4 ms·
> Do you really think the tools you use like your web browser, mail client etc, have less vulnerabilities on OpenBSD... A reasonable question, but presumptuous
by bch 9y ago
> Do you really think the tools you use like your web browser, mail client etc, have less vulnerabilities on OpenBSD...
A reasonable question, but presumptuously and poorly framed, I think. Mitigation efforts like privilege separation[0] (for daemons), ASLR[1], SSP[2], and now KARL[3] are designed to make things systemically better. I'm personally a NetBSD person, and don't see that ending anytime soon, but I do appreciate the work that OpenBSD does and pay attention with interest. I expect some of their work to be ported to my environment directly, and other effects to be felt tangentially. People running different or "weird" environments is a good thing.
[0] https://en.wikipedia.org/wiki/Privilege_separation https://en.wikipedia.org/wiki/Privilege_separation
[1] https://en.wikipedia.org/wiki/Address_space_layout_randomization https://en.wikipedia.org/wiki/Address_space_layout_randomiza...
[2] http://wiki.osdev.org/Stack_Smashing_Protector http://wiki.osdev.org/Stack_Smashing_Protector
[3] http://undeadly.org/cgi?action=article&sid=20170613041706 http://undeadly.org/cgi?action=article&sid=20170613041706
- saghm 9y agoOT, but I've had trouble in the past when trying out NetBSD; I wanted to install it on my laptop with full disk encryption, but I clearly was missing something about how to do it properly, and I've never been able to find a good guide for it. Any chance you might know a blog post or something that details how to do this properly for a NetBSD newbie like me?
- bch 9y agoI've run it in the past, but not recently. I'll see if something appears to me and try to post it here for you. And good luck with your NetBSD journey, with or without FDE. I've thoroughly enjoyed my years with it as my primary OS.
- bch 9y agoI'd start here - https://www.netbsd.org/docs/guide/en/chap-cgd.html https://www.netbsd.org/docs/guide/en/chap-cgd.html and point your IRC client to #netbsd on irc.freenode.net.
- saghm 9y agoThanks! I've tried out most of the other common BSDs (FreeBSD, OpenBSD, DragonflyBSD, and TrueOS) but I've always had more trouble with NetBSD for some reason. Hopefully I'll have better luck with it this time!
- deleted 9y ago[deleted]
- eugeneionesco 9y agoAll of those were developed on linux and linux distributions and were available on those before obsd...
- anthk 9y agoYeah, sure, linux has Pledge. Bullshit.
- eugeneionesco 9y agoOf course it does, seccomp, developed way before pledge :))
- sydney6 9y agoAnd where is seccomp used (by default)?
- ac29 9y agoChrome and Firefox both use seccomp by default on Linux.
- sydney6 9y agoOpenBSD has around 500 programs with pledge support in base. edit: and this number does not even include the ports available with pledge support, among others chromium.. and the fact that they were capable of adding pledge support this quickly says a lot, imho, about the implementation differences between libseccomp and pledge.
- anthk 9y agoNot the same approach.
- anthk 9y agoAlso, pledge is everywhere. Seppconf, not. And SeLinux just in few distros. Pledge is instrinsic. You have it right from the beggining with C and Perl. And it's straightforward to use.