6 ms·

SecBSD: Unix-like operating system focused on computer security

95 points by protomyth 8y ago

snazz 8y ago
So pretty much Kali for OpenBSD? Also, why use a VPN by default when many of the tools are intended to be run on the local network?
- Apes 8y ago
  I suspect the idea is that a VPN will provide encryption for all network traffic by default, preventing others on the local network from packet sniffing.
  - elchief 8y ago
    I use non-VPN IPSEC on my LAN. Works nicely
blotter_paper 8y ago
It says nothing about who the Dark Intelligence Team is, but this Google cache[0] has a little bit more info: >We are security enthusiasts from China, Germany, France, Netherlands, Norway, Switzerland, Mexico, India and Russia. Some of us have used *nix systems since 1999. >Coding && DeCoding && Talks && Beers && Wine && Pizzas && Good Music && Stuff && Hacking. So at least nine contributors, unless they're counting one person as being from multiple countries. [0] https://webcache.googleusercontent.com/search?q=cache:E2OiV-7ZhGIJ:https://secbsd.org/dark-intelligence-team.html https://webcache.googleusercontent.com/search?q=cache:E2OiV-...
- dmix 8y ago
  Heh, good catch.
bantunes 8y ago
Is security not an illusion with the current computer architectures? Sometimes it feels like we have to go back to architectures that separate code from data (Harvard) to really be secure.
- zerohp 8y ago
  A Harvard architecture, by itself, doesn't do anything to prevent code reuse attacks.
  - qubex 8y ago
    Indeed. The NX bit (which differentiates between executable and writable data) roughly approximates Harvard Architecture-like differences between types of memory, and likewise it cannot prevent code reuse attacks.
- mobilemidget 8y ago
  Imho, to use a metaphor, not much different than the glass windows of a car protecting the car contents. And then of course, some owners just leave the windows down, other 'car windows' have special foils, multilayer, some even have bullet resistent qualities, but give it time and physical access and it's always a car compromised in the end.
- muricula 8y ago
  Nah, you could still e.g. use a use after free to smash the return address or a vtable on a Harvard machine and execute a ROP chain. If it did speculative execution too it would probably be vulnerable to spectre. There's nothing special about Harvard machines when it comes to security.
cpach 8y ago
”OpenVPN + ProtonVPN”? IMHO that is a red flag. Wireguard would be a better alternative.
- TimTheTinker 8y ago
  From the WireGuard homepage: > WireGuard is not yet complete. You should not rely on this code. It has not undergone proper degrees of security auditing and the protocol is still subject to change. We're working toward a stable 1.0 release, but that time has not yet come. I agree that WireGuard will be great when it's done. Is there something I'm missing?
  - jorvi 8y ago
    Maybe he meant that ProtonVPN has a pretty shady reputation on HN due to their business connections to TesoNet, which is a data mining company. Its a lot more complicated than that, but if you see ProtonVPN being shot down on HN, that's why. Further reading: https://news.ycombinator.com/item?id=17258203 https://news.ycombinator.com/item?id=17258203 https://news.ycombinator.com/item?id=17775326 https://news.ycombinator.com/item?id=17775326 Personally, even if there isn't anything actually shady going on, I would want my VPN provider to be beyond reproach. Any smart VPN provider wouldn't want even tenuous connections to data mining companies. It feels a bit dirt to recommend Private Internet Access since they were the ones who pointed this out on HN, but so far AFAIK they are the only ones that have have been court-tested. Other options would be TorGuard or Mullvad VPN. Mullvad even already supports WireGuard!
    - TimTheTinker 8y ago
      I just run my own VPN from a $5/month DigitalOcean droplet... I feel like all the public VPNs are like big honeypots I'd rather stay away from. > ProtonVPN has a pretty shady reputation on HN due to their business connections to TesoNet, which is a data mining company Does that mean ProtonMail also is no longer trustworthy?
      - jorvi 8y ago
snvzz 8y ago
>not microkernel, multiserver Huge TCB, they already fucked up. So much for security.
- agumonkey 8y ago
  https://www.allacronyms.com/TCB https://www.allacronyms.com/TCB
6c696e7578 8y ago
IMHO stock OpenBSD is a better start. Concise and secure. Sending all traffic through a VPN is probably a bad idea, it is better IMO to put /some/ traffic through the VPN that you want separated. Private browse through VPN, preferably in a VM. The "I'm not a robot" thread (https://news.ycombinator.com/item?id=19155643 https://news.ycombinator.com/item?id=19155643) from a few days ago showed just how much can be gleaned by javascript, that's probably enough to work out if your private browser is on the same computer as the non-private.
- cyberpunk 8y ago
  I think this is more geared at pentesters and such, think bsd-backed kali? I’m not so keen on the VPN by default thing though.. I hope they plan to upstream metasploit back to ports at least.
agumonkey 8y ago
Just when I google about Tails alternative..
- DyslexicAtheist 8y ago
  this is not a tails alternative. it's a workstation for pen-testing. like Kali
8d10fee0c89cfb5 8y ago
They said they want contributors, but I don't see any link for contributing. And their twitter account basically is only focus on raising money
- blotter_paper 8y ago
  The code isn't public yet. I imagine that if you want to get involved at this stage you'd need to contact them directly. Their email address and public-key are available here: https://www.secbsd.org/dark-intelligence-team.html https://www.secbsd.org/dark-intelligence-team.html
  - toyg 8y ago
    > The code isn’t public yet Can’t take it seriously from a security perspective, then.
mastrsushi 8y ago
Why can't they just be honest and call it an OpenBSD distro, rather than a Unix-like operating system.
ggm 8y ago
I am getting a lot of mental "red flags" over this one. its a bunch of distros of things, some of which are pentest, some of which are less clear to me, it has confusing statements about VPN. Kali is understood. It has a sense of purpose, a community, quite strong public statements of intent and purpose. This one. I mean sure, that lock-pick you bought from a guy in the pub, he said it was only for testing padlocks, but now you see other people testing doors along the hall and you're wondering what you just walked into...
_bashskids 8y ago
> pentesting * Laughs at 90% script kiddie userbase > Unix like As someone already pointed out, honestly call it openbsd distro. > BSD I doubt it will remain free & OSS. We can't say if the fork from OpenBSD is for security or relicensing purpose. And the lock-pick example is nearly perfect analogue in this thread.

