4 ms·

OpenBSD is notably not vulnerable, because its SIGALRM handler calls syslog_r(), an async-signal-safer version of syslog() that was invented by OpenBSD

by nj5rq 2y ago

OpenBSD is notably not vulnerable, because its SIGALRM handler calls syslog_r(), an async-signal-safer version of syslog() that was invented by OpenBSD in 2001. Saving the day once again.

apache101 2y ago
Theo and team way ahead of their time like always.
- pjmlp 2y ago
  Not always, 36C3 - A systematic evaluation of OpenBSD's mitigations https://www.youtube.com/watch?v=3E9ga-CylWQ https://www.youtube.com/watch?v=3E9ga-CylWQ
  - zshrc 2y ago
    Not always, but they make it their goal to be. Code standards are very strict in OpenBSD and security is always a primary thought...
  - daneel_w 2y ago
    Wouldn't a good systematic evaluation need (or at least benefit from) a few actual working exploits/PoCs? I keep asking this as a long-time OpenBSD user who is genuinely interested in seeing it done, but so far everyone who has said "it's flawed" also reserved themselves the convenience of not having to prove their point in a practical sense.
    - DEADMINCE 2y ago
      > Wouldn't a good systematic evaluation need (or at least benefit from) a few actual working exploits/PoCs? Sure, see any of the previous exploits for sshd, or any other software shipped in the OpenBSD default install. > I keep asking this as a long-time OpenBSD user who is genuinely interested in seeing it done, but so far everyone who has said "it's flawed" also reserved themselves the convenience of not having to prove their point in a practical sense. The point is they have very little in the way of containing attackers and restricting what they can. Until pledge and unveil, almost all their focus in on eliminating bugs which hey, great, but let's have a little more in case you miss a bug and someone breaks in, eh? An insecure dockerized webserver protected with SELinux is safer than Apache on a default OpenBSD install.
      - daneel_w 2y ago
        > Sure, see any of the previous exploits for sshd, or any other software shipped in the OpenBSD default install. Would you like to point to one that successfully utilizes a weakness in OpenBSD itself, which is the topic and implied statement of the video, rather than a weakness in some application running under the superuser? Just to underline, I'm not interested in discussing the hows and whys of containing arbitrary applications where one or more portions are running under euid 0. I'm interested in seeing OpenBSD successfully attacked by an unprivileged process/user.
        yjftsjthsd-h 2y ago
        Now to be fair, sshd on OpenBSD is part of OpenBSD rather than an add-on application and I think it would be fair to count exploits in it against the OS, if it had vulnerabilities there.
        DEADMINCE 2y ago
        Any vulns in any package in OpenBSD's package repositories that they audited should count as a vuln against OpenBSD itself. If OpenBSD users installed it through OpenBSD repositories and are running it will they be affected? Yes? Then it counts against the system itself.
        yjftsjthsd-h 2y ago
        I'm not sure that's fair; was log4j a vulnerability in Ubuntu itself? How about libwebp ( https://news.ycombinator.com/item?id=37657746 https://news.ycombinator.com/item?id=37657746 )?
        DEADMINCE 2y ago
        > I'm not sure that's fair; It's the way most distros handled security vulnerabilities, though. Without looking, I'm certain Ubuntu has a security advisory for that vulnerability. So I agree it might not be fair on the face of it or if doing a technical analysis or something, but if you want to compare OpenBSD security to other Linux distros by vulnerability count, (and so many who don't know better do), then vulnerabilities should be measured in the same way across both systems.
    - saagarjha 2y ago
      Let's say I show up on this message board and say my house is more secure than a bank vault, because I have a special laser in my attic that vaporizes attackers if they come in my house. Would you believe me? Would you bother to even visit my house to prove me wrong? I mean, I can claim all I want that nobody has robbed my house, but at some point there is actually nothing of value here that means nobody has tried and nobody actually wants to try.
fmbb 2y ago
“async-signal-safer” Just this morning was the first time I read the words MT-Safe, AS-Safe, AC-Safe. But I did not know there were “safer” functions as well. Is there also a “safest” syslog?
- OJFord 2y ago
  For a word like 'safe', or at least in CS, I would assume that the 'safe' one actually is 'safest'; that 'safer' is ehh it's not safe but it's an improvement on the unsafe one. It's safer.
  - ralferoo 2y ago
    Similarly, safest is normal English means not completely safe, but more safe than the other options. So safe > safest > safer > safe-ish > unsafe.
    - p51-remorse 2y ago
      Wait, that seems backwards to me as a native English speaker. The superlative version feels more safe. Safest > Safe > (…)
      - nj5rq 2y ago
        I would assume he refers to "safe" being absolutely safe, while "safest" refers to the safest of the existing alternatives?
      - DEADMINCE 2y ago
        Nah. If something is 'safe', it's safe, period. If something is safest is, it's only the best of the available options and not necessarily 'safe'.
      - ralferoo 2y ago
        One example to help think about this. Say you have 3 friends. Your friend Bob has a net worth of $1 - he is the least rich. Your friend Alex has a net worth $10 - he is richer. Another friend Ben has a net worth of $100 - he is the richest. Richest here is comparative against all 3 of them, but none of them are actually rich. Bill Gates is rich. Bezos is rich. Musk is rich. Someone with a net worth of $100 isn't. You can still have comparisons between the rich too, so Bezos is richer than Gates and he's also the richest if you're just considering the pair. But add Musk to the mix, and he's no longer the richest. I guess that last example looks like you have two attributes - rich as some objective "has a lot of money" and comparatively rich (richer, richest). For safe, it's kind of similar, except that as soon as you are saying one thing is safer than the other, then you are implicitly acknowledging that there are areas where the thing isn't safe, and if you're admitting that you can't also call it safe without contradicting yourself.
deleted 2y ago
[deleted]

by nj5rq 2y ago

OpenBSD is notably not vulnerable, because its SIGALRM handler calls syslog_r(), an async-signal-safer version of syslog() that was invented by OpenBSD in 2001. Saving the day once again.

