dilettante dabblers. BSD continues to decay. Nothing short of a miracle could save it at this point in time. For all practical purposes, BSD is dead.
- chrismsnz 11y ago
  > How do you justify the 1.3% share on servers[1]? OpenBSD is a research operating system. A lot of their development and deployment methods do not align with the needs/wants of large infrastructure deployments (e.g. biannual releases, supported for 1 year). Happy to cull/reinvent legacy to suit modern systems and practices (e.g. utf8, doas, opensmtpd/ntpd/bgpd/sshd etc...) Refusal to support hardware without documentation or binary kernel blobs. Focus on simplicity and correctness, rather than legacy and kludges, which often gets in the way of sysadmins wanting to Get Stuff Working. Take your pick?
  - atmosx 11y ago
    Truth is, I know ... But it gives me a small but substantial amount of pleasure teasing OpenBSD fans :-P That said, I am grateful to OpenBSD developers because I use their software daily: OpenSMTPd, PF, SPAMd and SSH.

kozukumi 11y ago

To be fair that post is from 2007 which is like 32 years in tech years. Virtualisation technologies both hardware and software have improved a lot since then.

venomsnake 11y ago
But visualization also does more nowadays. We have a lot more surface area to get hit.

duaneb 11y ago

Just another iteration in the constant cycle of adding abstractions. What's another layer?

nickpsecurity 11y ago
The benefit was explained in an early, secure-virtualization project: http://www.cse.psu.edu/~trj1/cse543-f06/papers/vax_vmm.pdf http://www.cse.psu.edu/~trj1/cse543-f06/papers/vax_vmm.pdf Allows easier enforcement of isolation-based policies, easier verification of TCB, compatibility with existing OS/applications/tools, and optional debugging of above OS. Attempts to build secure UNIX's totally failed because it was inherently insecure in so many ways and took many API modifications. Many VM's, separation kernels, etc were built with strong security. Abstraction helps if applied correctly.

JustSomeNobody 11y ago

Exactly! We should all just give up and go home! /S

tedunangst 11y ago

That's not nearly as contradictory as it seems at first. Mike didn't say running OpenBSD on vmm would be more secure than running on hardware. Without commenting directly on the security of vmm, it can be simultaneously less secure and still useful.

somedutchguy 11y ago
Ted, can I ask a question? what's your opinion about network sockets and 9P?

protomyth 11y ago

your link is from 2007-10-24. more recently: from ruBSD in 2013 https://www.youtube.com/watch?v=OXS8ljif9b8 https://www.youtube.com/watch?v=OXS8ljif9b8 (6:36 mark) People do change their minds as they learn new things or the world changes.

Sanddancer 11y ago

The past several years have brought many additions to the x86 architecture that makes it more than shit atop shit. When he wrote it, things like Xen required you to build a kernel with special options for it to run, with all kinds of new and exciting bugs to discover. Things like page table virtualization, which provide a lot better page protection, or being able to shadow the vm control structures, which allow for nested VMs, or IOMMUs, which allow vms to access explicit pieces of hardware, just didn't exist. x86 is in a better condition for virtualization now, and layouts can finally done in a semi-sane way.

jnky 11y ago
Yeah, but on the other hand one might argue that there is no reason to believe Intel's hardware implementation of such features is more correct and less prone to errors than Xen's implementation in software.

jfb 11y ago

Without gainsaying what de Raadt says there, it's important to keep in mind that virtualization opens up the possibility to do things other than running a giant pile of Unix slop on top of a different giant pile of Unix slop -- see, for instance, projects like Mirage [1] [1] https://mirage.io https://mirage.io

mtgx 11y ago

Qubes OS [1] must've shown him the way. Many already consider it a more secure alternative to OpenBSD, and I don't think Theo likes his OS being called "second best" in security. [1] https://www.qubes-os.org/ https://www.qubes-os.org/

nickpsecurity 11y ago
Unlikely: there were a ton of server, desktop, and embedded virtualization projects and products before QubesOS. I listed them on their mailing list asking why they were reinventing the wheel instead of building on established work or improving hardware after they showed it was so flawed. Joanna's counter-arguments were disturbing and easily countered. Then she just started censoring any of my critiques on her blog while allowing positive comments lol. Promotes confidence in its security and her comment section's accuracy... Anyway, if OpenBSD copies anyone, I'd say copy the Nizza Security or Genode Architectures. They leverage the kind of good components (eg Nitpicker/NOVA) and tactics (eg resource management) I mentioned to QubesOS. I see Qubes since adopted a similar tactic in their graphics system. Has a few novelties but mostly a rehash of virtualization and CMW stuff good against common malware. Need stronger TCB and methods to stop nation-states. Other work at least goes in that direction although not there yet either. Nizza Security Architecture https://os.inf.tu-dresden.de/papers_ps/nizza.pdf https://os.inf.tu-dresden.de/papers_ps/nizza.pdf Genode http://genode.org/ http://genode.org/ EROS (example of one of best approaches) http://www.eros-os.org/papers/IEEE-Software-Jan-2002.pdf http://www.eros-os.org/papers/IEEE-Software-Jan-2002.pdf
- mirimir 11y ago
  It would be very useful if you could post some links to relevant threads about Qubes.
  - nickpsecurity 11y ago
    Couldn't find it last I Google'd for whatever reason. Could've been lost, moved, or another thing she censored. Started with a conversation on one forum where I mentioned prior work and separation kernels. A reader brought it up on QubesOS mailing list with Joanna dismissing it and cutting our comments down. So, if you're wondering about my tone, that's why. She exploded on me with ranting nonsense mixed with some useful points about her position. Went back and forth a few rounds. Anyway, my cross-domain system saved a copy of my end of the conversation. My style is to fairly quote other person before each reply so context is obvious to readers. Anything else was ranting filler that was unimportant. You'll be able to clearly see what she was saying. Here's a Pastebin of the two logs. http://pastebin.com/dVYcexT4 http://pastebin.com/dVYcexT4

ChuckMcM 11y ago

It is one of my favorite posts of Theo's but it is a bit dated. Still what is advocated is not really practical (building a secure computer system (ISA, System Architecture, OS)). Something security folks have wanted to do for years and years, I even got to bid on one for some Maryland agency when I was at Sun. That said, you could do a lot worse than just running OpenBSD out of the box on your servers connected to the Internet security wise, and be hard pressed to do better without a lot of training.

chrismsnz 11y ago

Theo has been softening on x86 virt for a long time. Additionally, he's still right. Don't rely on it to enforce security boundries (e.g. host untrusted systems and trusted systems on different tin) and his rant is totally congruent with virtualisation having a place in OpenBSD