11 ms·

Put differently, why would anyone in their right mind use OS/2 to browse the web, given that it misses more than two decades in development of security techniqu

Put differently, why would anyone in their right mind use OS/2 to browse the web, given that it misses more than two decades in development of security techniques. As far as I understand Mensys and now Arca Noae never had the source code to the OS/2 kernel or foundational libraries. Given that this code was written in the late eighties-half nineties in a largely pre-internet world: - It's likely that many of the libraries are full of buffer overflows, double frees, dangling pointers, etc. - OS/2 is not a multi-user system, there is no boundary between a user and a root-like account. - OS/2 does not have modern mitigation techniques like (K)ASLR, probably no PIE/PIC, stack canaries, etc. - OS/2 (AFAIR) does not offer sandboxing facilities, such as seccomp, capsicum, or pledge. - OS/2 has no protection against recent CPU vulnerabilities. So, if you are using OS/2 to browse the web, you are purely relying on security through obscurity.

sanxiyn 8y ago
On the other hand, security through obscurity is effective in the real world.
- hamilyon2 8y ago
  I would like to hear about it more. What use cases does it have and any supporting evidence for it. Genuinely curious.
  - barking 8y ago
    I'd be guessing that there is no evidence because that would destroy the obscurity and thereby the security.
  - dosshell 8y ago
    I do not know if this counts but: - change default port for sshd will take away 99.9% off all random attacks. - many copy protections may count as this. Some of them uncrypt themself before running so that it is harder to disassemble the bin file on disc. Also some more creative protections have been around, https://www.makeuseof.com/tag/5-strange-video-game-copy-protection-measures-used-in-history/ https://www.makeuseof.com/tag/5-strange-video-game-copy-prot...
    - Fnoord 8y ago
      > change default port for sshd will take away 99.9% off all random attacks. Not running SSH takes away 100% of all SSH attacks. Only allowing certain IPs to connect also takes away more than just changing the port number. Its a matter of convenience and effort though.
  - TickleSteve 8y ago
    Lots of systems are based on "defence in depth", i.e. multiple layers of security. This approach acknowledges that any single layer of security will have holes somewhere just waiting to be found no matter how theoretically secure you think it is. The implementation matters, not the theory and quite often this is where the holes exist. "Obscurity" is just one of those layers. Given no security, e.g. wide open front door, adding a door will reduce the number of successful attackers. Having a lock & key is a level up, hiding the key would reduce the chances of a successful burglary even more. Armed guards on the door would again reduce the chances of you getting burgled. Adding barbed-wire around your house improves the situation again... and it goes on. None of those levels of defence are impenetrable, but they all help. "Security by obscurity alone is discouraged and not recommended by standards bodies" (https://en.wikipedia.org/wiki/Security_through_obscurity https://en.wikipedia.org/wiki/Security_through_obscurity)
  - nickpsecurity 8y ago
    Well, we often differentiate between "security by obscurity" and "obfuscation" since former became a common insult/no-no. The former is when enemies not knowing how something works is the security strategy. Lots of those systems fall easily. The latter is when it's an extra defense on top of otherwise good, security practices or at least a baseline not much different than what's common. I've found obfuscation an essential tool to delaying or defeating high-strength attackers. I tried to apply it to every level of the computing stack in my research. Here's a write-up with examples you could use: https://news.ycombinator.com/item?id=11856351 https://news.ycombinator.com/item?id=11856351
    - irundebian 8y ago
