Hacker News Reader

notaplumberon Re: Integrating "safe" languages into OpenBSD? (2017)

> Is this really appropriate for a core system component to have this many dependencies?

Absolutely not. The entire OpenBSD base system can be built without an internet connection.

notaplumberon Re: Integrating "safe" languages into OpenBSD? (2017)

BSD does not use GNU coreutils. Is it really unexpected that the developer of a BSD project might have been unaware at the time of a project attempting to replace it, or simply found it incompatible with the stated requirements-- POSIX compliant base utilities. OpenBSD does not care about compatibility with GNU, for example longopts do not work for many utilities, with exceptions to permissive replacements to historically used GNU utilities (grep example).

It also does not address the concerns of higher build times compared the contemporary C counterparts, which also support far more platforms than Rust.

The use of cargo for example suggests that at least a few uu utilities makes network connections at build time to fetch dependencies!

For example something as simple as chown:

https://github.com/uutils/coreutils/blob/master/src/uu/chown...

notaplumberon Team Fortress 2 source code has leaked

I have to believe given the sheer size of these communities, that the source code being available only helped to confirm what was already known. The panic seen here hearkens back to the days when companies made similar ridiculous security claims about open source software compared to proprietary software.

notaplumberon Team Fortress 2 source code has leaked

What is up with the strange sensationalist claims in the article on and Twitter? Source code availability is not a prerequisite to people finding vulnerabilities or RCE exploits in games, there are many established games with open source game clients. Security researchers routinely reverse engineer proprietary software.

Bizarre.

notaplumberon ARM Development for the Office: Unboxing an Ampere EMag Workstation

I want one of these machines so bad. Would be an epic workstation, but the price tag is high. OpenBSD would mostly just work on these, as it already runs on the server boards. It even already has AMD graphics drivers ported to arm64, and a chromium browser port!

notaplumberon OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f

No. LibreSSL fork predates the issue, and has its own TLS 1.3 implementation. I'd expect the situation to be similar with Google's BoringSSL, but I don't how closely they track OpenSSL, if at all.

notaplumberon OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f

Which is a bizarre statement, all ports development happens on the OpenBSD -current branch, which is effectively a rolling release for developers/users running snapshots.

All of those projects that switched were simply expecting LibreSSL/OpenBSD to upstream support, when it hasn't got nearly the same numbers of developers.

Also, there were other problems with updating Qt on OpenBSD, but that was resolved. It is maintained by a single developer.

https://marc.info/?l=openbsd-ports-cvs&m=158411843726544&w=2

notaplumberon OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f

> Both SSH and SSL base on TLS.

You are very mistaken. OpenSSH only uses OpenSSL (or LibreSSL) as an optional dependency for the libcrypto primitives (RSA/AES etc). NOT for libssl.

The SSH protocol has nothing to do with either SSL or TLS.

notaplumberon OpenSSL high-severity bug – affects 1.1.1d, 1.1.1e, 1.1.1f

No, LibreSSL is a fork of OpenSSL that predates this vulnerability, it even predates the OpenSSL 1.1.x API break (some compatibility has since been added), and has an entirely separate and new TLS 1.3 implementation.

https://www.openbsd.org/papers/bsdcan2019-tls13.pdf (video: https://www.youtube.com/watch?v=MCVIBwGOwNY)

It maintains source compatibility with OpenSSL at an API and command-line level (e.g. openssl(1) utility).

LibreSSL cannot copy code from later versions of OpenSSL as they relicensed it under the Apache 2.0 license.

notaplumberon Ask HN: I'm a software engineer going blind, how should I prepare?

'mental' can often also mean 'crazy'.

notaplumberon Is BGP Safe Yet?

Thanks for the update!

notaplumberon Is BGP Safe Yet?