apache101 2y ago

Theo and team way ahead of their time like always.

pjmlp 2y ago
Not always, 36C3 - A systematic evaluation of OpenBSD's mitigations https://www.youtube.com/watch?v=3E9ga-CylWQ https://www.youtube.com/watch?v=3E9ga-CylWQ
- zshrc 2y ago
  Not always, but they make it their goal to be. Code standards are very strict in OpenBSD and security is always a primary thought...
- daneel_w 2y ago
  Wouldn't a good systematic evaluation need (or at least benefit from) a few actual working exploits/PoCs? I keep asking this as a long-time OpenBSD user who is genuinely interested in seeing it done, but so far everyone who has said "it's flawed" also reserved themselves the convenience of not having to prove their point in a practical sense.
  - DEADMINCE 2y ago
    > Wouldn't a good systematic evaluation need (or at least benefit from) a few actual working exploits/PoCs? Sure, see any of the previous exploits for sshd, or any other software shipped in the OpenBSD default install. > I keep asking this as a long-time OpenBSD user who is genuinely interested in seeing it done, but so far everyone who has said "it's flawed" also reserved themselves the convenience of not having to prove their point in a practical sense. The point is they have very little in the way of containing attackers and restricting what they can. Until pledge and unveil, almost all their focus in on eliminating bugs which hey, great, but let's have a little more in case you miss a bug and someone breaks in, eh? An insecure dockerized webserver protected with SELinux is safer than Apache on a default OpenBSD install.
    - daneel_w 2y ago
      > Sure, see any of the previous exploits for sshd, or any other software shipped in the OpenBSD default install. Would you like to point to one that successfully utilizes a weakness in OpenBSD itself, which is the topic and implied statement of the video, rather than a weakness in some application running under the superuser? Just to underline, I'm not interested in discussing the hows and whys of containing arbitrary applications where one or more portions are running under euid 0. I'm interested in seeing OpenBSD successfully attacked by an unprivileged process/user.
      - yjftsjthsd-h 2y ago
        Now to be fair, sshd on OpenBSD is part of OpenBSD rather than an add-on application and I think it would be fair to count exploits in it against the OS, if it had vulnerabilities there.
        DEADMINCE 2y ago
        Any vulns in any package in OpenBSD's package repositories that they audited should count as a vuln against OpenBSD itself. If OpenBSD users installed it through OpenBSD repositories and are running it will they be affected? Yes? Then it counts against the system itself.
        yjftsjthsd-h 2y ago
        I'm not sure that's fair; was log4j a vulnerability in Ubuntu itself? How about libwebp ( https://news.ycombinator.com/item?id=37657746 https://news.ycombinator.com/item?id=37657746 )?
        DEADMINCE 2y ago
        > I'm not sure that's fair; It's the way most distros handled security vulnerabilities, though. Without looking, I'm certain Ubuntu has a security advisory for that vulnerability. So I agree it might not be fair on the face of it or if doing a technical analysis or something, but if you want to compare OpenBSD security to other Linux distros by vulnerability count, (and so many who don't know better do), then vulnerabilities should be measured in the same way across both systems.
  - saagarjha 2y ago
    Let's say I show up on this message board and say my house is more secure than a bank vault, because I have a special laser in my attic that vaporizes attackers if they come in my house. Would you believe me? Would you bother to even visit my house to prove me wrong? I mean, I can claim all I want that nobody has robbed my house, but at some point there is actually nothing of value here that means nobody has tried and nobody actually wants to try.

fmbb 2y ago

“async-signal-safer” Just this morning was the first time I read the words MT-Safe, AS-Safe, AC-Safe. But I did not know there were “safer” functions as well. Is there also a “safest” syslog?

OJFord 2y ago
For a word like 'safe', or at least in CS, I would assume that the 'safe' one actually is 'safest'; that 'safer' is ehh it's not safe but it's an improvement on the unsafe one. It's safer.
- ralferoo 2y ago
  Similarly, safest is normal English means not completely safe, but more safe than the other options. So safe > safest > safer > safe-ish > unsafe.
  - p51-remorse 2y ago
    Wait, that seems backwards to me as a native English speaker. The superlative version feels more safe. Safest > Safe > (…)
    - nj5rq 2y ago
      I would assume he refers to "safe" being absolutely safe, while "safest" refers to the safest of the existing alternatives?
    - DEADMINCE 2y ago
      Nah. If something is 'safe', it's safe, period. If something is safest is, it's only the best of the available options and not necessarily 'safe'.
    - ralferoo 2y ago
      One example to help think about this. Say you have 3 friends. Your friend Bob has a net worth of $1 - he is the least rich. Your friend Alex has a net worth $10 - he is richer. Another friend Ben has a net worth of $100 - he is the richest. Richest here is comparative against all 3 of them, but none of them are actually rich. Bill Gates is rich. Bezos is rich. Musk is rich. Someone with a net worth of $100 isn't. You can still have comparisons between the rich too, so Bezos is richer than Gates and he's also the richest if you're just considering the pair. But add Musk to the mix, and he's no longer the richest. I guess that last example looks like you have two attributes - rich as some objective "has a lot of money" and comparatively rich (richer, richest). For safe, it's kind of similar, except that as soon as you are saying one thing is safer than the other, then you are implicitly acknowledging that there are areas where the thing isn't safe, and if you're admitting that you can't also call it safe without contradicting yourself.

deleted 2y ago

[deleted]