      I appreciate most of your posts regarding high-assurance but don't get used to your ideas on security by obscurity. Of course you shouldn't make it easy for attackers to get much information of your systems but you probably should do it for security evaluators. If security by obscurity doesn't take much effort and doesn't interfere with standard security principles (actually it does already when we think about open design/Kerckhoffs's principle , but what I mean is something like complexity increase) it may not harm your security. But if you spent to much effort, that effort could have probably been better used to increase the assurance of the system to be protected. I mean it does not sound very trivial and very beneficial to hide your CPU architecture from attackers. Maybe the effort is just is better spent in the assurance of the exposed network service or the compartmentalization of it.
      - nickpsecurity 8y ago
        "that effort could have probably been better used to increase the assurance of the system to be protected." Think about that kind of hard. The average person or developer would have to know how to block about everything a hacker can think of on their known configuration. Whereas, a hacker or group knowing nothing of their configuration aiming for highest number of compromises will focus on something widely known or used. Even the recent router hacks were devices that sold by the truckload. Even for a targeted scenario, they still gotta get information most of your employees won't even have if it's backend stuff. Much of what runs at my company is terminal, client server, and web apps on non-descript boxes all through VPN's and such. The attackers have to breach the strongest components or convince someone in IT to give them necessary information. How easy that con is varies company to company but there's methods for reducing risk of it, too. Using a different PDF reader, web server, embedded ISA, and so on takes barely any effort or brains. If its own defaults are decent, the switch immediately gives benefit of less, successful attacks with less downtime or restores needed. Even better if behind a guard that hides what things are running by faking an Intel Windows or Linux box. The few that implemented this strategy told me they went years without problems. If any of it gets popular, that benefit might go away. Worse is Better works in our favor for obfuscation, though. The crowds chase the worse things. The attackers stay right behind them. ;) EDIT: "If security by obscurity doesn't take much effort and doesn't interfere with standard security principles (actually it does already when we think about open design/Kerckhoffs's principle , but what I mean is something like complexity increase) it may not harm your security." Yeah, that's basically how I look at it. It shouldn't invalidate the existing mechanisms. It shouldn't take too much effort. Maybe a bit upfront one time for setup with maintenance being rather low. What one is looking for with obfuscations is that they knock out the average attacker's foothold into boxes or networks without using much time for defender. For high-strength attackers, they should be combined with detection mechanisms so they might expose themselves blindly trying attacks.
JdeBP 8y ago
They aren't using OS/2 to browse the WWW. They are using Mozilla Firefox to browse the WWW. In case you missed it, the headlined article even tells you that this is version 52 of Firefox, from March of last year. The same goes for many of these libraries that you vaguely allude to. They aren't part of the operating system. Almost all such major programs tend to have layers of either Unix-alike or Windows-alike libraries over the top of the operating system API. They are third-party add-ons, presumably built from equally recent versions. And that goes a long way down. This isn't Unix. There is no single, distinguished, "the" C library. Every compiler has its own C libraries.
- danieldk 8y ago
  They aren't using OS/2 to browse the WWW. They are using Mozilla Firefox to browse the WWW. In the end there will still be calls into the Presentation Manager to render pages on screen. Also, TCP/IP are handled through system libraries (tcp32.dll, so32dll.dll). So, there is a large surface area where Firefox will use system libraries. Besides that, the web browser can have vulnerabilities and runs untrusted code. It's pretty insane to use a browser in 2018 that doesn't execute Javascript in sandboxed processes.
  - JdeBP 8y ago
