4 ms·

I still run OpenBSD where I can, especially where security is more important. Yes, it's still missing A LOT of functionally compared to other UNIX-like systems,

by binkHN 3y ago

I still run OpenBSD where I can, especially where security is more important. Yes, it's still missing A LOT of functionally compared to other UNIX-like systems, but security bases tend to be well covered.

PrimeMcFly 3y ago
I don't really buy their approach to security honestly. Trying to fix all bugs is great, but they provide little to prevent unknown bugs bing exploited (pledge is nice for software that opts in to use it, but otherwise not so much). I'd love to see them implement something like AppArmor with their approach, it would probably be amazing. I actually think NetBSD is a pretty interesting alternative, it has some nice security features like veriexec that don't get talked about much.
- deleted 3y ago
  [deleted]
- binkHN 3y ago
  I think in the past they tried to fix all the bugs, and realized they couldn't, so they started to build all sorts of mitigations in the same vein as the one you see posted here today. As for pledge, and the related mitigations, yes, they're not useful if you don't use them, but I see this as them innovating in the space and giving application developers more tools to build hardened applications. I see tools like AppArmor as band-aids to fix problems that shouldn't exist in the first place. The problem with these approaches are the band-aids tend to break things in unexpected ways and when that happens they simply get removed and unused.
  - PrimeMcFly 3y ago
    > I see tools like AppArmor as band-aids to fix problems that shouldn't exist in the first place. I fundamentally disagree on that. I think tools like that are amazing at protecting against unknown threats/exploits. They let you lock down software and protect against future unknown exploits, badly behaving software, malicious employees etc. I think something similar should be a part of any OS claiming to be security focused. Basic DAC is woefully insufficient. On the other hand, the industry has largely found other solutions like sandboxing, but I still think MAC or RBAC or whichever has a place, certainly as art of a defense in depth strategy.
- anthk 3y ago
  OpenBSD has these on while on compiling.
- carlosrg 3y ago
  > they provide little to prevent unknown bugs bing exploited They provide plenty of mitigations (https://www.openbsd.org/innovations.html https://www.openbsd.org/innovations.html). In fact OP's article is for preventing unknown bugs from being exploited.
  - PrimeMcFly 3y ago
    They don't provide any mitigations of the sort I was clearly referencing. Specifically, for restricting malicious code or users that already has access to the system, exploiting insecure software that was not compiled with pledge support.
    - saagarjha 3y ago
      What kind of mitigations would help here?
      - PrimeMcFly 3y ago
        SELinux/RSBAC/AppArmor/grsecurity and similar.
        saagarjha 3y ago
        These largely require buy-in from applications just like pledge.
        PrimeMcFly 3y ago
        They absolutely don't, that's the key difference. What makes you think otherwise?
        saagarjha 3y ago
        You can’t just stick sandboxing around arbitrary apps without them breaking.
dark-star 3y ago
I find OpenBSD's hardware support especially lacking. It doesn't really work that well on at least 3 devices where I tried it on (all Dell laptops from various generations, 3-10 years old), whereas Linux runs perfectly out-of-the-box on all three. Which is sad, as I kinda like the *BSD approach to things
- carlosrg 3y ago
  Not my experience at all, it works very well with a new Acer laptop I own: the graphics work (Intel Xe - 12th gen processor), audio, touchpad, keyboard (and special keyboard keys like brightness), wifi... All I had to do is to download the firmware with fw_update, nothing more. Also I was pleasantly surprised to hear they support Apple M1/M2 Macs. Asahi Linux gets a lot of press around here but I had no idea OpenBSD supported it.
MuffinFlavored 3y ago
> Yes, it's still missing A LOT of functionally compared to other UNIX-like systems Could you give some examples/samples of things you have ran into off the top of your head?
- binkHN 3y ago
  Sure. Poor SMP support (but this has improved heavily over the years), ancient file system, no Bluetooth (not important if you don't need this), reduced performance (due to a lack of optimizations and security mitigations overhead), limited Wi-Fi support (this is for numerous reasons, but it's better than other BSDs)... I could go on, but, for my needs, it works very well and some of its simplicities are a godsend.

