9 ms·

OpenBSD's default configuration has basically nothing running. Once you actually set it up for a use case, it isn't much better (you'll likely be running softwa

OpenBSD's default configuration has basically nothing running. Once you actually set it up for a use case, it isn't much better (you'll likely be running software you would on Linux that wasn't audited) and might even be worse given it lacks a lot of security features Linux has (meaning you have less control over how to lock down things in the case of a hack).

anthk 4y ago
False. OpenBSD's daemons are patched, sandboxed and reviewed and lots of software it's compiled with secure CFLAGS and LDFLAGS among some tweaks for browsers with pledge and unveil.
- Zurrrrr 4y ago
  It's not false. No significant services are running by default, and for it to do anything useful you have to install and/or enable whatever services you want. Semantics doesn't change that.
  - anthk 4y ago
    Who cares, your point it's still wrong as you don't understand how much OpenBSD diverges from Linux and even FreeBSD and NetBSD on security and correctness.
    - Zurrrrr 4y ago
      No, I understand absolutely. I've been playing with OpenBSD for over 20 years. My point is that OpenBSD wants to focus on trying to remove bugs as much as possible, and securing the system in case a bug is exploited is very much a secondary objective. Pledge and unveil are nice, but insufficient compared to what SELinux can do, or similar systems. That's simply objectively true, regardless of if your bias towards OpenBSD will let you admit it or not. So no, my point isn't wrong, you're just possibly out of your depth in this convo. OpenBSD provides NOTHING to protect against an attacker who gets remote root, it just really really really hopes they won't.
      - yjftsjthsd-h 4y ago
        > OpenBSD provides NOTHING to protect against an attacker who gets remote root, it just really really really hopes they won't. Alright, if we're talking about things that are objectively true, this is objectively false. They specifically go to great lengths to make it impossible to get root.
        Zurrrrr 4y ago
        It seems you didn't properly read my comment. I'm not talking about GETTING root, I'm talking about in the situation where an attacker already HAS root.
        yjftsjthsd-h 4y ago
        You did, actually; you said that OpenBSD just "really really really hopes" that an attacker won't get root, and I pointed out that that was nonsense and that they are in fact taking measures to ensure it. Besides, by that logic, your systems are totally insecure because you're just really really really hoping the attacker doesn't get an unconfined process.
        Zurrrrr 4y ago
        Sigh. No, I didn't. Saying OpenBSD 'really really really hopes' an attacker doesn't get root is still 100% correct. They are still prioritizing removing bugs ahead of time instead of providing stronger tools to prepare for a scenario where someone does exploit a bug they didn't get to. > Besides, by that logic, your systems are totally insecure because you're just really really really hoping the attacker doesn't get an unconfined process. Which is where things like SELinux come in, which is my whole point.....
        yjftsjthsd-h 4y ago
        > They are still prioritizing removing bugs ahead of time instead of providing stronger tools to prepare for a scenario where someone does exploit a bug they didn't get to. They're absolutely dealing with that situation as well. So let's say for instance that the default OpenBSD httpd turns out to have some bug that allows an attacker to execute any arbitrary code of their choosing on the server. That's a problem, but it's hardly the end of the world. First, the server is using pledge+unveil, so it can't actually do all that much other than serving web pages. Second, even if the attacker can work within those restrictions, they're running as a completely unprivileged user, because OpenBSD is actually a great fan of defense in depth. > Which is where things like SELinux come in, which is my whole point..... If we're assuming an attacker can run things as root, then obviously we have to assume that they can run things in an unconfined context as well, at which point you've just basically added a second word for root and nothing helps.
  - ori_b 4y ago
    It ships with many of the services you may want by default (httpd, relayd, bgpd, etc). Major external packages are patched to improve security. For example, a compromised chrome or firefox can't observe any directory other than ~/Downloads; pledge and unveil take care of that.
    - Zurrrrr 4y ago
      Oh for sure, it can be somewhat useable for many simple cases. Many people, even most though will need to deviate from the default install. I mean, if someone is running httpd, a database might not be far behind, just for example.
  - 2b3a51 4y ago
    The comment directly above yours was referring to the work that some of the OpenBSD packagers do when providing packages for installation on OpenBSD additional to the base, using pledge and unveil. As a concrete example, Firefox can only load/save or download files to ~/Download by default.
    - Zurrrrr 4y ago
      I'm all for making software more secure, and pledge serves a niche. But it is entirely useless in the scenario where someone has root.

anthk 4y ago

False. OpenBSD's daemons are patched, sandboxed and reviewed and lots of software it's compiled with secure CFLAGS and LDFLAGS among some tweaks for browsers with pledge and unveil.

