7 ms·

For anybody wondering about the new pinsyscalls(2) suggest having a look at https://isopenbsdsecu.re/mitigations/pinsyscall/ https://isopenbsdsecu.re/mitigati

by ch0ic3 3y ago

For anybody wondering about the new pinsyscalls(2) suggest having a look at https://isopenbsdsecu.re/mitigations/pinsyscall/ https://isopenbsdsecu.re/mitigations/pinsyscall/ . To be clear: I use OpenBSD on all my external-facing systems. I trust it infinitely more than any GNU/Linux distribution (esp with the recent xz.. "issue"), but I think it's important to do your own research and see what the contrarians say from time to time.

calvinmorrison 3y ago
Do you think there's more value in combining 2 heterogenous systems (like openbsd up front, linux behind) than using one 'more secure' system throughout? I feel like the number of critical issues that have faced two systems at once is far fewer than a single system. Also I think it shows value in having independent implementations of standards. If you have 5x different xz tools or C compilers or Javascript engines, the threat is chopped in half, plus you can easily compare reference outputs between them (RE: on trusting trust)
- wannacboatmovie 3y ago
  It's common practice for the ultra paranoid to use two firewalls, from different vendors, back to back, for this reason.
- terlisimo 3y ago
  There is a name for this https://en.wikipedia.org/wiki/Swiss_cheese_model https://en.wikipedia.org/wiki/Swiss_cheese_model
- ch0ic3 3y ago
  For sure! An argument in OpenBSD circles is that contrary to popular belief one can have security through depth. This means that even though you'll never be 100% secure you can definitely make an attacker's job harder and their life more miserable. Of course, if the NSA wants to attack you then they'll probably succeed, but for your average script kiddy / botnet scanner / worm exploiting some vulnerability having multiple layers might be enough of a deterrent. I'm not a security person but I also think a lot of malware damage comes from companies / users using misconfigured or outdated software. As such, if you were a sysadmin, knew what you were doing and had the time, then running GNU/Linux is probably fine, but I'm not super knowledgeable. I just want to host a website or run a tor-relay on a VPS and not have to worry about updating my system as soon as some 0-day is announced in glibc or systemd; even if it's in the service itself, my hope is that by using a non-mainstream OS the exploit might not initially target it, hence giving sufficient time to see the news somewhere and patch / update.
nanolith 3y ago
This site is often fairly balanced, but I think the author often jumps to conclusions. The pinsyscall feature is one place where many security researchers have jumped to conclusions, because they only see it from their narrow x86 oriented view. Yeah, on x86, I can craft a ROP attack that allows me to discover relocations for functions fairly trivially, especially for coarse ASLR, because I can read the text segment. But, ARM64 has execute-only support so that it's possible for code to execute, but not read, a text segment. In this situation, pinsyscall does add a valid defense in depth layer. It's still imperfect, but this does in fact raise the bar necessary to carry out a ROP attack when combined with randomized re-linking on boot ASLR. Further, once dynamic linking has occurred, the text segment for a binary is made immutable so that no mapping changes can occur, including mmap. I think that OpenBSD still has a long way to go before all of these defenses align, but they are far less trivial than the author makes them out to be, because none of them are meant to be used alone. OpenBSD developer decisions like these can sometimes appear to be casting about randomly, because they are making small improvements instead of building toward a particular goal. Sometimes, they hit gold as with W^X, which was widely adopted. Sometimes, their ideas stink, like systrace. But, I don't think it's wise to just dismiss these ideas out of hand. Instead, I recommend that people look to the history of OpenBSD, which has been more of an evolutionary approach to security instead of a revolutionary approach (i.e. Fuchsia). From an evolutionary perspective, pinsyscall makes sense as it is low-hanging fruit that can buy some security and can force applications to use a standard interface (libc) instead of making raw system calls. From a revolutionary perspective, pinsyscall just seems like a dead end. Revolutionary design has convergent effects -- all of the pieces come together in a perfectly engineered defensive shell. Evolutionary design has emergent effects -- fixes and features build on each other until they co-evolve into strong defenses.
- pstuart 3y ago
  Would the evolutionary approach be an advantage in allowing existing code bases to run with minimal modifications? So not perfect but safer than linux with minimal effort?
  - nanolith 3y ago
lenerdenator 3y ago
Would it be correct to say that OpenBSD is far more of a unified approach to kernel and userland development than GNU/Linux? As in, both ship as one unit, end-to-end, instead of interchangeable modules that make up GNU's ecosystem?
- alberth 3y ago
  That's correct for all BSD's, not just OpenBSD. BSD = kernel + userland
  - lenerdenator 3y ago
    I might throw it on a VM soon. Maybe it'll finally scratch the ultimate nerdy OS itch. Probably not though.
    - nutrie 2y ago
      Having had some experience with FreeBSD, I'd pick BSD over Linux any day, the primary reason being its unique consistency, which is after a few days a breeze of fresh air even to a newbie. The vast majority of software that runs on Linux is available for BSD as well. Sadly, hardware support is not that great.
  - beanjuiceII 2y ago
    Yep you can pick from any distro you want.. freebsd openbsd netbsd pcbsd dragonflybsd etc etc etc each special petals like lisp languages or something
    - lproven 2y ago
      PC-BSD is long dead. It's much simpler than you represent. There are only 4 real trees here: * FreeBSD * NetBSD * OpenBSD * Dragonfly BSD In very approximate order, and I suspect that there are (wild approximation) half as many users for each step down the list. One estimate I've seen is that there are ~7K users of openBSD, in total, worldwide. There are a few distros of FreeBSD. None of the others have distros, AFAIK. PC-BSD was a FreeBSD distro. iXsystems acquired it, turned it into TrueOS, and then killed it 4Y ago. https://www.truenas.com/trueos-discontinuation/ https://www.truenas.com/trueos-discontinuation/
alberth 3y ago
Does pinsyscall mean Cosmo will no longer work on OpenBSD? https://github.com/jart/cosmopolitan https://github.com/jart/cosmopolitan