    Mozilla Firefox not sandboxing Javascript is not an OS/2 problem. It is a Mozilla Firefox problem. The problems with WWW browsers are not solved on other operating systems, are a lot more to do with a user being vulnerable to processes running as xyrself which multi-user semantics will not address on any operating system until the world starts taking advantage of GNU Hurd or nonce SIDs, and in large part lie within the application. * http://explainxkcd.com/wiki/index.php/1200:_Authorization http://explainxkcd.com/wiki/index.php/1200:_Authorization They lie in cryptography implementations, in the architecture of downloading programs across the WWW from arbitrary third parties and running them, in the access from one WWW site to another, in the architecture of "Web APIs" and non-document WWW sites, in document model implementations, and so forth. Presentation Manager and low-level sockets form almost none of this. You are positing that the major locus for flaws is libraries that literally provide the low-level read()/connect()/bind()/&c. library functions. Whereas the add-on libraries that the people porting these applications have to also build, from SSL libraries through HTML parsers to PNG and MPEG processors, form a lot of it; but are not part of OS/2 nor set in stone. You cannot have your cake and eat it. Either OS/2 comes with this stuff and it is a problem that the stuff is old with known vulnerabilities, or the problem is (as indeed explained in the headlined article) that OS/2 does not come with this stuff and a large amount of effort is needed in porting all of these modern libraries, runtimes, and even whole language development toolsets to OS/2. The reality is the latter. They are, after all, asking for money for doing one part of exactly that. But that reality means that vague handwaving about "written in a pre-Internet world" (which it of course was not, the Internet pre-dating any version of OS/2 by about a decade) is ill-thought. The irony is that the vast bulk of the so-called "surface area" in a WWW browser is in all of these application layers and libraries that are modern. Or, put more glibly: I don't expect any Javascript security holes in IBM WebExplorer ever.
matt_the_bass 8y ago
What does “pre-internet” have to do with “buffer overflows, double frees, dangling pointers”? I have no evidence, but I wouldn’t be surprised if code from them had less of these since there were far fewer code jockies that just hacked together code they don’t quite understand from google search results. I think most programmers then were much more classically trained.
- lallysingh 8y ago
  No, old programmers would do much worse. And the threat model for those systems didn't take in the web as an attack surface. The bugs described would only help with local privilege escalation before. Now they can be used to get access to the networked application. E.g. the browser uses a vulnerable library call with input from a web page, and that library call alters the return stack according to the input. The browser is now compromised.
  - matt_the_bass 8y ago
    Curious, why do you say “old programmers would do much worse”? That hasn’t been my experience.
    - fcbrooklyn 8y ago
      I don't think they mean "old" programmers exactly... more like "programmers back in the day". We just didn't have the quality of tools back then. Also, our machines were orders of magnitude less powerful, which meant we generally had to work with a lot less in the way of things like library support, frameworks, etc. I used to have an OS/2 box as my build machine. I think that box had 32k of RAM, and 4.7Mhz processor.
      - matt_the_bass 8y ago
        Yes, not nearly the quality of tools. When I was programming back then I programmed much closer to the cpu (less abstraction through libraries and less automated tools). This made me look much closer at the issues listed above. I also ready full books on the programming language and command sets. Unlike now, if I use a new library/language, I just scan the online docs to get the gist of what I need to do. So I guess I had the opposite experience.
fegu 8y ago
Indeed. But as obscurity goes, you can't get much higher than OS/2 :)
reaperducer 8y ago
>why would anyone in their right mind use OS/2 to browse the web, given that it misses more than two decades in development From the Arca Noae web site: "Firefox 38.8ESR is included by default, and 45.5ESR will be available soon as an update. Full HTML5 support is included. Visit YouTube and play what you like." And that was more than a year ago. I expect it's been updated since then.
Fnoord 8y ago
True, all OS/2 would need is a great RDP client.