95 points by protomyth 8y ago

So pretty much Kali for OpenBSD? Also, why use a VPN by default when many of the tools are intended to be run on the local network?

Apes 8y ago
I suspect the idea is that a VPN will provide encryption for all network traffic by default, preventing others on the local network from packet sniffing.
- elchief 8y ago
  I use non-VPN IPSEC on my LAN. Works nicely

blotter_paper 8y ago

It says nothing about who the Dark Intelligence Team is, but this Google cache[0] has a little bit more info: >We are security enthusiasts from China, Germany, France, Netherlands, Norway, Switzerland, Mexico, India and Russia. Some of us have used *nix systems since 1999. >Coding && DeCoding && Talks && Beers && Wine && Pizzas && Good Music && Stuff && Hacking. So at least nine contributors, unless they're counting one person as being from multiple countries. [0] https://webcache.googleusercontent.com/search?q=cache:E2OiV-7ZhGIJ:https://secbsd.org/dark-intelligence-team.html https://webcache.googleusercontent.com/search?q=cache:E2OiV-...

dmix 8y ago
Heh, good catch.

bantunes 8y ago

Is security not an illusion with the current computer architectures? Sometimes it feels like we have to go back to architectures that separate code from data (Harvard) to really be secure.

zerohp 8y ago
A Harvard architecture, by itself, doesn't do anything to prevent code reuse attacks.
- qubex 8y ago
  Indeed. The NX bit (which differentiates between executable and writable data) roughly approximates Harvard Architecture-like differences between types of memory, and likewise it cannot prevent code reuse attacks.
mobilemidget 8y ago
Imho, to use a metaphor, not much different than the glass windows of a car protecting the car contents. And then of course, some owners just leave the windows down, other 'car windows' have special foils, multilayer, some even have bullet resistent qualities, but give it time and physical access and it's always a car compromised in the end.
muricula 8y ago
Nah, you could still e.g. use a use after free to smash the return address or a vtable on a Harvard machine and execute a ROP chain. If it did speculative execution too it would probably be vulnerable to spectre. There's nothing special about Harvard machines when it comes to security.

cpach 8y ago

”OpenVPN + ProtonVPN”? IMHO that is a red flag. Wireguard would be a better alternative.