by ch0ic3 3y ago

calvinmorrison 3y ago

Do you think there's more value in combining 2 heterogenous systems (like openbsd up front, linux behind) than using one 'more secure' system throughout? I feel like the number of critical issues that have faced two systems at once is far fewer than a single system. Also I think it shows value in having independent implementations of standards. If you have 5x different xz tools or C compilers or Javascript engines, the threat is chopped in half, plus you can easily compare reference outputs between them (RE: on trusting trust)

wannacboatmovie 3y ago
It's common practice for the ultra paranoid to use two firewalls, from different vendors, back to back, for this reason.
terlisimo 3y ago
There is a name for this https://en.wikipedia.org/wiki/Swiss_cheese_model https://en.wikipedia.org/wiki/Swiss_cheese_model
ch0ic3 3y ago
For sure! An argument in OpenBSD circles is that contrary to popular belief one can have security through depth. This means that even though you'll never be 100% secure you can definitely make an attacker's job harder and their life more miserable. Of course, if the NSA wants to attack you then they'll probably succeed, but for your average script kiddy / botnet scanner / worm exploiting some vulnerability having multiple layers might be enough of a deterrent. I'm not a security person but I also think a lot of malware damage comes from companies / users using misconfigured or outdated software. As such, if you were a sysadmin, knew what you were doing and had the time, then running GNU/Linux is probably fine, but I'm not super knowledgeable. I just want to host a website or run a tor-relay on a VPS and not have to worry about updating my system as soon as some 0-day is announced in glibc or systemd; even if it's in the service itself, my hope is that by using a non-mainstream OS the exploit might not initially target it, hence giving sufficient time to see the news somewhere and patch / update.

nanolith 3y ago

This site is often fairly balanced, but I think the author often jumps to conclusions. The pinsyscall feature is one place where many security researchers have jumped to conclusions, because they only see it from their narrow x86 oriented view. Yeah, on x86, I can craft a ROP attack that allows me to discover relocations for functions fairly trivially, especially for coarse ASLR, because I can read the text segment. But, ARM64 has execute-only support so that it's possible for code to execute, but not read, a text segment. In this situation, pinsyscall does add a valid defense in depth layer. It's still imperfect, but this does in fact raise the bar necessary to carry out a ROP attack when combined with randomized re-linking on boot ASLR. Further, once dynamic linking has occurred, the text segment for a binary is made immutable so that no mapping changes can occur, including mmap. I think that OpenBSD still has a long way to go before all of these defenses align, but they are far less trivial than the author makes them out to be, because none of them are meant to be used alone. OpenBSD developer decisions like these can sometimes appear to be casting about randomly, because they are making small improvements instead of building toward a particular goal. Sometimes, they hit gold as with W^X, which was widely adopted. Sometimes, their ideas stink, like systrace. But, I don't think it's wise to just dismiss these ideas out of hand. Instead, I recommend that people look to the history of OpenBSD, which has been more of an evolutionary approach to security instead of a revolutionary approach (i.e. Fuchsia). From an evolutionary perspective, pinsyscall makes sense as it is low-hanging fruit that can buy some security and can force applications to use a standard interface (libc) instead of making raw system calls. From a revolutionary perspective, pinsyscall just seems like a dead end. Revolutionary design has convergent effects -- all of the pieces come together in a perfectly engineered defensive shell. Evolutionary design has emergent effects -- fixes and features build on each other until they co-evolve into strong defenses.

pstuart 3y ago
Would the evolutionary approach be an advantage in allowing existing code bases to run with minimal modifications? So not perfect but safer than linux with minimal effort?
- nanolith 3y ago

lenerdenator 3y ago

Would it be correct to say that OpenBSD is far more of a unified approach to kernel and userland development than GNU/Linux? As in, both ship as one unit, end-to-end, instead of interchangeable modules that make up GNU's ecosystem?

alberth 3y ago
That's correct for all BSD's, not just OpenBSD. BSD = kernel + userland
- lenerdenator 3y ago
  I might throw it on a VM soon. Maybe it'll finally scratch the ultimate nerdy OS itch. Probably not though.
  - nutrie 2y ago
    Having had some experience with FreeBSD, I'd pick BSD over Linux any day, the primary reason being its unique consistency, which is after a few days a breeze of fresh air even to a newbie. The vast majority of software that runs on Linux is available for BSD as well. Sadly, hardware support is not that great.
- beanjuiceII 2y ago
  Yep you can pick from any distro you want.. freebsd openbsd netbsd pcbsd dragonflybsd etc etc etc each special petals like lisp languages or something
  - lproven 2y ago
    PC-BSD is long dead. It's much simpler than you represent. There are only 4 real trees here: * FreeBSD * NetBSD * OpenBSD * Dragonfly BSD In very approximate order, and I suspect that there are (wild approximation) half as many users for each step down the list. One estimate I've seen is that there are ~7K users of openBSD, in total, worldwide. There are a few distros of FreeBSD. None of the others have distros, AFAIK. PC-BSD was a FreeBSD distro. iXsystems acquired it, turned it into TrueOS, and then killed it 4Y ago. https://www.truenas.com/trueos-discontinuation/ https://www.truenas.com/trueos-discontinuation/

alberth 3y ago

Does pinsyscall mean Cosmo will no longer work on OpenBSD? https://github.com/jart/cosmopolitan https://github.com/jart/cosmopolitan