sanxiyn 8y ago

On the other hand, security through obscurity is effective in the real world.

hamilyon2 8y ago
I would like to hear about it more. What use cases does it have and any supporting evidence for it. Genuinely curious.
- barking 8y ago
  I'd be guessing that there is no evidence because that would destroy the obscurity and thereby the security.
- dosshell 8y ago
  I do not know if this counts but: - change default port for sshd will take away 99.9% off all random attacks. - many copy protections may count as this. Some of them uncrypt themself before running so that it is harder to disassemble the bin file on disc. Also some more creative protections have been around, https://www.makeuseof.com/tag/5-strange-video-game-copy-protection-measures-used-in-history/ https://www.makeuseof.com/tag/5-strange-video-game-copy-prot...
  - Fnoord 8y ago
    > change default port for sshd will take away 99.9% off all random attacks. Not running SSH takes away 100% of all SSH attacks. Only allowing certain IPs to connect also takes away more than just changing the port number. Its a matter of convenience and effort though.
- TickleSteve 8y ago
  Lots of systems are based on "defence in depth", i.e. multiple layers of security. This approach acknowledges that any single layer of security will have holes somewhere just waiting to be found no matter how theoretically secure you think it is. The implementation matters, not the theory and quite often this is where the holes exist. "Obscurity" is just one of those layers. Given no security, e.g. wide open front door, adding a door will reduce the number of successful attackers. Having a lock & key is a level up, hiding the key would reduce the chances of a successful burglary even more. Armed guards on the door would again reduce the chances of you getting burgled. Adding barbed-wire around your house improves the situation again... and it goes on. None of those levels of defence are impenetrable, but they all help. "Security by obscurity alone is discouraged and not recommended by standards bodies" (https://en.wikipedia.org/wiki/Security_through_obscurity https://en.wikipedia.org/wiki/Security_through_obscurity)
- nickpsecurity 8y ago
  Well, we often differentiate between "security by obscurity" and "obfuscation" since former became a common insult/no-no. The former is when enemies not knowing how something works is the security strategy. Lots of those systems fall easily. The latter is when it's an extra defense on top of otherwise good, security practices or at least a baseline not much different than what's common. I've found obfuscation an essential tool to delaying or defeating high-strength attackers. I tried to apply it to every level of the computing stack in my research. Here's a write-up with examples you could use: https://news.ycombinator.com/item?id=11856351 https://news.ycombinator.com/item?id=11856351
  - irundebian 8y ago
    I appreciate most of your posts regarding high-assurance but don't get used to your ideas on security by obscurity. Of course you shouldn't make it easy for attackers to get much information of your systems but you probably should do it for security evaluators. If security by obscurity doesn't take much effort and doesn't interfere with standard security principles (actually it does already when we think about open design/Kerckhoffs's principle , but what I mean is something like complexity increase) it may not harm your security. But if you spent to much effort, that effort could have probably been better used to increase the assurance of the system to be protected. I mean it does not sound very trivial and very beneficial to hide your CPU architecture from attackers. Maybe the effort is just is better spent in the assurance of the exposed network service or the compartmentalization of it.
    - nickpsecurity 8y ago
      "that effort could have probably been better used to increase the assurance of the system to be protected." Think about that kind of hard. The average person or developer would have to know how to block about everything a hacker can think of on their known configuration. Whereas, a hacker or group knowing nothing of their configuration aiming for highest number of compromises will focus on something widely known or used. Even the recent router hacks were devices that sold by the truckload. Even for a targeted scenario, they still gotta get information most of your employees won't even have if it's backend stuff. Much of what runs at my company is terminal, client server, and web apps on non-descript boxes all through VPN's and such. The attackers have to breach the strongest components or convince someone in IT to give them necessary information. How easy that con is varies company to company but there's methods for reducing risk of it, too. Using a different PDF reader, web server, embedded ISA, and so on takes barely any effort or brains. If its own defaults are decent, the switch immediately gives benefit of less, successful attacks with less downtime or restores needed. Even better if behind a guard that hides what things are running by faking an Intel Windows or Linux box. The few that implemented this strategy told me they went years without problems. If any of it gets popular, that benefit might go away. Worse is Better works in our favor for obfuscation, though. The crowds chase the worse things. The attackers stay right behind them. ;) EDIT: "If security by obscurity doesn't take much effort and doesn't interfere with standard security principles (actually it does already when we think about open design/Kerckhoffs's principle , but what I mean is something like complexity increase) it may not harm your security." Yeah, that's basically how I look at it. It shouldn't invalidate the existing mechanisms. It shouldn't take too much effort. Maybe a bit upfront one time for setup with maintenance being rather low. What one is looking for with obfuscations is that they knock out the average attacker's foothold into boxes or networks without using much time for defender. For high-strength attackers, they should be combined with detection mechanisms so they might expose themselves blindly trying attacks.

JdeBP 8y ago

They aren't using OS/2 to browse the WWW. They are using Mozilla Firefox to browse the WWW. In case you missed it, the headlined article even tells you that this is version 52 of Firefox, from March of last year. The same goes for many of these libraries that you vaguely allude to. They aren't part of the operating system. Almost all such major programs tend to have layers of either Unix-alike or Windows-alike libraries over the top of the operating system API. They are third-party add-ons, presumably built from equally recent versions. And that goes a long way down. This isn't Unix. There is no single, distinguished, "the" C library. Every compiler has its own C libraries.

