3 ms·
I would not put all of this on the same machine. Edit: To clarify - if one line of code is fd in any of the daemons you’re running you’ll lose everything. Pra
by rasengan 8y ago
I would not put all of this on the same machine.
Edit: To clarify - if one line of code is fd in any of the daemons you’re running you’ll lose everything.
Practice defense in depth.
Minimize the damage possible.
- im3w1l 8y agoI can see how that kind of makes sense. But if you ask people to run it from multiple machines chances are they will throw their hands up and say too hard and not self host at all?
- rasengan 8y agoAgreed and that would be a reason not to self host at all, if security is critical, because it IS difficult. For example, driving is convenient. That doesn’t mean someone who has never driven before should just drive. It’s definitely better for them to taxi. It’s a hard problem - we have to make things easier for people. When King Sejong saw that people were illiterate, he didn’t try to force everyone to suddenly learn a difficult language - he just made an easier one. Now korea is 99.9% literate.
- yellowapple 8y agoOpenBSD's standard practice is for all daemons to run as unprivileged users in chroots (after using pledge and - nowadays - unveil to restrict themselves further). If one line of code is fd in any of the daemons, it will by default be constrained to that daemon.
- rasengan 8y agoAbsolutely, and pledge is amazing. That being said, for example, let’s say pledge or unveil have one line of code that is fd.
- upofadown 8y agoYou mean as opposed to your container/virtualization having one line of code that is "fd"?
- rasengan 8y agoThe point of my statement is you have tens upon thousands of lines of code, systems are complex. You can’t put all your eggs in a basket given the probability that something is fd. Downvoting my statement is fine as long as it’s noobs learning from this script and not someone who is running critical infrastructure. :)
- yellowapple 8y ago"You can’t put all your eggs in a basket given the probability that something is fd." But you'd be doing that no matter what unless you're running each daemon on a different physical machine. That basket's just called "Xen" now instead of "OpenBSD". Worse, if the hypervisor has a bug that can be triggered from unprivileged guest code (i.e. as a non-root user in the guest OS), then any layers added in the guest are moot.
- seattleeng 8y agowhat is `fd` in this context?