Magic means large search spaces (2005) | Hacker News Reader

Magic means large search spaces (2005)

sl4.org

51 pointsoptimalsolver13 comments

If anyone was wondering about how exploitable OpenBSD was as of July 2005, a quick search suggests it took about 2 years for a remote total exploit (sendable in a single IPV6 packet) to show up for OpenBSD: https://lwn.net/Articles/225947/ (Vindicating what is surely one of the easiest security predictions ever: "There are still undiscovered remote roots in all major OSes.") Anyone know of any ones in between?

man, say what you like about my writing, it sure used to be worse

> Consider OpenBSD, the most secure OS you can obtain on an open market.

It's funny the author imagines someone (nation states?) have built and deployed hyper-secure operating systems, but they aren't sharing.

Some exist in the defense sector. Also civilian aerospace; there is no business case to bother to share.

Go ahead and name some.

I assume you're imagining embedded realtime applications rather than server or desktop OS's; civilian aerospace has no business case to develop their own when Green Hills, VxWorks, Wind River, et al. are right there.

Not imagining, from high safety/reliability consulting for some Airbus subs, Alcatel-Alstom et al. They also use GHS and WRS of course. Different subsystems have different vendors and stacks, and sometimes those large OSes are overkill.

I find it surprising that you believe that, I'd expect the opposite

Also, I doubt that OpenBSD is the most secure (open) system out there. What about seL4, Genode and the likes?

You think someone goes to the trouble of developing an operating system from scratch, device drivers from scratch, all new applications from scratch, and then training their staff to use, and then maintaining it? For what benefit?

At that level of paranoia you'd run disconnected from public networks and security from remote hackers is a non-issue.

Those weren't around in 2005, the time that was written (which is not me defending the claim about OpenBSD in 2005, I have no idea).

seL4 didn't exist, but the commercial variants of L4 did exist although they were meant for licensing to embedded companies so AFAIK you could neither download nor buy on the open market. (As the L4s were probably better known around 2005 than they are now, it's possible Eliezer was referring to those specifically.)

The conventional wisdom at the time was indeed that OpenBSD was the most secure server OS.

Did Yud ever publish the chat logs of this AI box experiment? EDIT: No, and while I agree with his general point here, I still find it really funny.

Remember that the chat logs for this "experiment" have not been released, even going on 20 years later. Feel free to dismiss this nonsense entirely, because I certainly have.

Reply on news.ycombinator.com