Zurrrrr 4y ago
It's not false. No significant services are running by default, and for it to do anything useful you have to install and/or enable whatever services you want. Semantics doesn't change that.
- anthk 4y ago
  Who cares, your point it's still wrong as you don't understand how much OpenBSD diverges from Linux and even FreeBSD and NetBSD on security and correctness.
  - Zurrrrr 4y ago
    No, I understand absolutely. I've been playing with OpenBSD for over 20 years. My point is that OpenBSD wants to focus on trying to remove bugs as much as possible, and securing the system in case a bug is exploited is very much a secondary objective. Pledge and unveil are nice, but insufficient compared to what SELinux can do, or similar systems. That's simply objectively true, regardless of if your bias towards OpenBSD will let you admit it or not. So no, my point isn't wrong, you're just possibly out of your depth in this convo. OpenBSD provides NOTHING to protect against an attacker who gets remote root, it just really really really hopes they won't.
    - yjftsjthsd-h 4y ago
      > OpenBSD provides NOTHING to protect against an attacker who gets remote root, it just really really really hopes they won't. Alright, if we're talking about things that are objectively true, this is objectively false. They specifically go to great lengths to make it impossible to get root.
      - Zurrrrr 4y ago
        It seems you didn't properly read my comment. I'm not talking about GETTING root, I'm talking about in the situation where an attacker already HAS root.
        yjftsjthsd-h 4y ago
        You did, actually; you said that OpenBSD just "really really really hopes" that an attacker won't get root, and I pointed out that that was nonsense and that they are in fact taking measures to ensure it. Besides, by that logic, your systems are totally insecure because you're just really really really hoping the attacker doesn't get an unconfined process.
        Zurrrrr 4y ago
        Sigh. No, I didn't. Saying OpenBSD 'really really really hopes' an attacker doesn't get root is still 100% correct. They are still prioritizing removing bugs ahead of time instead of providing stronger tools to prepare for a scenario where someone does exploit a bug they didn't get to. > Besides, by that logic, your systems are totally insecure because you're just really really really hoping the attacker doesn't get an unconfined process. Which is where things like SELinux come in, which is my whole point.....
        yjftsjthsd-h 4y ago
        > They are still prioritizing removing bugs ahead of time instead of providing stronger tools to prepare for a scenario where someone does exploit a bug they didn't get to. They're absolutely dealing with that situation as well. So let's say for instance that the default OpenBSD httpd turns out to have some bug that allows an attacker to execute any arbitrary code of their choosing on the server. That's a problem, but it's hardly the end of the world. First, the server is using pledge+unveil, so it can't actually do all that much other than serving web pages. Second, even if the attacker can work within those restrictions, they're running as a completely unprivileged user, because OpenBSD is actually a great fan of defense in depth. > Which is where things like SELinux come in, which is my whole point..... If we're assuming an attacker can run things as root, then obviously we have to assume that they can run things in an unconfined context as well, at which point you've just basically added a second word for root and nothing helps.
- ori_b 4y ago
  It ships with many of the services you may want by default (httpd, relayd, bgpd, etc). Major external packages are patched to improve security. For example, a compromised chrome or firefox can't observe any directory other than ~/Downloads; pledge and unveil take care of that.
  - Zurrrrr 4y ago
    Oh for sure, it can be somewhat useable for many simple cases. Many people, even most though will need to deviate from the default install. I mean, if someone is running httpd, a database might not be far behind, just for example.
- 2b3a51 4y ago
  The comment directly above yours was referring to the work that some of the OpenBSD packagers do when providing packages for installation on OpenBSD additional to the base, using pledge and unveil. As a concrete example, Firefox can only load/save or download files to ~/Download by default.
  - Zurrrrr 4y ago
    I'm all for making software more secure, and pledge serves a niche. But it is entirely useless in the scenario where someone has root.