5 ms·

It's not false. No significant services are running by default, and for it to do anything useful you have to install and/or enable whatever services you want.

It's not false. No significant services are running by default, and for it to do anything useful you have to install and/or enable whatever services you want. Semantics doesn't change that.

anthk 4y ago
Who cares, your point it's still wrong as you don't understand how much OpenBSD diverges from Linux and even FreeBSD and NetBSD on security and correctness.
- Zurrrrr 4y ago
  No, I understand absolutely. I've been playing with OpenBSD for over 20 years. My point is that OpenBSD wants to focus on trying to remove bugs as much as possible, and securing the system in case a bug is exploited is very much a secondary objective. Pledge and unveil are nice, but insufficient compared to what SELinux can do, or similar systems. That's simply objectively true, regardless of if your bias towards OpenBSD will let you admit it or not. So no, my point isn't wrong, you're just possibly out of your depth in this convo. OpenBSD provides NOTHING to protect against an attacker who gets remote root, it just really really really hopes they won't.
  - yjftsjthsd-h 4y ago
    > OpenBSD provides NOTHING to protect against an attacker who gets remote root, it just really really really hopes they won't. Alright, if we're talking about things that are objectively true, this is objectively false. They specifically go to great lengths to make it impossible to get root.
    - Zurrrrr 4y ago
      It seems you didn't properly read my comment. I'm not talking about GETTING root, I'm talking about in the situation where an attacker already HAS root.
      - yjftsjthsd-h 4y ago
        You did, actually; you said that OpenBSD just "really really really hopes" that an attacker won't get root, and I pointed out that that was nonsense and that they are in fact taking measures to ensure it. Besides, by that logic, your systems are totally insecure because you're just really really really hoping the attacker doesn't get an unconfined process.
        Zurrrrr 4y ago
        Sigh. No, I didn't. Saying OpenBSD 'really really really hopes' an attacker doesn't get root is still 100% correct. They are still prioritizing removing bugs ahead of time instead of providing stronger tools to prepare for a scenario where someone does exploit a bug they didn't get to. > Besides, by that logic, your systems are totally insecure because you're just really really really hoping the attacker doesn't get an unconfined process. Which is where things like SELinux come in, which is my whole point.....
        yjftsjthsd-h 4y ago
        > They are still prioritizing removing bugs ahead of time instead of providing stronger tools to prepare for a scenario where someone does exploit a bug they didn't get to. They're absolutely dealing with that situation as well. So let's say for instance that the default OpenBSD httpd turns out to have some bug that allows an attacker to execute any arbitrary code of their choosing on the server. That's a problem, but it's hardly the end of the world. First, the server is using pledge+unveil, so it can't actually do all that much other than serving web pages. Second, even if the attacker can work within those restrictions, they're running as a completely unprivileged user, because OpenBSD is actually a great fan of defense in depth. > Which is where things like SELinux come in, which is my whole point..... If we're assuming an attacker can run things as root, then obviously we have to assume that they can run things in an unconfined context as well, at which point you've just basically added a second word for root and nothing helps.
        anthk 4y ago
  - stonogo 4y ago
    I don't know why you're acting like anyone actually uses SELinux the way you are describing it. It's notoriously a pain in the ass to configure any meaningful system-level protection from root accounts, to the degree that most deployments who bother at all only protect one or two directories. Even then SELinux is such a bolted-on mess that it's still subject to evil maid attacks and so forth. And you're wrong about OpenBSD. I'm not going to get as angry about this as you appear to be, but I recommend you run "man 7 securelevel" on one of the OpenBSD systems you've been playing with for 20 years.
    - Zurrrrr 4y ago
      You're very wrong about SELinux and I assume haven't touched it in years. It's enabled by default in Fedora, other distros use it as well, and it really isn't at all that big a deal to learn and configure proportional to the benefit. I'm not remotely wrong about OpenBSD, and that manpage doesn't contain anything that contradicts a point I've made.
      - stonogo 4y ago
        I administer thousands of selinux boxes professionally. I, like the vast majority of Earth's population, remain steadfastly uninterested in Fedora's default behavior. You claim that OpenBSD has no conpromised-root mitigation. I have provided evidence to back my counterclaim. I will assume your rejection of actual evidence indicates a disinterest in good-faith argument, so I won't bother pressing the point, except to mention that you may be more successful persuading people to support your case if you adopt a reality-based approach to argument instead of just making wild-ass assumptions about other people.
        Zurrrrr 4y ago
        You haven't provided evidence at all, that's the thing. You're either wrong or misunderstanding something.
ori_b 4y ago
It ships with many of the services you may want by default (httpd, relayd, bgpd, etc). Major external packages are patched to improve security. For example, a compromised chrome or firefox can't observe any directory other than ~/Downloads; pledge and unveil take care of that.
- Zurrrrr 4y ago
  Oh for sure, it can be somewhat useable for many simple cases. Many people, even most though will need to deviate from the default install. I mean, if someone is running httpd, a database might not be far behind, just for example.
2b3a51 4y ago
The comment directly above yours was referring to the work that some of the OpenBSD packagers do when providing packages for installation on OpenBSD additional to the base, using pledge and unveil. As a concrete example, Firefox can only load/save or download files to ~/Download by default.
- Zurrrrr 4y ago
  I'm all for making software more secure, and pledge serves a niche. But it is entirely useless in the scenario where someone has root.

