6 ms·

This security tech usually ends up in other platforms too, strongly recommend donating to their work: https://www.openbsdfoundation.org/donations.html https://w

This security tech usually ends up in other platforms too, strongly recommend donating to their work: https://www.openbsdfoundation.org/donations.html https://www.openbsdfoundation.org/donations.html

bell-cot 4y ago
+1...but OpenBSD's webmaster might want to update that page, so it doesn't link to their 2020 Fundraising Campaign. (Their current Campaign - https://www.openbsdfoundation.org/campaign2022.html https://www.openbsdfoundation.org/campaign2022.html ) And "This security tech usually..." is a bit too modest. Just one example - OpenBSD is the origin of OpenSSH, which has been rather widely used for a decade or two now.
- fsckboy 4y ago
  OpenBSD does great work, but for the record OpenSSH started as a fork of the free SSH program developed by Tatu Ylönen; later versions of Ylönen's SSH were proprietary software offered by SSH Communications Security. https://en.wikipedia.org/wiki/OpenSSH https://en.wikipedia.org/wiki/OpenSSH
  - chasil 4y ago
    Realistically, OpenBSD completely reimplemented protocol 2 themselves. Since nobody uses protocol 1 anymore, very little of the original code from Tatu Ylönen remains in operation with default settings. ps I have had to use the SSH commercial release under VMS, and the compatibilities with OpenSSH are quite unpleasant.
    - gigantaure 4y ago
      i just read that page[1] earlier this week. this gives a great view on the amount of work performed by the openssh project after the fork of the last open source version. [1] https://www.openssh.com/history.html https://www.openssh.com/history.html
    - fsckboy 4y ago
      https://en.wikipedia.org/wiki/Ship_of_Theseus https://en.wikipedia.org/wiki/Ship_of_Theseus
- nayden 4y ago
  thanks for bringing this to our attention. fixed now: https://github.com/bob-beck/foundation-web/commit/d34479b48abf65732ca5923f37d58e03b4d182b4 https://github.com/bob-beck/foundation-web/commit/d34479b48a...
saagarjha 4y ago
This happens to already exist on macOS as VM_FLAGS_PERMANENT when setting up the mapping.
chasil 4y ago
The ROP-gadget stuff hasn't migrated to any other kernels that I have seen. As I understand it, previous ROP-gadget hardening included compiler modifications on system/function call return, trap sleds, and some other stuff that I don't remember. This is on top of the kernel and library relink at every boot (to really make ASLR more potent). These modifications include a verification that the jump is in the stack, and not at the tail of some function (and the other thing eludes my understanding). These are some OpenBSD references on ROP hardening: https://undeadly.org/cgi?action=article;sid=20170622065629 https://undeadly.org/cgi?action=article;sid=20170622065629 https://www.openbsd.org/papers/rop.pdf https://www.openbsd.org/papers/rop.pdf https://www.openbsd.org/papers/asiabsdcon2019-rop-paper.pdf https://www.openbsd.org/papers/asiabsdcon2019-rop-paper.pdf I think that the most notorious exploit of "Return-Oriented Programming" (ROP-gadget) flaws was Solarwinds; I understand that a ROP exploit sealed their fate. Maybe Windows is doing some of this in their kernel. "At this point, we noticed that Serv-U.dll and RhinoNET.dll both have ASLR support disabled, making them prime locations for ROP gadgets..." https://www.microsoft.com/security/blog/2021/09/02/a-deep-dive-into-the-solarwinds-serv-u-ssh-vulnerability/ https://www.microsoft.com/security/blog/2021/09/02/a-deep-di...
- saagarjha 4y ago
  This is because the ROP gadget hardening OpenBSD does is generally considered to be mostly useless by other kernels, which are moving to hardware-enforced control flow integrity instead.
  - chasil 4y ago
    I prefer to do all my financial transactions from Chromium on OpenBSD, on a machine where I have run me_cleaner. Am I happy to have ROP safeguards? You bet!
  - beachhead 4y ago
    Is the ROP gadget hardening OpenBSD does mostly useless tho? Can you elaborate?
    - 4y ago
hggh 4y ago
Too bad they don't accept peer-to-peer electronic cash
- 7vUYjPAG2fnx7fd 4y ago
  > Bitcoin donation via BitPay: The OpenBSD Foundation can accept donations in BTC via BitPay
  - groby_b 4y ago
    Yeah, but ideally you should make a donation of lasting value.
    - notaplumber1 4y ago
      That's what BitPay handles. The OpenBSD Foundation doesn't hold onto any Bitcoin, it's immediately converted into USD.
    - andirk 4y ago
      Almost every donation and purchase I have made would have been far more lucrative to the recipient had they kept it in BTC. But yes, I understand this is salty HN.
  - hggh 4y ago
    Peer-to-peer means there isn't a third party involved, and BTC stopped being electronic cash around 2014
na85 4y ago
And thus the failure of BSD-style licensing is thrown into sharp relief: Why are these projects that are used by many large and extraordinarily profitable tech enterprises dependent on community donations? I recommend not donating, because to do so directly supports corporate parasitism.
- Sunspark 4y ago
  The flip side of course is that improvements also come at the pace of volunteerism, and there are no boardroom meetings where a manager tells the BSD developers that they didn't type enough lines of code that week. If a corp wants a feature improved or implemented if it doesn't exist, they will have to pay someone and then they have to decide whether they will contribute it. If they do not, then they have to maintain a fork themselves which requires ongoing resources. At the end of the day, I don't think it really matters that much. The corps are providing a service not a software application. If they weren't using BSD, they'd be using something else.
- deleted 4y ago
  [deleted]
- iE4mHBzmoYezwbx 4y ago
  Really? Their biggest donors are large and extraordinarily profitable tech enterprises. (Like Google, Microsoft, and Facebook) And thus the success of BSD-style licensing is thrown into sharp relief. (Also the fact that you or I can go use it as much as we want for free and do whatever we want to it.)
- chasil 4y ago
  There used to be complaint from OpenBSD that large corporate users of OpenSSH weren't donating anything, so I sent them $100. Those days appear to be over. https://www.theregister.com/2015/07/08/microsoft_donates_to_openbsd_foundation/ https://www.theregister.com/2015/07/08/microsoft_donates_to_...
  - mekster 4y ago
    Better than nothing but it's far from what the title describes as "rains cash". MS : $25k - $50k Google , FB : $10k - $25k For them, that's like saying "Hi". For the financial value the OpenBSD foundation is creating, that's a miniscule return.
hansendc 4y ago
There honestly isn't that much "tech" to speak of here. We were literally talking about "immutable" mappings last week in Linux land: https://lore.kernel.org/all/b4f0dca5-1d15-67f7-4600-9a0a91e9d0bd@intel.com/ https://lore.kernel.org/all/b4f0dca5-1d15-67f7-4600-9a0a91e9... That said, this would be great to see in OpenBSD (or any other OS).

