9 ms·
>hardline views on security The only hardline view on security you'll encounter in the wild is "security is practical in our computational environments"[1]. On
by dexen 7y ago
>hardline views on security
The only hardline view on security you'll encounter in the wild is "security is practical in our computational environments"[1]. Only half-joking here.
My reading of Theo's quote is merely "the combination of x86/IA32/AMD64 and virtualization gives little to no factual security benefits, and plenty of pitfals".
I don't see Theo as being a hardliner about security, just meticulous about good engineering practices - as per OpenBSD's usual standards - and facing the problems & risks as they are.
[1] examples: "Rust/Java gives you security", "shortlisting the only allowed actions by end-user application gives you security", "hardcore firewalls give you security", "virtualization gives you security", "advanced architectures like Burroughs' give you security".
- Gibbon1 7y ago> examples: "Rust/Java gives you security" Reminds me a friend who worked on Javascript in the early days said it was the only thing that had any hope of providing minimal security at the time. Because Windows 3.1 and 95 +0x86 was a security trashfire.
- XorNot 7y agoExcept that's objectively wrong - x86 virtualization breakouts have been extremely rare in practice, and fixable till recently. The new class of attacks we now see target any type of shared code execution environment. OpenBSD is as vulnerable to this as anything else.
- astrange 7y agoOpenBSD disables hyperthreading, doesn't it? That's a smart defense against at least one of today's attacks. Doesn't help if you're a VM guest, but does if you're the host.
- redrabbyte 7y agothere's a foreshadow-ng variant specifically for vms, and it's arguably the worst