4 ms·

OpenBSD doesn't include the Apache HTTP server, so while their default settings might expose Apache bugs if you choose to use it, it's not fair to say it's a vu

OpenBSD doesn't include the Apache HTTP server, so while their default settings might expose Apache bugs if you choose to use it, it's not fair to say it's a vulnerability in OpenBSD

cryptonector 8y ago
This reasoning is getting annoying. If you do nothing with your OS, it's secure! If you use software it bundles it's not secure and it's not their fault (but they'll fix it anyways)! That is just oh so gimmicky. It reflects quite poorly on the project.
- bialpio 8y ago
  I think I'm missing something here. How is a bug in Apache an issue with OpenBSD?
  - mrkeen 8y ago
    I believe what's being referred to is the first sentence on the OpenBSD site: "Only two remote holes in the default install, in a heck of a long time!" A more cynical reading of it would be: "OpenBSD is secure as long as you don't run software on it." I share that cynicism. The discussion is relevant if you believe that an OS should have some responsibility for memory-related security issues.
    - bialpio 8y ago
      Thanks for clarifying! Although I don't agree with the sentiment that OS should be responsible for these particular security issues...
    - johnisgood 8y ago
      Emphasis on default install.
    - wahern 8y ago
      > The discussion is relevant if you believe that an OS should have some responsibility for memory-related security issues. Pedantically speaking, your point is valid. But as a practical matter, OpenBSD is the operating system that takes these issues the most seriously. They formalized the notion of Unix-based privilege separation, and systematically employed it across the system. They regularly perform system-wide code audits (including of bundled software, such as Apache back when they actually bundled Apache) to identify and remediate high-risk source code patterns (e.g. strcpy -> strlcpy, realloc -> reallocarray, etc). While people [still] debate the merits and performance of things like seccomp or Capsium, OpenBSD has incorporated pledge(2) into the vast majority of binaries on the system. They were the first to apply stack canaries, ASLR, W^X, and most recently PIE globally by default. And apropos the article, they were the first to implement their system malloc in a robust way that maximized the chances of catching memory bugs, sometimes sacrificing performance in a way that would be inconceivable for Linux distributions. And all of these things have resulted in a steady stream of bug fixes upstream to third-party packages from the ports collection. One of the reasons OpenBSD forks projects like openssh or libressl, or implements from scratch services like iked, httpd, ntpd, relayd, smtpd, and many others, is precisely so they can assume full responsibility and control for things like memory management. See https://www.openbsd.org/innovations.html https://www.openbsd.org/innovations.html When a researcher points out a potential issue on OpenBSD, they're emphasizing their point by leveraging OpenBSD's credibility and the hard work put into the system.
  - detaro 8y ago
    It's an issue with the Apache package from the OpenBSD ports tree: it was set up in a configuration not recommended for production by upstream, which means bugs that weren't expected to actually trigger in practical use (and thus didn't get attention) could happen there.
- pixl97 8y ago
  So I guess you love Windows with dozens of running executables and plenty of open ports out of the box? What, you don't want the Xbox service at start up?, too bad. OS security is rapidly decreased by increased running services. Minimizing your services reduces your risk footprint.
  - asveikau 8y ago
    It's funny how the tide of running executables seems to ebb and flow. Windows 7 seemed to be a good spot. With Windows 10 it's seemingly gone totally nuts again. They've had Windows Firewall enabled by default for several releases now so I don't think the open port thing is the same problem it used to be.
- wahern 8y ago
  FWIW, OpenBSD doesn't bundle Apache. OpenBSD has shipped with a homegrown HTTP daemon for several years, now--https://www.openbsd.org/papers/httpd-asiabsdcon2015.pdf https://www.openbsd.org/papers/httpd-asiabsdcon2015.pdf Apache is available as a port/package, but not many people use it. Even when installing a port/package like PHP it's more common to run it through httpd using PHP-FPM (i.e. FastCGI).

OpenBSD doesn't include the Apache HTTP server, so while their default settings might expose Apache bugs if you choose to use it, it's not fair to say it's a vulnerability in OpenBSD

cryptonector 8y ago

This reasoning is getting annoying. If you do nothing with your OS, it's secure! If you use software it bundles it's not secure and it's not their fault (but they'll fix it anyways)! That is just oh so gimmicky. It reflects quite poorly on the project.

bialpio 8y ago
I think I'm missing something here. How is a bug in Apache an issue with OpenBSD?
- mrkeen 8y ago
  I believe what's being referred to is the first sentence on the OpenBSD site: "Only two remote holes in the default install, in a heck of a long time!" A more cynical reading of it would be: "OpenBSD is secure as long as you don't run software on it." I share that cynicism. The discussion is relevant if you believe that an OS should have some responsibility for memory-related security issues.
  - bialpio 8y ago
    Thanks for clarifying! Although I don't agree with the sentiment that OS should be responsible for these particular security issues...
  - johnisgood 8y ago
    Emphasis on default install.
  - wahern 8y ago
    > The discussion is relevant if you believe that an OS should have some responsibility for memory-related security issues. Pedantically speaking, your point is valid. But as a practical matter, OpenBSD is the operating system that takes these issues the most seriously. They formalized the notion of Unix-based privilege separation, and systematically employed it across the system. They regularly perform system-wide code audits (including of bundled software, such as Apache back when they actually bundled Apache) to identify and remediate high-risk source code patterns (e.g. strcpy -> strlcpy, realloc -> reallocarray, etc). While people [still] debate the merits and performance of things like seccomp or Capsium, OpenBSD has incorporated pledge(2) into the vast majority of binaries on the system. They were the first to apply stack canaries, ASLR, W^X, and most recently PIE globally by default. And apropos the article, they were the first to implement their system malloc in a robust way that maximized the chances of catching memory bugs, sometimes sacrificing performance in a way that would be inconceivable for Linux distributions. And all of these things have resulted in a steady stream of bug fixes upstream to third-party packages from the ports collection. One of the reasons OpenBSD forks projects like openssh or libressl, or implements from scratch services like iked, httpd, ntpd, relayd, smtpd, and many others, is precisely so they can assume full responsibility and control for things like memory management. See https://www.openbsd.org/innovations.html https://www.openbsd.org/innovations.html When a researcher points out a potential issue on OpenBSD, they're emphasizing their point by leveraging OpenBSD's credibility and the hard work put into the system.
- detaro 8y ago
  It's an issue with the Apache package from the OpenBSD ports tree: it was set up in a configuration not recommended for production by upstream, which means bugs that weren't expected to actually trigger in practical use (and thus didn't get attention) could happen there.
pixl97 8y ago
So I guess you love Windows with dozens of running executables and plenty of open ports out of the box? What, you don't want the Xbox service at start up?, too bad. OS security is rapidly decreased by increased running services. Minimizing your services reduces your risk footprint.
- asveikau 8y ago
  It's funny how the tide of running executables seems to ebb and flow. Windows 7 seemed to be a good spot. With Windows 10 it's seemingly gone totally nuts again. They've had Windows Firewall enabled by default for several releases now so I don't think the open port thing is the same problem it used to be.
wahern 8y ago
FWIW, OpenBSD doesn't bundle Apache. OpenBSD has shipped with a homegrown HTTP daemon for several years, now--https://www.openbsd.org/papers/httpd-asiabsdcon2015.pdf https://www.openbsd.org/papers/httpd-asiabsdcon2015.pdf Apache is available as a port/package, but not many people use it. Even when installing a port/package like PHP it's more common to run it through httpd using PHP-FPM (i.e. FastCGI).