This security tech usually ends up in other platforms too, strongly recommend donating to their work: https://www.openbsdfoundation.org/donations.html https://www.openbsdfoundation.org/donations.html

bell-cot 4y ago

+1...but OpenBSD's webmaster might want to update that page, so it doesn't link to their 2020 Fundraising Campaign. (Their current Campaign - https://www.openbsdfoundation.org/campaign2022.html https://www.openbsdfoundation.org/campaign2022.html ) And "This security tech usually..." is a bit too modest. Just one example - OpenBSD is the origin of OpenSSH, which has been rather widely used for a decade or two now.

fsckboy 4y ago
OpenBSD does great work, but for the record OpenSSH started as a fork of the free SSH program developed by Tatu Ylönen; later versions of Ylönen's SSH were proprietary software offered by SSH Communications Security. https://en.wikipedia.org/wiki/OpenSSH https://en.wikipedia.org/wiki/OpenSSH
- chasil 4y ago
  Realistically, OpenBSD completely reimplemented protocol 2 themselves. Since nobody uses protocol 1 anymore, very little of the original code from Tatu Ylönen remains in operation with default settings. ps I have had to use the SSH commercial release under VMS, and the compatibilities with OpenSSH are quite unpleasant.
  - gigantaure 4y ago
    i just read that page[1] earlier this week. this gives a great view on the amount of work performed by the openssh project after the fork of the last open source version. [1] https://www.openssh.com/history.html https://www.openssh.com/history.html
  - fsckboy 4y ago
    https://en.wikipedia.org/wiki/Ship_of_Theseus https://en.wikipedia.org/wiki/Ship_of_Theseus
nayden 4y ago
thanks for bringing this to our attention. fixed now: https://github.com/bob-beck/foundation-web/commit/d34479b48abf65732ca5923f37d58e03b4d182b4 https://github.com/bob-beck/foundation-web/commit/d34479b48a...

saagarjha 4y ago

This happens to already exist on macOS as VM_FLAGS_PERMANENT when setting up the mapping.

