3 ms·
How is the security with Fossil? I'm always leery of hosting (niche) web facing services written in C.
by candiddevmike 6y ago
How is the security with Fossil? I'm always leery of hosting (niche) web facing services written in C.
- pmarin 6y agoWhat web server do you use?
- candiddevmike 6y agoCaddy, though I have used NGINX and HAProxy in the past. I get your point, but those projects have corporate backing and a lot of scrutiny. A niche C project seems less likely to have that.
- pmarin 6y agoDo you know the author of Fossil is the same person who wrote sqlite?
- exikyut 6y agoSQLite3 is the only project I have ever seen that casually makes (non-normative, non-legally-binding) confident reference to its suitability for use in medical devices.
- iudqnolq 6y agoI just saw today it's "aviation certified", which I assumed was the same but turned out to be literally true.
- zie 6y agoMy understanding is, if you pay for a support contract, they are happy to make it legally binding. It's literally the most used database in the world, but a giant margin. Every Android and iOS device and every mac and linux machine use SQLite. I haven't ever bothered to check Windows, but I bet they use it too.
- exikyut 6y agoApache and nginx are C As is stunnel, which is what the canonical fossil website uses to handle HTTPS
- mscrnt 6y agoAnd httpd and relayd.
- wyoung2 6y agoFossil is a single executable with low system requirements operating on a single SQLite database file, so it's really easy to chroot. It'll even chroot itself if started as root: https://www.fossil-scm.org/home/doc/trunk/www/chroot.md https://www.fossil-scm.org/home/doc/trunk/www/chroot.md If you want something more complicated (BSD jails, Docker, etc.) the same properties make it easy to box up that way instead.
- SQLite 6y agoIt's a fair question. I need to better document the security features built into Fossil. Here is a quick off-the-top-of-my-head summary: (1) Fossil is designed to run inside a minimal chroot jail. The stand-alone "fossil" binary needs its repository database file, /dev/null, and /dev/random and nothing else. It can run inside a sparse jail. So even if somebody manages to find an RCE in Fossil, the damage potential is limited. They cannot shell-out because there is no /bin/sh in the jail. (2) Fossil processes each HTTP request in a separate process. (3) Custom static-analysis tools run over the Fossil sources at compile-time, and abort the built if any problems are seen. The source code and docs to these tools is in the Fossil source tree.
- sgbeal 6y ago> How is the security with Fossil? I'm always leery of hosting (niche) web facing services written in C. Fossil's been available for nearly 14 years now and we've had to make only a single security-relevant release in that time (in late Summer 2020). Fossil's primary architect, Richard Hipp (edit: HN user "SQLite"), is no stranger to code hardening and continues to add security-related APIs to all levels of the code, from how we internally build SQL queries or encode URL arguments to the recent (late 2020) ability for the db to lock down regions of the db until/unless that protection is toggled off for the brief blocks of code which need to modify those regions, ensuring that other areas of the code cannot modify parts of the database which they aren't directly responsible for. Security against malicious inputs has never been treated as an afterthought in fossil.