8 ms·
OpenBSD Recent Security Innovations
- cmurf 7y agoAnyone know why this link works in Chrome but not in Firefox? I get Peer could not decode an SSL handshake message. Error code: SSL_ERROR_DECODE_ERROR_ALERT
- snazz 7y agoWorks here on Firefox. Something to do with your internet connection or certificate store in particular?
- newnewpdro 7y agoWorks in FF just fine over here.
- sam_bristow 7y agoAre you on running on Fedora by any chance? You might've hit this issue: https://www.mail-archive.com/misc@openbsd.org/msg167825.html https://www.mail-archive.com/misc@openbsd.org/msg167825.html
- cmurf 7y agoYep, thanks.
- adioe3 7y agosee https://bugzilla.redhat.com/show_bug.cgi?id=1713416 https://bugzilla.redhat.com/show_bug.cgi?id=1713416
- cperciva 7y agoWait, OpenBSD didn't have MAP_NOCORE? FreeBSD added that in February 2000... I always assumed that the other BSDs had long since picked it up. Huh.
- wahern 7y agoPretty sure they've deliberately kept it out on principle: better to encrypt swap, ensure permissions on core files are strict, etc, rather than hope all applications correctly set MAP_NOCORE on every bit of sensitive data. Sounds like it just became too inconvenient to avoid, though.
- tedunangst 7y agoDeliberate makes it sound like we wanted secrets to appear in the core files. I don't think that's the case, but otherwise yes, there's been a certain amount of care to making core files secure.
- throwaway2048 7y agoWhy even bother with core files if you aren't a developer? they are completely useless for an average user and are really nothing but a risk.
- asveikau 7y agoI feel like this kind of culture may be dying in most places. But it used to be a common thing that you could pass a core file around to someone knowledgeable who knew what to do with it. In a workplace or university, maybe someone on staff who is technical. In a piece of software, either open source or commercial, maybe its developer. Obviously there is trust implicit in that, because core files contain your data. On Windows, their equivalent of core files gets sent to Microsoft and they run analysis on them to get most common stack traces for crashing bugs. If you're opted in.
- SmellyGeekBoy 7y agoTo be fair, I'm not sure OpenBSD is targeted at the "average user".
- bluGill 7y agoWhy doesn't the system automatically pass core files to someone who knows how to deal with them. I work on an embedded system and our system to get core files back from the users has meant a lot of crashes go from "no idea what happened, closed" to "found the bug and fixed it". Of course there are security implications. Developers are not allowed to see core files from real customers unless the customer agrees. However our test department and our beta tests agree to this. I don't think anyone has ever looked into a core file to see sensitive data not related to the crash but the possibility exists.
- anaphor 7y agohttps://man.openbsd.org/pledge.2 https://man.openbsd.org/pledge.2 is also pretty damn cool. It effectively lets you make your program use a least authority model of execution, and then you can grant it the capabilities it actually needs to run. I would love to see something similar on Linux (there is capsicum-linux, but it seems like it's abandoned).
- rurban 7y agoTotally uncool and a dead end. Nobody else will do it that way. "The promises argument is specified as a string, with space separated keywords". caps as strings to be tokenized at runtime are slow, insecure and not validated at compile-time. Never trust a parser in core. This needs to be a bitmask of course. Don't let ruby programmers add OS API's.
- aomix 7y agoThe PROT_WRITE tweak is interesting. Being able to enforce a bit of Write XOR Execute behavior in Write OR Execute arenas is nifty. It took this change for me to read into W^X and exactly what it entailed because my naive understanding was that the new no-syscall-from-writeable-page behavior would be almost identical in effect to the strict W^X behavior.
- sridca 7y agoGrr, HN is run by fascists.
- Lt_Riza_Hawkeye 7y agoIf you have data you don't want written to a core dump, then MAP_CONCEAL will literally only help you if that memory is in an mmap'd region. If it's in regular old virtual memory, you're fucked. So if you're going to add a flag to something to let users conceal a region of memory from a core dump, add it to madvise, adding it to mmap is just adding arbitrary restrictions on the programmer. Linux got it right with MADV_DONTDUMP
- quotemstr 7y agoAll memory is mmaped, especially on OpenBSD, which deprecated basically-mmap-with-a-mustache brk. There's no such thing as "regular old virtual memory".
- davidcuddeback 7y agoThere’s also malloc_conceal() and calloc_conceal(), as discussed in the article.
- joosters 7y agoWhy don’t they just default to not writing core dumps, and forcing the sysadmin to explicitly enable them when debugging an app? This setup seems like the worst of both worlds. Core dumps get written but now probably lack the information critical to debugging, making them worthless.