5 ms·
The security section should mention that as of 2015, FreeBSD still does not have ASLR.
by tshtf 11y ago
The security section should mention that as of 2015, FreeBSD still does not have ASLR.
- iheartmemcache 11y agoI am far from a blackhat/malware expert, but I've used enough ASLR exploits with ROP toys to win a few CTF's. I'm way too old to have any allegiance to BSD vs Linux vs POSIX{foo}. I say this to clarify my point - in the 90s I was a teenage-FreeBSD bigot; now, I don't give a hoot. To successfully manipulate the lack of memory address randomization (i.e., attack via ASLR), one either either has a target running BIND circa 1999 that will let you smash the stack and 'sploit da EIP remotely, or the malicious attacker has a local, non-jailed shell. At which point you have far more to worry about than ASLR. DEP and ASLR are effective (especially with doing interesting things more advanced than just swapping on a ROP gadget - JIT stream exploits are _very clever_) but I'd take the out-of-the-box FreeBSD over any distro of Linux out-of-the-box for security.
- betaby 11y agoTo be honest, FreeBSD lack so many other modern features that barely makes it usable. (Properly working)NUMA? Virtualization? Yes, I'm fully aware about work in progress.
- gopowerranger 11y agoAnd yet Netflix chose FreeBSD over Linux to serve about 40% of all internet traffic, as does WhatsApp.
- betaby 11y agoSince when Netflix accounts for 40% of internet traffic?
- gopowerranger 11y agoNetflix video accounts for over 40% of all internet traffic, yes.
- emaste 11y agoSee for example http://time.com/3901378/netflix-internet-traffic/ http://time.com/3901378/netflix-internet-traffic/ Note that the metric is actually downstream peak time consumer ISP traffic which is a little different than "40% of the Internet," but the fact remains that Netflix is using FreeBSD to serve a phenomenal amount of traffic.
- Confusion 11y agoIf you think someone may be saying something ridiculous, please reread carefully in a charitable manner (charity was not even required here).
- vezzy-fnord 11y agoFreeBSD supports being run as Xen dom0, has OS-level virtualization through jails, the bhyve hypervisor and can run as a VirtualBox host. I'm thus not sure what you mean by a lack of virtualization. Touché on NUMA. How this makes FreeBSD "barely usable" is beyond me.
- schwarze_pest 11y agoThere is a working ASLR patchset for FreeBSD. https://hardenedbsd.org/article/shawn-webb/2015-07-06/announcing-aslr-completion https://hardenedbsd.org/article/shawn-webb/2015-07-06/announ... So if you want ASLR you can have it. It's just not yet in a regular FreeBSD release.