beachhead

https://imgur.com/EiHZIXJ - wonder if any of these folks are still around?

#flux is still alive and kickin' 24 years later but much smaller than in 2001.

oh i must be confused about what a CTF challenge is

so they're used in combination with already known exploits but you're saying no one uses them during the development of exploits?

what are popular ROP compilers used for then?

what's cattle slavery? we talkin dairy cows or what?

I'm looking forward to it!

I hear you. I guess I'd just like to see more hacking and less of the memes. For me I think again that it would help more than hurt.

I'm an old man now and maybe I've gone a bit soft but I don't see much benefit in mocking and am more interested in helping even if that means wasting a bit of time.

Can you share more about what you are working on right now? If not, hopefully we'll see something about it in the near future once you're done.

It would be cool for one of these folks (or anyone really) to show us why these things won't work. I see people I respect in that thread but I'm also very tired of hearing about how trivial these things are and not seeing someone spend, according to them, very little time to bypass these things.

Obviously, I'm not smart enough to do it or else I'd be doing it. However, I'm not going around making wild claims either. I think something like that would help rather than hinder OpenBSD.

More from Qualys: https://seclists.org/oss-sec/2023/q1/109

More from OpenBSD: https://marc.info/?l=openbsd-tech&m=167715187212393&w=2

Ah, I see you just want to get into a fight.

You've got the wrong guy, ace. Have a good day.

I'm not sure what to tell you. It didn't make sense. It doesn't make sense. There was nothing technical about what you wrote. Other people don't need to confirm that something doesn't make sense to me. I'm not making a claim, I'm telling you that it didn't make sense. What do you not understand about this?

I'm not trying to insult you or dispute what you wrote. I'm just telling you, again, that it does not make sense.

You keep repeating that all OpenBSD tries to do is audit to find bugs, but that is very obviously not all that they do to prevent exploitation and post-exploitation issues. I'm not sure why you keep doing that. This is one of the parts that doesn't make sense to me.

You say that unveil or pledge aren't enough or aren't as good as SELinux. There is nothing technical about saying that. That's just your opinion that others do not share. I'm not even commenting on whether or not I agree or disagree with you about that. However, you aren't making a point in expressing this opinion. That's something else that doesn't make sense to me.

So, do you want to try to explain what point you're trying to make again? The whole thing. All I'm getting from the things you're saying is that you love SELinux and you have almost no understanding of any other aspect of what OpenBSD does beyond auditing code.

Yeah it couldn't possibly be you.

Nothing you wrote made any sense at all. So, explain the whole thing again, I guess?

I'm sorry, what?

It'll never happen. Every single time this comes up it turns into the same thing over and over again. You must remember the person that said they'd "write a blogpost bypassing OpenBSD mitigations next week" and that's been well over a month now and, surprise, there's no blog about this.

Everything OpenBSD does is wrong and trivial to bypass but everyone's too busy to do it. Maybe the dumbest part about this is that nobody on the other side of this is making claims that these mitigations are perfect in any way.

Qualys has bypassed some OpenBSD malloc hardening features recently but then they don't go around making wild or insulting claims about how wrong and trivial they are either. Go figure.

hey, you finish that blog bypassing those mitigations yet?

so, one video then? where the blogs at?

can't wait!

i really hope you do this because it's super annoying to see all these folks talk about how these mitigations don't work but nobody really _shows_ it.

it's always the same thing whenever openbsd is mentioned.

"these mitigations don't work."

- "okay, please show us that they don't work"

"well, i don't use openbsd"

rinse. repeat.

it would also be nice to see some patches/fixes/suggestions/etc submitted after you've bypassed/defeated/whatever these things sent to the mailing lists. i don't suppose you'd agree to that?

is pledge easy to escape? can you give some examples?

someone show us bypasses for all these mitigations that don't mitigate anything please

you were a contractor, not an apple employee.

Thank you for taking the time to reply and explain things to me. I appreciate it. I've nothing else to add because I just wanted to know more.

Right. So, how does that render OpenBSD's useless? Maybe I'm not being clear about what I'm asking here. I'm not comparing software vs hardware CFI. OpenBSD doesn't have support for PAC or CET (That I know of) but that doesn't mean they won't in the future. Should there be no software CFI then? Perhaps they would eventually complement each other?

Is the ROP gadget hardening OpenBSD does mostly useless tho? Can you elaborate?

Who is we?

Word? Nobody uses OpenBSD? I reckon you've got some sources to back your claims, right? I mean surely you wouldn't just be making things up. Let's see them.

I watched the talk. The guy was wearing a t-shirt with the OpenBSD mascot with "got hacked" under it. Again if you read the about section it seems pretty clear. You're parroting the same language from the talk. Why should there be counter points to some random internet person's claims? Where are those bypasses at? Where are the patches to incorporate these better mitigations or to improve existing ones?

I don't think OpenBSD has perfect security and I'm not sure why that needs to be said. I don't see anyone involved in the project making that claim either. What I'm saying is this talk/website is just as dubious as some of y'all think OpenBSD mitigations are and if that's not obvious from looking at the sources I'm not sure what else to say here.

If you look at some of the comments, sources, and just the attitude of the guy that put this together it seems he does have an axe to grind. It kinda says so in the about section. I think if you dive into the mitigations section without looking at that it seems less like that because he ends up having to admit some of them are decent ideas... try as he might to come up with ways in which they're not. There are plenty of OpenBSD users going around talking nonsense but this "systematic evaluation" is not an actual systematic evaluation.

I especially like the part where it lists people who helped but it's all redacted. All of this "research" came from google and twitter. I'd like to see some bypasses to OpenBSD's mitigations and perhaps some ideas and/or code to help improve them or implement ones that these folks say work better. If they're all so bad then it shouldn't be hard for someone like the author or so called security experts he quoted to do these things. Yeah, maybe no one is going to pay for that work to be done... that seems to always be the response when someone asks for proof, code, etc. No one has the time. They sure spend enough time making websites, blog posts, and tweeting about it though.