3 ms·

OpenBSD has a really novel concept of using unveil and pledge to contain processes into restricted-service operating modes. And being OpenBSD, these security fe

by icefog 7y ago

OpenBSD has a really novel concept of using unveil and pledge to contain processes into restricted-service operating modes. And being OpenBSD, these security features are actually turned on by default for many binaries. See discussion in https://news.ycombinator.com/item?id=17277067 https://news.ycombinator.com/item?id=17277067

saagarjha 7y ago
macOS has this already.
- icefog 7y ago
  Does it? On OpenBSD, Chrome cannot read my ~/.ssh directory, can the same guarantee be made on Mac?
  - saagarjha 7y ago
    Yes, you can write custom sandbox profiles and apply themselves to yourself using sandbox_init(3).
    - icefog 7y ago
      Good to know, but I don't need to write anything on OpenBSD. The protection is just enabled by default. That is more comforting to me as a user.
      - saagarjha 7y ago
        Certain programs have default protections applied to them, such as most App Store apps.