4 ms·

Reminds me of Theo DeRaadt again: https://marc.info/?l=openbsd-misc&m=119318909016582 https://marc.info/?l=openbsd-misc&m=119318909016582

by sdcfgy 1mo ago

throwa356262 1mo ago
Theo is a very insightful guy, but also very opinionated. I think the truth is somewhere in between. Especially as more and more virtualization functions move into hardware, not using them as a second security barrier seems foolish.
12995816 1mo ago
[flagged]
- Topfi 1mo ago
  It has? News to me. Go on any major thread on this page, you’ll witness similarly strong pushback visa-vi buying into corporate backed hype, akin to the overconfidence in virt security he pointed at back then.
  - nython 1mo ago
    Vi doesn't require a visa but the trip is one way only. (Vis-a-vis)
    - Topfi 1mo ago
      You know, given my French grades, I really should stop using such phrases…
XMPPwocky 1mo ago
Looks like this has nothing to do with the hypervisor, it's not a traditional VM escape
fallat 1mo ago
Brutal I hope when people read this though they understand this is a communication style; they're clearly trying to strongly discourage people from thinking they are suddenly protected. Effective? Maybe at one time, where "macho dev energy" was a thing. Today, not so much. You can tell they mean well because the intro sentence is actually pretty cheeky!
zvmaz 1mo ago
All I see is rudeness, insults, and arrogance sparkled with inklings of technical arguments. Worthless.
- iugtmkbdfil834 1mo ago
  But, and this is the important part, is he wrong?
  - zvmaz 1mo ago
    I don't really know as the argument is mainly about how stupid people are... The technical argument is one paragraph ended with an insult, not much to make an educated and civilized opinion.
    - iugtmkbdfil834 1mo ago
      << You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes. Allow me to start by saying that you are wrong about 'mainly about'. The argument starts with an insult, but insult is minimal and it moves directly into the technical details. But, note that how much you are wrong about the paragraph, because what you want to focus is the insult. You are so wrong about it you effectively invert the proportions of presence of technical data to insult..
  - eli 1mo ago
    What if that isn’t the most important part
  - matherial 1mo ago
    Being right is not the most important part. If you're right but don't convince anyone, you've made no difference. Theo was right that virtualization is a comparatively shoddy security boundary. At the same time, it's flexible and capable in ways that now define the shape of modern IT. Could we have replicated that by other means? If yes, then it's on Theo and other knee-jerk critics that they never proposed a better approach and settled for insulting people. If not, then maybe virtualization was a necessary evil. Or maybe everyone else is an irredeemable idiot, but again - if we reach that conclusion, is the world better off?
edelbitter 1mo ago
This is less of a virt/x86 bug and more of a "don't call system() on arbitrary user input" bug. .. incidentally, OpenBSD also provides one of the clearest examples of how the excuse "calling system() is fine in my case, its totally not arbitrary user input" is deluded just the same, see CVE-2020-8794.
pornel 1mo ago
The bug here is not related to virtualization, but a footgun as old as C stdlib: system() that doesn't take arguments separately, and instead relies on shell escaping by the application.
- 1718627440 1mo ago
  The only point of system(3) is to invoke the OS shell, if you do not want that use exec(3).
Topfi 1mo ago
I feel that, in fairness, one should at least read Adam’s response, though ideally all subsequent mails: https://marc.info/?l=openbsd-misc&m=119320496730314&w=2 https://marc.info/?l=openbsd-misc&m=119320496730314&w=2 Theos is a very opinionated and not necessarily wrong position, but I feel also a bit too reductive given we are eternally having to deal with compromises of some form. Also, lest we forget, it has been two decades in the interim and oh so much has changed. In any case, this originated from their code, not virtualization, so it doesn’t really apply either way…
- chmod775 1mo ago
  That's an impressive amount of maturity and composure Adam demonstrates there after receiving a response like that.
- sdcfgy 1mo ago
  I think it's pretty much spot on myself and applies to more than virtualization based on the last point. It really suggests that further complexity and abstraction is not a good security posture. And I agree with this from extensive experience (embedded, defence). Regarding the two decades since and the numerous exploitable x86-64 and hypervisor bugs suggests he wasn't wrong and that the tone was appropriate for the severity of the problem.
  - dvdkon 1mo ago
    Sadly complexity is unavoidable for most real-world usecases. Just see how so many people interested in de-Googled phones balk at the prospect of losing access to banking apps. Telling them to go use an OS that doesn't support Bluetooth isn't going to work, but hopefully you wouldn't say that means they should give up all hope of security. Abstraction has served us well in managing complexity before. I wouldn't abandon it out of misplaced idealism.
    - sdcfgy 1mo ago
      Hey I'm quite happy to run my banking over TN3270 :)

Reminds me of Theo DeRaadt again: https://marc.info/?l=openbsd-misc&m=119318909016582 https://marc.info/?l=openbsd-misc&m=119318909016582

by sdcfgy 1mo ago

Reminds me of Theo DeRaadt again: https://marc.info/?l=openbsd-misc&m=119318909016582 https://marc.info/?l=openbsd-misc&m=119318909016582

throwa356262 1mo ago

Theo is a very insightful guy, but also very opinionated. I think the truth is somewhere in between. Especially as more and more virtualization functions move into hardware, not using them as a second security barrier seems foolish.