by binkHN 3y ago

PrimeMcFly 3y ago

I don't really buy their approach to security honestly. Trying to fix all bugs is great, but they provide little to prevent unknown bugs bing exploited (pledge is nice for software that opts in to use it, but otherwise not so much). I'd love to see them implement something like AppArmor with their approach, it would probably be amazing. I actually think NetBSD is a pretty interesting alternative, it has some nice security features like veriexec that don't get talked about much.

deleted 3y ago
[deleted]
binkHN 3y ago
I think in the past they tried to fix all the bugs, and realized they couldn't, so they started to build all sorts of mitigations in the same vein as the one you see posted here today. As for pledge, and the related mitigations, yes, they're not useful if you don't use them, but I see this as them innovating in the space and giving application developers more tools to build hardened applications. I see tools like AppArmor as band-aids to fix problems that shouldn't exist in the first place. The problem with these approaches are the band-aids tend to break things in unexpected ways and when that happens they simply get removed and unused.
- PrimeMcFly 3y ago
  > I see tools like AppArmor as band-aids to fix problems that shouldn't exist in the first place. I fundamentally disagree on that. I think tools like that are amazing at protecting against unknown threats/exploits. They let you lock down software and protect against future unknown exploits, badly behaving software, malicious employees etc. I think something similar should be a part of any OS claiming to be security focused. Basic DAC is woefully insufficient. On the other hand, the industry has largely found other solutions like sandboxing, but I still think MAC or RBAC or whichever has a place, certainly as art of a defense in depth strategy.
anthk 3y ago
OpenBSD has these on while on compiling.
carlosrg 3y ago
> they provide little to prevent unknown bugs bing exploited They provide plenty of mitigations (https://www.openbsd.org/innovations.html https://www.openbsd.org/innovations.html). In fact OP's article is for preventing unknown bugs from being exploited.
- PrimeMcFly 3y ago
  They don't provide any mitigations of the sort I was clearly referencing. Specifically, for restricting malicious code or users that already has access to the system, exploiting insecure software that was not compiled with pledge support.
  - saagarjha 3y ago
    What kind of mitigations would help here?
    - PrimeMcFly 3y ago
      SELinux/RSBAC/AppArmor/grsecurity and similar.
      - saagarjha 3y ago
        These largely require buy-in from applications just like pledge.
        PrimeMcFly 3y ago
        They absolutely don't, that's the key difference. What makes you think otherwise?
        saagarjha 3y ago
        You can’t just stick sandboxing around arbitrary apps without them breaking.

dark-star 3y ago

I find OpenBSD's hardware support especially lacking. It doesn't really work that well on at least 3 devices where I tried it on (all Dell laptops from various generations, 3-10 years old), whereas Linux runs perfectly out-of-the-box on all three. Which is sad, as I kinda like the *BSD approach to things

carlosrg 3y ago
Not my experience at all, it works very well with a new Acer laptop I own: the graphics work (Intel Xe - 12th gen processor), audio, touchpad, keyboard (and special keyboard keys like brightness), wifi... All I had to do is to download the firmware with fw_update, nothing more. Also I was pleasantly surprised to hear they support Apple M1/M2 Macs. Asahi Linux gets a lot of press around here but I had no idea OpenBSD supported it.

MuffinFlavored 3y ago

> Yes, it's still missing A LOT of functionally compared to other UNIX-like systems Could you give some examples/samples of things you have ran into off the top of your head?

binkHN 3y ago
Sure. Poor SMP support (but this has improved heavily over the years), ancient file system, no Bluetooth (not important if you don't need this), reduced performance (due to a lack of optimizations and security mitigations overhead), limited Wi-Fi support (this is for numerous reasons, but it's better than other BSDs)... I could go on, but, for my needs, it works very well and some of its simplicities are a godsend.