Nonsense.
The other half wants him tried fairly. We just expect he will be convicted because his guilt is more obvious than OJs was.
296 karma · joined March 11, 2024
Account abandoned due to Daddy Dang personally disliking my sarcasm or tone, not because guidelines were being broken.
Enforce consistently or not at all.
The other half wants him tried fairly. We just expect he will be convicted because his guilt is more obvious than OJs was.
It's not a question of what I believe, the fats and argument are outlined in the link previously provided.
And if the last few years in US politics has shown us anything, it's that some people choose to reject reality for one of their own making.
> Try and remove citizenship from an extremely well-armed populous and see what happens.
The only insurrection attempt in recent history came from the right, and the only presidential candidate who threatened to be a dictator also came from the right.
Gun nuts are also on the right and allegedly compare very much about rising up against an authoritarian government. Except if such a government would agree with them, I guess. What traitorous hypocrites.
Those people with guns won't ever do anything because they are all preparing for an imaginary Red Dawn type situation. If legislation sneaks up on them, if it's a 'threat' they can't shoot, they will be helpless to fight it.
That side has also shown how incredibly gullible they are, so the simplest information warfare will likely pacify them. Russia has certainly demonstrated how easy a group they are to control.
> Guess to which side the overwhelming majority of the military and private arms ownership leans? Hint: it's not yours.)
Ooooh scary! lol.
Anyway, I'm done with this convo. I'd rather not enable this kind of fantasizing any further. Cheers.
The real reason you have a Second Amendment is to stop those pesky slaves from rising up and trying to obtain their freedom. [0]
Here's the funny bit. If you were even half the patriot you consider yourself to be, you'd more than agree with the issues I outlined above.
[0] https://www.nytimes.com/2018/05/24/opinion/second-amendment-...
That's the problem.
What do you do in a situation where half the population won't take a vaccine during a pandemic because they think Bill Gates is going to track you with microchips?
Honestly, what's the solution here other than to wait and hope the voting population normalizes and self-corrects?
It's what we already have, just extended a little. We already limit voting to citizens, and we have mandatory education for age groups and as a prerequisite to do certain professions.
> I certainly don't want any government to have the power to re-educate adults and limit who can vote because they're voting wrong. That's Orwellian.
Look at the situation we are in now, though. We have an extremely ignorant, outright science denying, not insignificant subset of the population, who due to our system of government can elect in people who share their beliefs, who then go on to be in real positions of power.
What do you do when you have a slight majority of Trumps or MTGs as your representatives? More than likely, freedoms will erode and wars would likely increase.
So, how can you avoid that, or worse problems caused by an ignorant voting block? If you want to keep this form of government (which I would argue we should not), I'm not sure what other solutions there are other than to have some sort of test for voting. Maybe moving the definition of what constitutes a citizen like in Starship Troopers could work.
I don't understand how anyone can genuinely believe that.
Half the population has an absolutely astounding and embarrassing level of education, think things like climate change are hoaxes, don't care about the constitution and just want Jesus' word to be law, etc etc etc.
The problem is absolutely the voters. It's also why this model of democracy is actually kind of terrible unless you have an educated population. We're basically watching the fall of the American Empire here.
Cheers.
lol, why are you going out of your way to reply to this? It's not in my comment, and it wasn't in the comment when you logged in to reply. Did you copy and paste it from your rss feed or whatever specifically to be able to reply to it? That's really weird. Anyway.
> They have felt alone, disenfranchised, and cut off by the coastal elite (both sides!) for decades.
The problem is they have no education and have no idea how to think critically. In society we have made it such a bad thing to be 'stupid', combine that with studies showing being wrong can be similar to being physically hurt [0], well, now we have a population that has no education, is religious and rejects science, doesn't want to be called stupid or be wrong, so they rally around 'alternative facts' and a charlatan who they see as one of them.
The only solution here is mandatory re-education and/or limiting who can vote, or hopefully waiting for the oldest and most stubborn conservatives to die out so alphas and gen-z can vote with a little more heart and brain.
> So no, I'm not going to be done with 'both sides'. The Left thinks that if they just prosecute Trump and get him convicted these people will just go away and we can go back to business as usual,
Trump's an especially bad candidate to be leader, the left just wants the Romney style republicans back. You know, not the science denying nazi wackos obsessed with guns and controlling women's bodies.
