3 ms·

I love obsd and agree with all your points...except security. A Whonix developer and GrapheneOS contributor wrote this up better than I can: https://madaidans-i

by Seirdy 5y ago

I love obsd and agree with all your points...except security. A Whonix developer and GrapheneOS contributor wrote this up better than I can: https://madaidans-insecurities.github.io/openbsd.html https://madaidans-insecurities.github.io/openbsd.html

mikem170 5y ago
Thanks for that link. I'll have to dig into a few of those things more, ROP is something I have not bumped into before. Comparisons to Windows/Mac/Chrome/Android security are kind of a moot point for me, given that they are tools of corporate surveillance capitalism. I wondered how linux stacked up, outside of the mentioned MAC capabilities, but the article was more focused on openbsd. How much does MAC buy if I don't notice that I've outgrown the granularity of normal file system permissions? I know that does often come up in environments with more users. Do you think openbsd has worse security than normal linux? (not selinux) My next planned security update is to attempt to separate apps that need network access from those that do not. I'm still brainstorming on how to best do this, maybe leveraging the ability of the pf firewall to allow/deny traffic by user account.
- Seirdy 5y ago
  The author also wrote about Linux's lack of exploit mitigations and sandboxing: https://madaidans-insecurities.github.io/linux.html https://madaidans-insecurities.github.io/linux.html Android's surveillance is mostly in stock android and other derivatives, but not in AOSP; AOSP has no Play services. GrapheneOS is a downstream ROM that adds further hardening and privacy enhancements. I view MAC as quite essential. On top of that, Clang on Linux supports sanitizers like CFI, safe-stack/shadow-call-stack, and a few others; check the Clang docs for more info. Linux supports dm-verity which can help ensure the integrity of the base system, and can combine with UEFI Secure Boot for getting some of the way towards a fully verified boot. I also don't know of a USBGuard- or kloak-equivalent for OpenBSD. USBGuard is essential for physical security regarding removable media, and kloak anonymizes keystroke input. There is no OpenBSD web browser that's remotely secure; they all use Linux, macOS, and Windows sandboxing/hardening measures. I never enable JS in obsd; if I absolutely must, I run the browser in a VM and disable JIT.
  - mikem170 5y ago
    I browsed some other articles on the site you linked. Wow. So many mitigations, yet still so many potential vulnerabilities. What a hassle to worry about all this! I'm reminded of a favorite movie quote that be appropos: "The only winning move is not to play". My biggest easiest takeaway may be a reminder to remain portable, in case I want to switch to another os at some point. btw, I'm with you on disabling javascript. I make exceptions for only a few sites, like banks, and duckduckgo. I pretty closely followed this guide [0] on configuring firefox, disabling all kinds of things like hw acceleration, wasm, fonts and javascript via ublock origin, etc. [0] https://12bytes.org/articles/tech/firefox/firefoxgecko-configuration-guide-for-privacy-and-performance-buffs/ https://12bytes.org/articles/tech/firefox/firefoxgecko-confi...
    - Seirdy 5y ago
      Might wanna disable JIT, MathML, SVG, Graphite font rendering, asm.js, webgl, webgpu, hyperlink auditing, and native regexp while you're at it. Here's what torbutton disables, for reference: https://gitweb.torproject.org/torbutton.git/tree/modules/security-prefs.js https://gitweb.torproject.org/torbutton.git/tree/modules/sec... Note that this will make you quite fingerprintable on sites with JS enabled. I'd rather split browsing across three browsers: one heavily neutered FF with the above prefs and my own personal customizations, one chromium (built properly with all mitigations, i.e. using is_official_build and not a distro package) for secure JS-enabled browsing (jitless and with all telemetry disabled/blocked, of course), and the Tor browser for anonymous browsing. Avoid ungoogled-chromium; its patches significantly weaken the browser's security by disabling component updates, and you'll have to build it yourself if you want all the exploit migigations included (since none of the available builds are built properly). I'd avoid extensions if at all possible since they very heavily weaken the browser security model. Chromium lets you enable extensions on a per-site basis, which I find helpful. Extensions that inject content also make fingerprinting quite trivial: without any JS I can uniquely identify, e.g., a Canvas Fingerprinting Defender user by eyeballing a CSP report log against an access log, no JS needed.