TimTheTinker 8y ago
From the WireGuard homepage: > WireGuard is not yet complete. You should not rely on this code. It has not undergone proper degrees of security auditing and the protocol is still subject to change. We're working toward a stable 1.0 release, but that time has not yet come. I agree that WireGuard will be great when it's done. Is there something I'm missing?
- jorvi 8y ago
  Maybe he meant that ProtonVPN has a pretty shady reputation on HN due to their business connections to TesoNet, which is a data mining company. Its a lot more complicated than that, but if you see ProtonVPN being shot down on HN, that's why. Further reading: https://news.ycombinator.com/item?id=17258203 https://news.ycombinator.com/item?id=17258203 https://news.ycombinator.com/item?id=17775326 https://news.ycombinator.com/item?id=17775326 Personally, even if there isn't anything actually shady going on, I would want my VPN provider to be beyond reproach. Any smart VPN provider wouldn't want even tenuous connections to data mining companies. It feels a bit dirt to recommend Private Internet Access since they were the ones who pointed this out on HN, but so far AFAIK they are the only ones that have have been court-tested. Other options would be TorGuard or Mullvad VPN. Mullvad even already supports WireGuard!
  - TimTheTinker 8y ago
    I just run my own VPN from a $5/month DigitalOcean droplet... I feel like all the public VPNs are like big honeypots I'd rather stay away from. > ProtonVPN has a pretty shady reputation on HN due to their business connections to TesoNet, which is a data mining company Does that mean ProtonMail also is no longer trustworthy?
    - jorvi 8y ago

snvzz 8y ago

>not microkernel, multiserver Huge TCB, they already fucked up. So much for security.

agumonkey 8y ago
https://www.allacronyms.com/TCB https://www.allacronyms.com/TCB

6c696e7578 8y ago

IMHO stock OpenBSD is a better start. Concise and secure. Sending all traffic through a VPN is probably a bad idea, it is better IMO to put /some/ traffic through the VPN that you want separated. Private browse through VPN, preferably in a VM. The "I'm not a robot" thread (https://news.ycombinator.com/item?id=19155643 https://news.ycombinator.com/item?id=19155643) from a few days ago showed just how much can be gleaned by javascript, that's probably enough to work out if your private browser is on the same computer as the non-private.

cyberpunk 8y ago
I think this is more geared at pentesters and such, think bsd-backed kali? I’m not so keen on the VPN by default thing though.. I hope they plan to upstream metasploit back to ports at least.

agumonkey 8y ago

Just when I google about Tails alternative..

DyslexicAtheist 8y ago
this is not a tails alternative. it's a workstation for pen-testing. like Kali

8d10fee0c89cfb5 8y ago

They said they want contributors, but I don't see any link for contributing. And their twitter account basically is only focus on raising money

blotter_paper 8y ago
The code isn't public yet. I imagine that if you want to get involved at this stage you'd need to contact them directly. Their email address and public-key are available here: https://www.secbsd.org/dark-intelligence-team.html https://www.secbsd.org/dark-intelligence-team.html
- toyg 8y ago
  > The code isn’t public yet Can’t take it seriously from a security perspective, then.

mastrsushi 8y ago

Why can't they just be honest and call it an OpenBSD distro, rather than a Unix-like operating system.

ggm 8y ago

I am getting a lot of mental "red flags" over this one. its a bunch of distros of things, some of which are pentest, some of which are less clear to me, it has confusing statements about VPN. Kali is understood. It has a sense of purpose, a community, quite strong public statements of intent and purpose. This one. I mean sure, that lock-pick you bought from a guy in the pub, he said it was only for testing padlocks, but now you see other people testing doors along the hall and you're wondering what you just walked into...

_bashskids 8y ago

> pentesting * Laughs at 90% script kiddie userbase > Unix like As someone already pointed out, honestly call it openbsd distro. > BSD I doubt it will remain free & OSS. We can't say if the fork from OpenBSD is for security or relicensing purpose. And the lock-pick example is nearly perfect analogue in this thread.