14 ms·

It's objectively the right model, because it's simple enough to implement that the vast majority of OpenBSD is pledged, including many ports like Firefox. The v

by ori_b 8y ago

It's objectively the right model, because it's simple enough to implement that the vast majority of OpenBSD is pledged, including many ports like Firefox. The vast majority of other systems do not have the equivalent, in spite of having mechanisms that are in theory more powerful than pledge. Flexible sandboxes don't help if your programs don't run in them.

kbenson 8y ago
Maybe it's objectively the right model for right now, and the wrong model for tomorrow, which would make you both right. It's hard to get programmers and packagers to add new OS specific features, at least until most OS's support from variant of that feature, and then they either bite the bullet or they use from library to abstract it. Pledge is simple, and that helps people adopt it and start using it. When most operating systems are providing something equivalent and most programs are making some use of it, it then becomes a selling point to do it better, because the status quo has moved. At that point, pledge might not compare well, unless it has evolved.
- ori_b 8y ago
  > Maybe it's objectively the right model for right now, and the wrong model for tomorrow. I'm using my computer right now. And pledge is evolving over time, as we gain experience in what real programs need by implementing protection for them.
  - kbenson 8y ago
    Sure, but some things are hard to evolve after a while, and it may be that a clean (or older but more complex) implementation has advantages at some point. I have no idea if pledge will fall under this or not, but it's a common theme in computing.
deleted 8y ago
[deleted]
pcwalton 8y ago
Firefox is sandboxed via seccomp-bpf on Linux.
- jakeogh 8y ago
  Awesome. I just checked, and it appears one FF process is, and one is not: https://bpaste.net/show/d8b3d6ada513 https://bpaste.net/show/d8b3d6ada513 https://wiki.mozilla.org/Security/Sandbox/Seccomp https://wiki.mozilla.org/Security/Sandbox/Seccomp I would like much more general control, like disable write, or prevent forks, or net access, right from the executing shell. I have selinux experience, and it's too low level.

by ori_b 8y ago

kbenson 8y ago

Maybe it's objectively the right model for right now, and the wrong model for tomorrow, which would make you both right. It's hard to get programmers and packagers to add new OS specific features, at least until most OS's support from variant of that feature, and then they either bite the bullet or they use from library to abstract it. Pledge is simple, and that helps people adopt it and start using it. When most operating systems are providing something equivalent and most programs are making some use of it, it then becomes a selling point to do it better, because the status quo has moved. At that point, pledge might not compare well, unless it has evolved.

ori_b 8y ago
> Maybe it's objectively the right model for right now, and the wrong model for tomorrow. I'm using my computer right now. And pledge is evolving over time, as we gain experience in what real programs need by implementing protection for them.
- kbenson 8y ago
  Sure, but some things are hard to evolve after a while, and it may be that a clean (or older but more complex) implementation has advantages at some point. I have no idea if pledge will fall under this or not, but it's a common theme in computing.

deleted 8y ago

[deleted]

pcwalton 8y ago

Firefox is sandboxed via seccomp-bpf on Linux.

jakeogh 8y ago
Awesome. I just checked, and it appears one FF process is, and one is not: https://bpaste.net/show/d8b3d6ada513 https://bpaste.net/show/d8b3d6ada513 https://wiki.mozilla.org/Security/Sandbox/Seccomp https://wiki.mozilla.org/Security/Sandbox/Seccomp I would like much more general control, like disable write, or prevent forks, or net access, right from the executing shell. I have selinux experience, and it's too low level.