The left isn't the problem here, and never has been.
[0] https://www.theguardian.com/lifeandstyle/2016/feb/28/why-bei...
There's a strong argument that the candidate in question shouldn't be in the position he was in is because he acted inappropriately. Not just in demeanor and professionalism, but he has several ongoing criminal trials going right now. There is a real possibility that he committed treason.
But even so, no one is really opposed to him gaining office if that's what truly people want. At that point, the concern is what the hell is wrong with the people that voted him in, and what the hell happened to get the population to that point. My guess is Reagan.
In context though, it's quite terrifying given how much the US has fallen into tribalism. Half the population wouldn't convict a certain candidate no matter what they did.
It's the way most distros handled security vulnerabilities, though. Without looking, I'm certain Ubuntu has a security advisory for that vulnerability.
So I agree it might not be fair on the face of it or if doing a technical analysis or something, but if you want to compare OpenBSD security to other Linux distros by vulnerability count, (and so many who don't know better do), then vulnerabilities should be measured in the same way across both systems.
We are the people having this discussion. That should be obvious. It's kind of funny you accused me of pretending to be baffled, lol. The irony.
You certainly had no issue discussing this top with me until I called out your claims/methodology as nonsense.
> The question I asked another poster, where you decided to butt in,
Welcome to the Internet!
> regarded escalation from an unprivileged position and nothing else.
Yes. And I pointed out why this is an absolutely nonsense approach. You realize getting root on OpenBSD is significantly easier than several other setups or Linux distro's you've probably never heard of, though, right?
So, what is it? Afraid to be wrong? You brought too much into the OpenBSD marketing, so now it's a sunk cost for your ego?
> Nobody but yourself said anything along the lines of "only attacks against things in the default install 'count'", nor drew drew up comparisons against "the competition".
This is exactly what you imply when you want to limit attacks to LPE's that require a user account, lol.
> You clearly have some larger axe to grind, but you're doing it in a discourse playing out only in your head, without reading what others actually wrote.
No axe to grind. Just calling out bad claims and reasoning.
Even now, you've successfully got us discussing semantics and nonsense instead of you actually addressing the bs claims you made. Stellar job.
That's not an answer so much as an excuse.
> There is no tool that does that except for the version control systems that programmers use.
It wouldn't be much effort at all, especially for Google, to write a simple wrapper that relied on a database or zfs snapshots or anything actually more suitable.
You really love your assumptions, huh?
> it's just a "well, I got access, nothing more to see!"?
I said nothing like that, and besides that, if you were not just focused on arguing for the sake of it, you would see MY point was about the infrequency of the situation you were talking about (and even then your original point seemed to be contrarian in nature more than anything).
For example:
> Huh? Exploiting an unpatched vulnerability on a server to get access to a user account is.. very rare?
The 'this' I refer to is very clearly not what you've decided to map it to here. The 'this' I refer to, if you follow the comment chain, refers to a subset of something you said which was relevant to your point - the rest was not.
The thing is, we're trying to talk about the security of OpenBSD compared to its competition.
But you're trying to avoid letting anyone do that by saying only an attack against something in the default install you can do with a user account counts, which is absolutely ridiculous.
I'm not moving the goalposts nor am I pretending in any sense. Your approach just doesn't make sense, measure or indicate anything useful or relevant about the security of OpenBSD. I stated so and explained why.
But hey, keep believing whatever you want buddy.
Of course I do.
I'm not saying privsec isn't useful, I'm saying the cases where you will ssh to localhost to get root are very rare.
Maybe you test different environment or something, but on most corporate networks I test the linux machines are dev machines just used for compiling/testing and basically have shared passwords, or they're servers for webapps or something else where normal users most who have a windows machine won't have a shell account.
If there's a server where I only have a local account and I'm trying to get root and it's running an ssh server vulnerable to this attack, of course I'd try it. I just don't expect to be in that situation any time soon, if ever.
I get the point.
My point was the example being given is less than 1% of affected cases.
> It’s very common on linux pentests to need to privesc from some lower-privileged foothold
Sure. Been doing pentests for 20+ years :)
> So yes I would expect this turns out to be a useful privesc in practice.
Nah.
Better to stick to standard definitions in the future so you won't have to explain your personal definitions later on.
