Zurrrrr

11 ms·

121.
by Zurrrrr 4y ago
You haven't provided evidence at all, that's the thing. You're either wrong or misunderstanding something.
122.
by Zurrrrr 4y ago
You're really just showing you have no clue what you are talking about lol. That seems to be true for most of the people in this thread defending OpenBSD, as you're not the first to make the point. The reason it's wrong, the
123.
by Zurrrrr 4y ago
I'm not spouting crap at all, you just really have your head buried in the sand. YOu've drunk more of the OBSD koolaid then even mac zealots drink of the mac kooolaid. I won't be replying again as I don't see how this is
124.
by Zurrrrr 4y ago
Jesus christ, once again, the point is it doesn't matter. There is nothing in place if someone does. Good security is preparing for different possibilities, not just hoping one never happens because it seems unlikely. You're just
125.
by Zurrrrr 4y ago
lol, ok. You really think root can't access the devices? lol. So you just want to have blind faith in what is basically security via obscurity with extra steps. That's fine, but it's not an approach to be taken seriously or a
126.
by Zurrrrr 4y ago
It's absolutely possible. No idea about a proof of concept, but I don't even think it matters, honestly. It's cute that the OS might play some tricks to hide them from you, but at the end of the day, that's all it is doi
127.
by Zurrrrr 4y ago
A car can have all the tech in the world to avoid an accident, but I still expect it to have seatbelts.
128.
by Zurrrrr 4y ago
> Oh so you're saying that things like ASLR, chrooting, and safe programming practices aren't useful in things like httpd, because you might run an insecure PHP app, and the only thing that helps you then is something like SELi
129.
by Zurrrrr 4y ago
> That statement indicates you do not fully understand pledge(2) and unveil(2). Not so, not so at all. You have to take my statement in context. The point was those technologies, while nifty, are entirely irrelevant if an attacker gains
130.
by Zurrrrr 4y ago
I'm all for making software more secure, and pledge serves a niche. But it is entirely useless in the scenario where someone has root.
131.
by Zurrrrr 4y ago
Yeah, it's not like OpenBSD hasn't had remote root issues before... And this is exactly what I'm talking about. Putting more energy into hoping no one ever gets root rather than providing anything to protect against the scena
132.
by Zurrrrr 4y ago
I have no idea why you think linking that proves some kind of point, it only proves to me that as I said you are very much out of your depth in joining this conversation. Please don't reply to me again.
133.
by Zurrrrr 4y ago
If someone has remote root pledge is basically irrelevant.
134.
by Zurrrrr 4y ago
> They're absolutely dealing with that situation as well. That's why I said they were prioritizing . The very use of that word obviously means they are not just working on one thing.... Why do you keep arguing against strawmen
135.
by Zurrrrr 4y ago
If someone has remote root you are telling me they can't unhide a filesystem? Otherwise what are you disputing and what would you accept as evidence?
136.
by Zurrrrr 4y ago
Well yeah, kind of. If you consider there are levels of compromise at least. SELinux and similar frameworks do prevent further compromise. That's the point.
137.
by Zurrrrr 4y ago
Oh for sure, it can be somewhat useable for many simple cases. Many people, even most though will need to deviate from the default install. I mean, if someone is running httpd, a database might not be far behind, just for example.
138.
by Zurrrrr 4y ago
Sigh. No, I didn't. Saying OpenBSD 'really really really hopes' an attacker doesn't get root is still 100% correct. They are still prioritizing removing bugs ahead of time instead of providing stronger tools to prepare f
139.
by Zurrrrr 4y ago
You're very wrong about SELinux and I assume haven't touched it in years. It's enabled by default in Fedora, other distros use it as well, and it really isn't at all that big a deal to learn and configure proportional to
140.
by Zurrrrr 4y ago
It seems you didn't properly read my comment. I'm not talking about GETTING root, I'm talking about in the situation where an attacker already HAS root.
141.
by Zurrrrr 4y ago
I don't mean to imply that if OpenBSD ran those specific services by default that it would be much worse. My point is that: a) Generally for a server people are running some kind of services, and that's going to include third part
142.
by Zurrrrr 4y ago
This is frustrating. I don't know why you are trying to explain things when the issue is you simply were not clear with your first comment, and then acted like I misquoted you. > SEBSE is a Framework, MAC is an implementation, those
143.
by Zurrrrr 4y ago
lol I'm not wrong, but this is so silly. What's not constructive is you really needing to have the last word. If you don't want to 'quibble', don't reply. I'll just say this. Saying 'of course' t
144.
by Zurrrrr 4y ago
> That's NOT what i said, the FreeBSD MAC implementation is big and pretty much feature complete, NOT SEBSD. It is what you said. I never said you claimed SEBSD. You said FreeBSD has a massive MAC framework. I was asking which one,
145.
by Zurrrrr 4y ago
No, I understand absolutely. I've been playing with OpenBSD for over 20 years. My point is that OpenBSD wants to focus on trying to remove bugs as much as possible, and securing the system in case a bug is exploited is very much a seco
146.
by Zurrrrr 4y ago
Hiding filesystems is security via obscurity more than anything else, and probably won't hold up if someone has root. Things like SELinux by contrast allow you to remove all access and power from the root account except for what it spe
147.
by Zurrrrr 4y ago
lol, you clearly have no clue. SELinux and other MAC systems are the only thing that can protect against a hostile actor getting remote root.
148.
by Zurrrrr 4y ago
It's not false. No significant services are running by default, and for it to do anything useful you have to install and/or enable whatever services you want. Semantics doesn't change that.
149.
by Zurrrrr 4y ago
The world's exactly as big as I think it is, and I've been playing with OpenBSD since 2004 or so. The point was projects like OpenBSD often don't have support for more recent hardware, and given OpenBSD is used much more as a
150.
by Zurrrrr 4y ago
That's capabilities, not MAC

More ›