notaplumber

15 ms·

91.
by notaplumber 7y ago
Most of the issues are classified as Local privilege escalation, and none of the daemons mentioned are enabled by default, sshd can be enabled in the installer, but as the quote says "sshd is not exploitable thanks to its defense-in-de
92.
by notaplumber 7y ago
> We thank Theo de Raadt and the OpenBSD developers for their incredibly quick response: they published patches for these vulnerabilities less than 40 hours after our initial contact. Awesome.
93.
by notaplumber 7y ago
> I'm not very familiar with low level work and exploits, but aren't syscalls the API for the kernel itself? No. The kernel doesn't call syscalls itself. It provides them for applications. Just to clarify a potential misun
94.
by notaplumber 7y ago
Indeed. This appears to be the case for stuff encountered thus far.
95.
by notaplumber 7y ago
OpenBSD already prevents syscalls from writable pages. It did not break JITs, in fact, to quote Theo de Raadt, it brings over an aspect of W^X to JITs that haven't been adapted to work with mandatory W^X. https://marc.info&#
96.
by notaplumber 7y ago
From my dupe submission: https://news.ycombinator.com/item?id=21653796 This new proposed mitigation builds upon other work, such as libc/ld.so random re-linking at boot, and opportunistic enforcement of syscalls from o
97.
by notaplumber 7y ago
This new proposed mitigation builds upon other work, such as libc/ld.so random re-linking at boot, and opportunistic enforcement of syscalls from only un-writable pages by default. https://www.openbsd.org/innovations.ht
98.
Syscall Call-From Verification [OpenBSD](twitter.com)
5 points by notaplumber 7y ago|1 comments
99.
by notaplumber 7y ago
Probably the same (or worse) as Linux. IIRC FreeBSD still had executable stacks by default until at least 2016? Edit: I give FreeBSD too much credit. The kern.elf64.nxstack / kern.elf32.nxstack sysctls were introduced in FreeBSD 9.0, w
100.
by notaplumber 7y ago
For engineers reading this who work at a tech company, or well, any company. Watch this keynote talk by Patricia Aas. It's called Embedded Ethics. And it is crystal clear many of you need to watch it. https://www.youtube.com
101.
Why isn’t the ARIN RPKI TAL like other public key files? [video](youtube.com)
2 points by notaplumber 7y ago|0 comments
102.
by notaplumber 7y ago
They made professional quality release songs (and sold CD's) up until 6.0. A few extras showed up for 6.1-6.3 also. https://www.openbsd.org/lyrics.html
103.
by notaplumber 7y ago
Unrelated to OpenBSD's pledge(2).
104.
by notaplumber 7y ago
That's interesting! But by golly, was 1973's Westworld a chore to sit through. The remake has the technology and a compelling story.
105.
by notaplumber 7y ago
This is already possible. SSH can be enabled on the AirPort. Indeed, they run a build of NetBSD 6.0. https://jcs.org/2018/06/12/airport_ssh
106.
by notaplumber 7y ago
Here's the project website: https://gameoftrees.org/
107.
by notaplumber 7y ago
Distributing binary packages outside of OpenBSD's official repository is generally discouraged, as you'll need users to install your public key (packages must be signed, unsigned packages are rejected by pkg_add), and set a custom
108.
by notaplumber 7y ago
OpenBSD pledge(2) and unveil(2) are relatively easy to create high level language bindings for, and users have already contributed several in the community, like this latest one for Ada. In base, OpenBSD only supports C/C++, however a
109.
by notaplumber 7y ago
It's not just their cloud images, as far as I know Debian excludes all virtio drivers (net/disk/rnd) from all install media. It is very frustrating.
110.
by notaplumber 7y ago
> The OpenBSD folks also appear to trust RDRANG, which would help not blocking. But I disagree with that trust decision. It feeds the entropy pool, mixed in with many sources. OpenBSD also feeds in data from the AMD CCP as well. The poin
111.
by notaplumber 7y ago
It doesn't on OpenBSD. arc4random(3) simply can not fail, and getentropy(2) does not block. Linux screwed up getrandom. High quality random numbers are available very early in the OpenBSD kernel, and there is no early boot problem for
112.
by notaplumber 7y ago
OpenBSD has radeondrm enabled on mips64, powerpc and arm64. It can initialize the board just fine without emulating x86, since KMS. Working 3D acceleration is another story. OpenBSD even has (or had, build breaks often) packages for chromiu
113.
by notaplumber 7y ago
pledge(2), and the traditional OpenBSD privilege dropping model by which pledge(2) expands upon, is demonstrably the superior model by which developers can easily understand and use to design secure programs. Simple interfaces always beat m
114.
by notaplumber 7y ago
Capsicum is dead outside of FreeBSD, the Linux port went nowhere, and in the handful of places where it is used in FreeBSD base, it's not even utilizing capabilities to its full potential. It wasn't even enabled by default for man
115.
by notaplumber 7y ago
And here's the OpenBSD pledge(2) patch for bzip2, for comparison. But similarly it already prevents a compromised bzip2 process from accessing the network, executing arbitrary commands, etc. And when used in a pipeline, accessing the f
116.
by notaplumber 7y ago
"This talk presents the results of a use case study I performed together with my friend Maurice throughout the first quarter of 2019. Maurice is an actor who survived a brain hemorrhage in 1996 and has since lived with severe physical
117.
Building an accessible OpenBSD laptop (BSDCan 2019)(youtube.com)
5 points by notaplumber 7y ago|1 comments
118.
by notaplumber 7y ago
A bit off-topic, sorry, but I'm curious about what you mean by interfacing with Monitors/TVs wirelessly, how does that work?
119.
by notaplumber 7y ago
If you're looking for a system that does, OpenBSD adopted libc++ and libc++abi by default.
120.
by notaplumber 7y ago
Several *BSD projects have been using the Clang toolchain by default for many years, and have been a massive driving force in getting these fixes upstreamed so that other systems, incl. Linux distributions can benefit from greater choice of

More ›