4 ms·
It is hard to call OpenBSD an OS focused on security. Beyond pledge their primary focus seems to be "just implement everything correctly and don't run malware".
by harporoeder 3y ago
It is hard to call OpenBSD an OS focused on security. Beyond pledge their primary focus seems to be "just implement everything correctly and don't run malware". If some utility has an implementation error or you do accidentally run something malicious you are hosed. Compare this to Linux with the extensive use of containerization and things like eBPF for dynamic security measures, or portals as part as flatpak for dynamic application permissions.
- tonyarkles 3y ago> Compare this to Linux with the extensive use of containerization and things like eBPF for dynamic security measures I think it's an interesting comparison study and I'm not convinced either way of The Right Approach. OpenBSD takes the approach "keep the attack surface as small as possible" while Linux takes the approach "let's bolt a bunch of layers together... good luck making your way through all of it"
- dbolgheroni 3y agoSo many misconceptions in the same answer. eBPF is for observability, and letting you run privileged programs inside the kernel space (even with protections) can actually increase the potential attack surface. Containerization is not and was never a security measure.
- harporoeder 3y agoeBPF is used for substantially more than observability.
- anthk 3y agoMost of your comment it's bullshit. Containers are not for security, but for convencience and task separation/isolation to avoid the overhead of a vm. eBPF will expose you further more, not less. Also, how can flatpak secure you against a ~/.profile script run at login or an ~/.xprofile one?
- harporoeder 3y agoA malicious program is going to have a difficult time adding something to your ~/.profile script if it cannot access your home directory. Although I don't doubt that many flatpak programs have too lenient default permissions, and the various XOrg lack of isolation issues are unfortunate somewhat remedied in wayland.
- anthk 3y agoOpenBSD is implementing Wayland if you like it instead of Xenocara. Again, in which way it's any GNU/Linux distro better then? See: https://www.openbsd.org/papers/eurobsdcon2023-matthieu-wayland-openbsd.pdf https://www.openbsd.org/papers/eurobsdcon2023-matthieu-wayla...
- harporoeder 3y agoWayland does not stop a process from manipulating the home directory, doing various things on the network, using a ton of memory, recording what other processes exist etc. Once you add all that stuff you start to get something that looks a lot like containers.
- anthk 3y agoOpenBSD has limits.conf and acct(8). Again, RTFM.
- harporoeder 3y agoObviously OpenBSD has some limited mechanisms for managing RAM usage and open file descriptors, just like every other system.