> No, I think your examples were excellent for illustrating the differences in systems; you can get a more secure system by severely limiting how much it can do
So you not only missed the point but decided to take away an entirely different message. Interesting.
Yes, limiting attack surface is a basic security principle. The examples I gave were not to demonstrate this basic principle, but to show that trying to gauge security by amount of vulnerabilities is foolish.
> seL4 is a good choice for embedded systems, but in itself currently useless as a server OS
Plan 9 then. Or any of other numerous OS projects that have less vulns than OpenBSD and can meet your arbitrary definition of 'useful'. The point is that trying to measure security by vuln disclosures is a terrible, terrible method and only something someone with no clue about security would use.
> but OpenBSD is a weirdly good ratio of high utility for low security exposure.
OpenBSD is just niche, that's it. Creating OpenSSH brought a lot of good marketing, but if you really look at the OS from a security perspective and look at features, it's lacking.
> Well no, that's the point - they'll be better than "fat" distros, but they absolutely will not match OpenBSD.
They absolutely will be better than OpenBSD, because they have capabilities to limit what an attacker can do in the event they get access, as opposed to putting all the eggs in the 'find all the bugs before they get exploited' basket. OpenBSD isn't anything special when it comes to security. That, really, is the point. Anything otherwise is marketing or people who have fell for marketing IMO.
> I don't really do youtube
There's a lot of good content only on that platform. Surely you can use yt-dlp or freetube or something.
> is it the one that handwaves at allegedly bad design without ever actually showing a single exploit?
That summary isn't remotely accurate, so I'd have to say no.
> Because I've gotten really tired of people loudly proclaiming that this thing is so easy to exploit but they just don't have time to actually do it just now but trust them it's definitely easy and a real thing that they could do even though somehow it never seems to actually happen.
They have remote holes listed on their homepage. Both those cases led to remote root and this supposedly secure OS had nothing to offer, while most Linux distros did. Let's make this simple. Linux allows you to contain a remote root exploit with tools like RBAC and MAC extensions. OpenBSD offers nothing. In the event both systems have the same vulnerability (of which this titular instance is not an example of) allowing remote root, Linux will be the safer system if set up correctly.
But honestly, I've gotten really tired of OpenBSD stans regurgitating that it's supposedly secure and thinking that being able to point to a lack of vulnerabilities in a barebones default install is some kind of proof of that.
Right, which is almost none. www-data should be set to noshell 99% of the time.
> or just locally for some reason).
This is all that would be relevant, and this is also very rare.
If OpenBSD users installed it through OpenBSD repositories and are running it will they be affected? Yes? Then it counts against the system itself.
I'm sorry, what? What kind of nonsense distinction is this?
Are you trying to very disingenuously try and claim only kernel exploits count as attacks against OpenBSD?
Why the hell wouldn't a webserver zero-day count? If an OS that claims to be security focused can't constrain a misbehaving web server running as root then it's sure as hell not any type of secure OS.
> I'm interested in seeing OpenBSD successfully attacked by an unprivileged process/user.
You realize there is very little that OpenBSD does to protect against LPE if there is any LPE vuln on their system, right? Surely you're not just advocating for OpenBSD based on their own marketing? If you want to limit the goalposts to kernel vulns or LPE's that already require an account you're free to do so, but that's rather silly and not remotely indicative of real world security needs.
If it's a security focused OS, it should provide ways to limit the damage an attacker can do. OpenBSD had very very little in that regard and still does, although things are slightly better now and they have a few toys.
And hey, fun fact, if you apply the same OpenBSD methodology and config of having a barebones install, you'll suddenly find at least dozens of other operating systems with equivalent or better track records.
Plan 9 has had less vulnerabilities than OpenBSD and has had more thought put into its security architecture[0], so by your metric it's the more secure OS, yeah?
Oh, SEL4 is without any doubt useful, it wouldn't be as popular and coveted if it wasn't, but I think you are trying to say widespread.
However, you seem to have taken my examples literally and missed my point, which is trying to judge the security of an OS by its vulnerabilities is a terrible, terrible approach.
> but it does include everything out of the box to be a web server
Sure, and so do plenty of minimal linux distros, and if you use the same metrics and config as OpenBSD then they'll have a similar security track record.
And honestly, Linux with one of the RBAC solutions puts OpenBSD's security to shame.
Do yourself a favor and watch the CCC talk someone else linked in the thread.