5 ms·

Theo and team way ahead of their time like always.

pjmlp 2y ago
Not always, 36C3 - A systematic evaluation of OpenBSD's mitigations https://www.youtube.com/watch?v=3E9ga-CylWQ https://www.youtube.com/watch?v=3E9ga-CylWQ
- zshrc 2y ago
  Not always, but they make it their goal to be. Code standards are very strict in OpenBSD and security is always a primary thought...
- daneel_w 2y ago
  Wouldn't a good systematic evaluation need (or at least benefit from) a few actual working exploits/PoCs? I keep asking this as a long-time OpenBSD user who is genuinely interested in seeing it done, but so far everyone who has said "it's flawed" also reserved themselves the convenience of not having to prove their point in a practical sense.
  - DEADMINCE 2y ago
    > Wouldn't a good systematic evaluation need (or at least benefit from) a few actual working exploits/PoCs? Sure, see any of the previous exploits for sshd, or any other software shipped in the OpenBSD default install. > I keep asking this as a long-time OpenBSD user who is genuinely interested in seeing it done, but so far everyone who has said "it's flawed" also reserved themselves the convenience of not having to prove their point in a practical sense. The point is they have very little in the way of containing attackers and restricting what they can. Until pledge and unveil, almost all their focus in on eliminating bugs which hey, great, but let's have a little more in case you miss a bug and someone breaks in, eh? An insecure dockerized webserver protected with SELinux is safer than Apache on a default OpenBSD install.
    - daneel_w 2y ago
      > Sure, see any of the previous exploits for sshd, or any other software shipped in the OpenBSD default install. Would you like to point to one that successfully utilizes a weakness in OpenBSD itself, which is the topic and implied statement of the video, rather than a weakness in some application running under the superuser? Just to underline, I'm not interested in discussing the hows and whys of containing arbitrary applications where one or more portions are running under euid 0. I'm interested in seeing OpenBSD successfully attacked by an unprivileged process/user.
      - yjftsjthsd-h 2y ago
        Now to be fair, sshd on OpenBSD is part of OpenBSD rather than an add-on application and I think it would be fair to count exploits in it against the OS, if it had vulnerabilities there.
        DEADMINCE 2y ago
        Any vulns in any package in OpenBSD's package repositories that they audited should count as a vuln against OpenBSD itself. If OpenBSD users installed it through OpenBSD repositories and are running it will they be affected? Yes? Then it counts against the system itself.
        yjftsjthsd-h 2y ago
        I'm not sure that's fair; was log4j a vulnerability in Ubuntu itself? How about libwebp ( https://news.ycombinator.com/item?id=37657746 https://news.ycombinator.com/item?id=37657746 )?
        DEADMINCE 2y ago
        > I'm not sure that's fair; It's the way most distros handled security vulnerabilities, though. Without looking, I'm certain Ubuntu has a security advisory for that vulnerability. So I agree it might not be fair on the face of it or if doing a technical analysis or something, but if you want to compare OpenBSD security to other Linux distros by vulnerability count, (and so many who don't know better do), then vulnerabilities should be measured in the same way across both systems.
  - saagarjha 2y ago
    Let's say I show up on this message board and say my house is more secure than a bank vault, because I have a special laser in my attic that vaporizes attackers if they come in my house. Would you believe me? Would you bother to even visit my house to prove me wrong? I mean, I can claim all I want that nobody has robbed my house, but at some point there is actually nothing of value here that means nobody has tried and nobody actually wants to try.

Not always, 36C3 - A systematic evaluation of OpenBSD's mitigations https://www.youtube.com/watch?v=3E9ga-CylWQ https://www.youtube.com/watch?v=3E9ga-CylWQ

zshrc 2y ago
Not always, but they make it their goal to be. Code standards are very strict in OpenBSD and security is always a primary thought...
daneel_w 2y ago
Wouldn't a good systematic evaluation need (or at least benefit from) a few actual working exploits/PoCs? I keep asking this as a long-time OpenBSD user who is genuinely interested in seeing it done, but so far everyone who has said "it's flawed" also reserved themselves the convenience of not having to prove their point in a practical sense.
- DEADMINCE 2y ago
  > Wouldn't a good systematic evaluation need (or at least benefit from) a few actual working exploits/PoCs? Sure, see any of the previous exploits for sshd, or any other software shipped in the OpenBSD default install. > I keep asking this as a long-time OpenBSD user who is genuinely interested in seeing it done, but so far everyone who has said "it's flawed" also reserved themselves the convenience of not having to prove their point in a practical sense. The point is they have very little in the way of containing attackers and restricting what they can. Until pledge and unveil, almost all their focus in on eliminating bugs which hey, great, but let's have a little more in case you miss a bug and someone breaks in, eh? An insecure dockerized webserver protected with SELinux is safer than Apache on a default OpenBSD install.
  - daneel_w 2y ago
    > Sure, see any of the previous exploits for sshd, or any other software shipped in the OpenBSD default install. Would you like to point to one that successfully utilizes a weakness in OpenBSD itself, which is the topic and implied statement of the video, rather than a weakness in some application running under the superuser? Just to underline, I'm not interested in discussing the hows and whys of containing arbitrary applications where one or more portions are running under euid 0. I'm interested in seeing OpenBSD successfully attacked by an unprivileged process/user.
    - yjftsjthsd-h 2y ago
      Now to be fair, sshd on OpenBSD is part of OpenBSD rather than an add-on application and I think it would be fair to count exploits in it against the OS, if it had vulnerabilities there.
      - DEADMINCE 2y ago
        Any vulns in any package in OpenBSD's package repositories that they audited should count as a vuln against OpenBSD itself. If OpenBSD users installed it through OpenBSD repositories and are running it will they be affected? Yes? Then it counts against the system itself.
        yjftsjthsd-h 2y ago
        I'm not sure that's fair; was log4j a vulnerability in Ubuntu itself? How about libwebp ( https://news.ycombinator.com/item?id=37657746 https://news.ycombinator.com/item?id=37657746 )?
        DEADMINCE 2y ago
        > I'm not sure that's fair; It's the way most distros handled security vulnerabilities, though. Without looking, I'm certain Ubuntu has a security advisory for that vulnerability. So I agree it might not be fair on the face of it or if doing a technical analysis or something, but if you want to compare OpenBSD security to other Linux distros by vulnerability count, (and so many who don't know better do), then vulnerabilities should be measured in the same way across both systems.
- saagarjha 2y ago
  Let's say I show up on this message board and say my house is more secure than a bank vault, because I have a special laser in my attic that vaporizes attackers if they come in my house. Would you believe me? Would you bother to even visit my house to prove me wrong? I mean, I can claim all I want that nobody has robbed my house, but at some point there is actually nothing of value here that means nobody has tried and nobody actually wants to try.