danieldk 8y ago
They aren't using OS/2 to browse the WWW. They are using Mozilla Firefox to browse the WWW. In the end there will still be calls into the Presentation Manager to render pages on screen. Also, TCP/IP are handled through system libraries (tcp32.dll, so32dll.dll). So, there is a large surface area where Firefox will use system libraries. Besides that, the web browser can have vulnerabilities and runs untrusted code. It's pretty insane to use a browser in 2018 that doesn't execute Javascript in sandboxed processes.
- JdeBP 8y ago
  Mozilla Firefox not sandboxing Javascript is not an OS/2 problem. It is a Mozilla Firefox problem. The problems with WWW browsers are not solved on other operating systems, are a lot more to do with a user being vulnerable to processes running as xyrself which multi-user semantics will not address on any operating system until the world starts taking advantage of GNU Hurd or nonce SIDs, and in large part lie within the application. * http://explainxkcd.com/wiki/index.php/1200:_Authorization http://explainxkcd.com/wiki/index.php/1200:_Authorization They lie in cryptography implementations, in the architecture of downloading programs across the WWW from arbitrary third parties and running them, in the access from one WWW site to another, in the architecture of "Web APIs" and non-document WWW sites, in document model implementations, and so forth. Presentation Manager and low-level sockets form almost none of this. You are positing that the major locus for flaws is libraries that literally provide the low-level read()/connect()/bind()/&c. library functions. Whereas the add-on libraries that the people porting these applications have to also build, from SSL libraries through HTML parsers to PNG and MPEG processors, form a lot of it; but are not part of OS/2 nor set in stone. You cannot have your cake and eat it. Either OS/2 comes with this stuff and it is a problem that the stuff is old with known vulnerabilities, or the problem is (as indeed explained in the headlined article) that OS/2 does not come with this stuff and a large amount of effort is needed in porting all of these modern libraries, runtimes, and even whole language development toolsets to OS/2. The reality is the latter. They are, after all, asking for money for doing one part of exactly that. But that reality means that vague handwaving about "written in a pre-Internet world" (which it of course was not, the Internet pre-dating any version of OS/2 by about a decade) is ill-thought. The irony is that the vast bulk of the so-called "surface area" in a WWW browser is in all of these application layers and libraries that are modern. Or, put more glibly: I don't expect any Javascript security holes in IBM WebExplorer ever.

matt_the_bass 8y ago

What does “pre-internet” have to do with “buffer overflows, double frees, dangling pointers”? I have no evidence, but I wouldn’t be surprised if code from them had less of these since there were far fewer code jockies that just hacked together code they don’t quite understand from google search results. I think most programmers then were much more classically trained.

lallysingh 8y ago
No, old programmers would do much worse. And the threat model for those systems didn't take in the web as an attack surface. The bugs described would only help with local privilege escalation before. Now they can be used to get access to the networked application. E.g. the browser uses a vulnerable library call with input from a web page, and that library call alters the return stack according to the input. The browser is now compromised.
- matt_the_bass 8y ago
  Curious, why do you say “old programmers would do much worse”? That hasn’t been my experience.
  - fcbrooklyn 8y ago
    I don't think they mean "old" programmers exactly... more like "programmers back in the day". We just didn't have the quality of tools back then. Also, our machines were orders of magnitude less powerful, which meant we generally had to work with a lot less in the way of things like library support, frameworks, etc. I used to have an OS/2 box as my build machine. I think that box had 32k of RAM, and 4.7Mhz processor.
    - matt_the_bass 8y ago
      Yes, not nearly the quality of tools. When I was programming back then I programmed much closer to the cpu (less abstraction through libraries and less automated tools). This made me look much closer at the issues listed above. I also ready full books on the programming language and command sets. Unlike now, if I use a new library/language, I just scan the online docs to get the gist of what I need to do. So I guess I had the opposite experience.

fegu 8y ago

Indeed. But as obscurity goes, you can't get much higher than OS/2 :)

reaperducer 8y ago

>why would anyone in their right mind use OS/2 to browse the web, given that it misses more than two decades in development From the Arca Noae web site: "Firefox 38.8ESR is included by default, and 45.5ESR will be available soon as an update. Full HTML5 support is included. Visit YouTube and play what you like." And that was more than a year ago. I expect it's been updated since then.

Fnoord 8y ago

True, all OS/2 would need is a great RDP client.