It's not false. No significant services are running by default, and for it to do anything useful you have to install and/or enable whatever services you want. Semantics doesn't change that.

anthk 4y ago

Who cares, your point it's still wrong as you don't understand how much OpenBSD diverges from Linux and even FreeBSD and NetBSD on security and correctness.

Zurrrrr 4y ago
No, I understand absolutely. I've been playing with OpenBSD for over 20 years. My point is that OpenBSD wants to focus on trying to remove bugs as much as possible, and securing the system in case a bug is exploited is very much a secondary objective. Pledge and unveil are nice, but insufficient compared to what SELinux can do, or similar systems. That's simply objectively true, regardless of if your bias towards OpenBSD will let you admit it or not. So no, my point isn't wrong, you're just possibly out of your depth in this convo. OpenBSD provides NOTHING to protect against an attacker who gets remote root, it just really really really hopes they won't.
- yjftsjthsd-h 4y ago
  > OpenBSD provides NOTHING to protect against an attacker who gets remote root, it just really really really hopes they won't. Alright, if we're talking about things that are objectively true, this is objectively false. They specifically go to great lengths to make it impossible to get root.
  - Zurrrrr 4y ago
    It seems you didn't properly read my comment. I'm not talking about GETTING root, I'm talking about in the situation where an attacker already HAS root.
    - yjftsjthsd-h 4y ago
      You did, actually; you said that OpenBSD just "really really really hopes" that an attacker won't get root, and I pointed out that that was nonsense and that they are in fact taking measures to ensure it. Besides, by that logic, your systems are totally insecure because you're just really really really hoping the attacker doesn't get an unconfined process.
      - Zurrrrr 4y ago
        Sigh. No, I didn't. Saying OpenBSD 'really really really hopes' an attacker doesn't get root is still 100% correct. They are still prioritizing removing bugs ahead of time instead of providing stronger tools to prepare for a scenario where someone does exploit a bug they didn't get to. > Besides, by that logic, your systems are totally insecure because you're just really really really hoping the attacker doesn't get an unconfined process. Which is where things like SELinux come in, which is my whole point.....
        yjftsjthsd-h 4y ago
        > They are still prioritizing removing bugs ahead of time instead of providing stronger tools to prepare for a scenario where someone does exploit a bug they didn't get to. They're absolutely dealing with that situation as well. So let's say for instance that the default OpenBSD httpd turns out to have some bug that allows an attacker to execute any arbitrary code of their choosing on the server. That's a problem, but it's hardly the end of the world. First, the server is using pledge+unveil, so it can't actually do all that much other than serving web pages. Second, even if the attacker can work within those restrictions, they're running as a completely unprivileged user, because OpenBSD is actually a great fan of defense in depth. > Which is where things like SELinux come in, which is my whole point..... If we're assuming an attacker can run things as root, then obviously we have to assume that they can run things in an unconfined context as well, at which point you've just basically added a second word for root and nothing helps.
        anthk 4y ago
- stonogo 4y ago
  I don't know why you're acting like anyone actually uses SELinux the way you are describing it. It's notoriously a pain in the ass to configure any meaningful system-level protection from root accounts, to the degree that most deployments who bother at all only protect one or two directories. Even then SELinux is such a bolted-on mess that it's still subject to evil maid attacks and so forth. And you're wrong about OpenBSD. I'm not going to get as angry about this as you appear to be, but I recommend you run "man 7 securelevel" on one of the OpenBSD systems you've been playing with for 20 years.
  - Zurrrrr 4y ago
    You're very wrong about SELinux and I assume haven't touched it in years. It's enabled by default in Fedora, other distros use it as well, and it really isn't at all that big a deal to learn and configure proportional to the benefit. I'm not remotely wrong about OpenBSD, and that manpage doesn't contain anything that contradicts a point I've made.
    - stonogo 4y ago
      I administer thousands of selinux boxes professionally. I, like the vast majority of Earth's population, remain steadfastly uninterested in Fedora's default behavior. You claim that OpenBSD has no conpromised-root mitigation. I have provided evidence to back my counterclaim. I will assume your rejection of actual evidence indicates a disinterest in good-faith argument, so I won't bother pressing the point, except to mention that you may be more successful persuading people to support your case if you adopt a reality-based approach to argument instead of just making wild-ass assumptions about other people.
      - Zurrrrr 4y ago
        You haven't provided evidence at all, that's the thing. You're either wrong or misunderstanding something.

ori_b 4y ago

It ships with many of the services you may want by default (httpd, relayd, bgpd, etc). Major external packages are patched to improve security. For example, a compromised chrome or firefox can't observe any directory other than ~/Downloads; pledge and unveil take care of that.

Zurrrrr 4y ago
Oh for sure, it can be somewhat useable for many simple cases. Many people, even most though will need to deviate from the default install. I mean, if someone is running httpd, a database might not be far behind, just for example.

2b3a51 4y ago

The comment directly above yours was referring to the work that some of the OpenBSD packagers do when providing packages for installation on OpenBSD additional to the base, using pledge and unveil. As a concrete example, Firefox can only load/save or download files to ~/Download by default.

Zurrrrr 4y ago
I'm all for making software more secure, and pledge serves a niche. But it is entirely useless in the scenario where someone has root.