chasil 4y ago

The ROP-gadget stuff hasn't migrated to any other kernels that I have seen. As I understand it, previous ROP-gadget hardening included compiler modifications on system/function call return, trap sleds, and some other stuff that I don't remember. This is on top of the kernel and library relink at every boot (to really make ASLR more potent). These modifications include a verification that the jump is in the stack, and not at the tail of some function (and the other thing eludes my understanding). These are some OpenBSD references on ROP hardening: https://undeadly.org/cgi?action=article;sid=20170622065629 https://undeadly.org/cgi?action=article;sid=20170622065629 https://www.openbsd.org/papers/rop.pdf https://www.openbsd.org/papers/rop.pdf https://www.openbsd.org/papers/asiabsdcon2019-rop-paper.pdf https://www.openbsd.org/papers/asiabsdcon2019-rop-paper.pdf I think that the most notorious exploit of "Return-Oriented Programming" (ROP-gadget) flaws was Solarwinds; I understand that a ROP exploit sealed their fate. Maybe Windows is doing some of this in their kernel. "At this point, we noticed that Serv-U.dll and RhinoNET.dll both have ASLR support disabled, making them prime locations for ROP gadgets..." https://www.microsoft.com/security/blog/2021/09/02/a-deep-dive-into-the-solarwinds-serv-u-ssh-vulnerability/ https://www.microsoft.com/security/blog/2021/09/02/a-deep-di...

saagarjha 4y ago
This is because the ROP gadget hardening OpenBSD does is generally considered to be mostly useless by other kernels, which are moving to hardware-enforced control flow integrity instead.
- chasil 4y ago
  I prefer to do all my financial transactions from Chromium on OpenBSD, on a machine where I have run me_cleaner. Am I happy to have ROP safeguards? You bet!
- beachhead 4y ago
  Is the ROP gadget hardening OpenBSD does mostly useless tho? Can you elaborate?
  - 4y ago

hggh 4y ago

Too bad they don't accept peer-to-peer electronic cash

7vUYjPAG2fnx7fd 4y ago
> Bitcoin donation via BitPay: The OpenBSD Foundation can accept donations in BTC via BitPay
- groby_b 4y ago
  Yeah, but ideally you should make a donation of lasting value.
  - notaplumber1 4y ago
    That's what BitPay handles. The OpenBSD Foundation doesn't hold onto any Bitcoin, it's immediately converted into USD.
  - andirk 4y ago
    Almost every donation and purchase I have made would have been far more lucrative to the recipient had they kept it in BTC. But yes, I understand this is salty HN.
- hggh 4y ago
  Peer-to-peer means there isn't a third party involved, and BTC stopped being electronic cash around 2014

na85 4y ago

And thus the failure of BSD-style licensing is thrown into sharp relief: Why are these projects that are used by many large and extraordinarily profitable tech enterprises dependent on community donations? I recommend not donating, because to do so directly supports corporate parasitism.

Sunspark 4y ago
The flip side of course is that improvements also come at the pace of volunteerism, and there are no boardroom meetings where a manager tells the BSD developers that they didn't type enough lines of code that week. If a corp wants a feature improved or implemented if it doesn't exist, they will have to pay someone and then they have to decide whether they will contribute it. If they do not, then they have to maintain a fork themselves which requires ongoing resources. At the end of the day, I don't think it really matters that much. The corps are providing a service not a software application. If they weren't using BSD, they'd be using something else.
deleted 4y ago
[deleted]
iE4mHBzmoYezwbx 4y ago
Really? Their biggest donors are large and extraordinarily profitable tech enterprises. (Like Google, Microsoft, and Facebook) And thus the success of BSD-style licensing is thrown into sharp relief. (Also the fact that you or I can go use it as much as we want for free and do whatever we want to it.)
chasil 4y ago
There used to be complaint from OpenBSD that large corporate users of OpenSSH weren't donating anything, so I sent them $100. Those days appear to be over. https://www.theregister.com/2015/07/08/microsoft_donates_to_openbsd_foundation/ https://www.theregister.com/2015/07/08/microsoft_donates_to_...
- mekster 4y ago
  Better than nothing but it's far from what the title describes as "rains cash". MS : $25k - $50k Google , FB : $10k - $25k For them, that's like saying "Hi". For the financial value the OpenBSD foundation is creating, that's a miniscule return.

hansendc 4y ago

There honestly isn't that much "tech" to speak of here. We were literally talking about "immutable" mappings last week in Linux land: https://lore.kernel.org/all/b4f0dca5-1d15-67f7-4600-9a0a91e9d0bd@intel.com/ https://lore.kernel.org/all/b4f0dca5-1d15-67f7-4600-9a0a91e9... That said, this would be great to see in OpenBSD (or any other OS).