by Seirdy 5y ago

mikem170 5y ago

Thanks for that link. I'll have to dig into a few of those things more, ROP is something I have not bumped into before. Comparisons to Windows/Mac/Chrome/Android security are kind of a moot point for me, given that they are tools of corporate surveillance capitalism. I wondered how linux stacked up, outside of the mentioned MAC capabilities, but the article was more focused on openbsd. How much does MAC buy if I don't notice that I've outgrown the granularity of normal file system permissions? I know that does often come up in environments with more users. Do you think openbsd has worse security than normal linux? (not selinux) My next planned security update is to attempt to separate apps that need network access from those that do not. I'm still brainstorming on how to best do this, maybe leveraging the ability of the pf firewall to allow/deny traffic by user account.

Seirdy 5y ago
The author also wrote about Linux's lack of exploit mitigations and sandboxing: https://madaidans-insecurities.github.io/linux.html https://madaidans-insecurities.github.io/linux.html Android's surveillance is mostly in stock android and other derivatives, but not in AOSP; AOSP has no Play services. GrapheneOS is a downstream ROM that adds further hardening and privacy enhancements. I view MAC as quite essential. On top of that, Clang on Linux supports sanitizers like CFI, safe-stack/shadow-call-stack, and a few others; check the Clang docs for more info. Linux supports dm-verity which can help ensure the integrity of the base system, and can combine with UEFI Secure Boot for getting some of the way towards a fully verified boot. I also don't know of a USBGuard- or kloak-equivalent for OpenBSD. USBGuard is essential for physical security regarding removable media, and kloak anonymizes keystroke input. There is no OpenBSD web browser that's remotely secure; they all use Linux, macOS, and Windows sandboxing/hardening measures. I never enable JS in obsd; if I absolutely must, I run the browser in a VM and disable JIT.
- mikem170 5y ago
  I browsed some other articles on the site you linked. Wow. So many mitigations, yet still so many potential vulnerabilities. What a hassle to worry about all this! I'm reminded of a favorite movie quote that be appropos: "The only winning move is not to play". My biggest easiest takeaway may be a reminder to remain portable, in case I want to switch to another os at some point. btw, I'm with you on disabling javascript. I make exceptions for only a few sites, like banks, and duckduckgo. I pretty closely followed this guide [0] on configuring firefox, disabling all kinds of things like hw acceleration, wasm, fonts and javascript via ublock origin, etc. [0] https://12bytes.org/articles/tech/firefox/firefoxgecko-configuration-guide-for-privacy-and-performance-buffs/ https://12bytes.org/articles/tech/firefox/firefoxgecko-confi...
  - Seirdy 5y ago
    Might wanna disable JIT, MathML, SVG, Graphite font rendering, asm.js, webgl, webgpu, hyperlink auditing, and native regexp while you're at it. Here's what torbutton disables, for reference: https://gitweb.torproject.org/torbutton.git/tree/modules/security-prefs.js https://gitweb.torproject.org/torbutton.git/tree/modules/sec... Note that this will make you quite fingerprintable on sites with JS enabled. I'd rather split browsing across three browsers: one heavily neutered FF with the above prefs and my own personal customizations, one chromium (built properly with all mitigations, i.e. using is_official_build and not a distro package) for secure JS-enabled browsing (jitless and with all telemetry disabled/blocked, of course), and the Tor browser for anonymous browsing. Avoid ungoogled-chromium; its patches significantly weaken the browser's security by disabling component updates, and you'll have to build it yourself if you want all the exploit migigations included (since none of the available builds are built properly). I'd avoid extensions if at all possible since they very heavily weaken the browser security model. Chromium lets you enable extensions on a per-site basis, which I find helpful. Extensions that inject content also make fingerprinting quite trivial: without any JS I can uniquely identify, e.g., a Canvas Fingerprinting Defender user by eyeballing a CSP report log against an access log, no JS needed.