12995816 1mo ago

[flagged]

Topfi 1mo ago
It has? News to me. Go on any major thread on this page, you’ll witness similarly strong pushback visa-vi buying into corporate backed hype, akin to the overconfidence in virt security he pointed at back then.
- nython 1mo ago
  Vi doesn't require a visa but the trip is one way only. (Vis-a-vis)
  - Topfi 1mo ago
    You know, given my French grades, I really should stop using such phrases…

XMPPwocky 1mo ago

Looks like this has nothing to do with the hypervisor, it's not a traditional VM escape

fallat 1mo ago

Brutal I hope when people read this though they understand this is a communication style; they're clearly trying to strongly discourage people from thinking they are suddenly protected. Effective? Maybe at one time, where "macho dev energy" was a thing. Today, not so much. You can tell they mean well because the intro sentence is actually pretty cheeky!

zvmaz 1mo ago

All I see is rudeness, insults, and arrogance sparkled with inklings of technical arguments. Worthless.

iugtmkbdfil834 1mo ago
But, and this is the important part, is he wrong?
- zvmaz 1mo ago
  I don't really know as the argument is mainly about how stupid people are... The technical argument is one paragraph ended with an insult, not much to make an educated and civilized opinion.
  - iugtmkbdfil834 1mo ago
    << You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes. Allow me to start by saying that you are wrong about 'mainly about'. The argument starts with an insult, but insult is minimal and it moves directly into the technical details. But, note that how much you are wrong about the paragraph, because what you want to focus is the insult. You are so wrong about it you effectively invert the proportions of presence of technical data to insult..
- eli 1mo ago
  What if that isn’t the most important part
- matherial 1mo ago
  Being right is not the most important part. If you're right but don't convince anyone, you've made no difference. Theo was right that virtualization is a comparatively shoddy security boundary. At the same time, it's flexible and capable in ways that now define the shape of modern IT. Could we have replicated that by other means? If yes, then it's on Theo and other knee-jerk critics that they never proposed a better approach and settled for insulting people. If not, then maybe virtualization was a necessary evil. Or maybe everyone else is an irredeemable idiot, but again - if we reach that conclusion, is the world better off?

edelbitter 1mo ago

This is less of a virt/x86 bug and more of a "don't call system() on arbitrary user input" bug. .. incidentally, OpenBSD also provides one of the clearest examples of how the excuse "calling system() is fine in my case, its totally not arbitrary user input" is deluded just the same, see CVE-2020-8794.

pornel 1mo ago

The bug here is not related to virtualization, but a footgun as old as C stdlib: system() that doesn't take arguments separately, and instead relies on shell escaping by the application.

1718627440 1mo ago
The only point of system(3) is to invoke the OS shell, if you do not want that use exec(3).

Topfi 1mo ago

I feel that, in fairness, one should at least read Adam’s response, though ideally all subsequent mails: https://marc.info/?l=openbsd-misc&m=119320496730314&w=2 https://marc.info/?l=openbsd-misc&m=119320496730314&w=2 Theos is a very opinionated and not necessarily wrong position, but I feel also a bit too reductive given we are eternally having to deal with compromises of some form. Also, lest we forget, it has been two decades in the interim and oh so much has changed. In any case, this originated from their code, not virtualization, so it doesn’t really apply either way…

chmod775 1mo ago
That's an impressive amount of maturity and composure Adam demonstrates there after receiving a response like that.
sdcfgy 1mo ago
I think it's pretty much spot on myself and applies to more than virtualization based on the last point. It really suggests that further complexity and abstraction is not a good security posture. And I agree with this from extensive experience (embedded, defence). Regarding the two decades since and the numerous exploitable x86-64 and hypervisor bugs suggests he wasn't wrong and that the tone was appropriate for the severity of the problem.
- dvdkon 1mo ago
  Sadly complexity is unavoidable for most real-world usecases. Just see how so many people interested in de-Googled phones balk at the prospect of losing access to banking apps. Telling them to go use an OS that doesn't support Bluetooth isn't going to work, but hopefully you wouldn't say that means they should give up all hope of security. Abstraction has served us well in managing complexity before. I wouldn't abandon it out of misplaced idealism.
  - sdcfgy 1mo ago
    Hey I'm quite happy to run my banking over TN3270 :)