OpenBSD just released a portable version of their privsep rpki-client(8)* this week!

https://www.rpki-client.org/

rpki-client 6.6p1 was released Apr 13, 2020: https://www.rpki-client.org/txt/rpki-client-6.6p1.txt

* https://man.openbsd.org/rpki-client

Looks like there may be problems with the mirror sites, a generated tarball is on the official portable github, but it may be worth waiting for an official announcement as github can re-roll these (it's not an uploaded release asset): https://github.com/rpki-client/rpki-client-portable/releases

notaplumberon 18-year-old personal website, built with Frontpage and still updated

I sorta knew that. But it still feels weird for dollar amounts. As 25.000 looks a lot like 25.00 ($25 dollars, 0 cents).

notaplumberon 18-year-old personal website, built with Frontpage and still updated

They mean USD $25,000 and not $25.

notaplumberon Clang vs. other open-source compilers

I wish more people would have seen through this, but alas.. this is the real reason. Corporate pressure, agenda, not the best interest of the open source community.

http://lists.llvm.org/pipermail/llvm-dev/2015-October/091536...

"1) Some contributors are actively blocked from contributing code to LLVM."

> These contributors have been holding back patches for quite some time that they’d like to upstream. Corporate contributors (in particular) often have patents on many different things, and while it is reasonable for them to grant access to patents related to LLVM, the wording in the Developer Policy can be interpreted to imply that unrelated parts of their IP could accidentally be granted to LLVM (through “scope creep”).

[..]

> This is a complicated topic that deals with legal issues and our primary goal is to unblock contributions from specific corporate contributors."

Legally dubious relicensing was not only unnecessary, it is now preventing 9.0> use and future contributions, OpenBSD, which has a long history of opposing Apache 2.0. And using LLVM/Clang as the default compiler for the kernel/userland and a ports tree with 10,000 software packages.

https://marc.info/?l=openbsd-misc&m=147503691302850&w=2

http://lists.llvm.org/pipermail/llvm-dev/2017-April/112300.h...

notaplumberon Clang vs. other open-source compilers

> GCC is licensed under the GPL license. Clang uses a BSD license ...

Looks like this hasn't been updated in a while. As of Clang 9.0 they migrated everything to the Apache 2.0 license, which is not nearly as permissive as BSD. Apache 2.0 mixes US Contract law with Copyright law, and that is considered wholly "not permissive enough" by many, most notably OpenBSD which is stuck on Clang 8.0.1. They also migrated the libc++/libc++abi C++ standard libraries from MIT to Apache 2.0 as well (which was a real dick move), but they don't care.

notaplumberon Linux 5.5 to Offer Mainline Support for SGI's Octane MIPS Workstations

https://www.openbsd.org/sgi.html

"The OpenBSD/sgi port was discontinued after the 6.5 release."

That said, it was a very mature port and ran on many models, in 64-bit mode.

The code remains in -current for now.. the last release, 6.5 is a complete modern (was released in 2019) Unix operating system, which is more than can be said for running IRIX or Linux on these machines. I'm not even _aware_ of any binary distros of Linux for these. And good luck building your own kernel and userland.

notaplumberon Pledge() and Unveil() in SerenityOS

If a program needs arbitrary file-access late or "forever" then at least unveil(2) won't work, because that process needs arbitrary access. Sometimes a user policy can be enforced, i.e: documents must be in $HOME/Documents. But if not, that process can still pledge rpath or wpath. It's broader but may still limit creating/removing files, reading but not writing, etc.

unveil(2) requires upfront knowledge, hard-coded or via configuration file, or computed at initialization time before the final locking unveil call.

One model is using a privilege separation, various ways to do it, browsers might allow the main browser process access to the filesystem, defining an IPC mechanism (passing file descriptors) for restricted processes, like the renderer or content processes which are "sandboxed". They could use unveil(2) to lock down direct access to the filesystem, except to maybe read access to browser config, temporary directories.

Another is having an out-of-process "filepicker" UI.

notaplumberon OpenBSD won't update Firefox, advises users to switch to ESR

> OpenBSD-current users are not affected, www/mozilla-firefox update is already committed and will be available soon on the mirrors.

notaplumberon Removing the Linux /dev/random blocking pool

In 2012, first release 5.3 in 2013. Added by Matthew Dempsky. It was used for the per-shared object stack protector cookie extended for the per-function cookies required for RETGUARD.

https://github.com/openbsd/src/blob/master/libexec/ld.so/SPE...

https://www.openbsd.org/innovations.html

No other OS has this.

notaplumberon HyperbolaBSD Roadmap: hard fork of the OpenBSD kernel and userspace

What it means. It's glib remark implying there was any difficulty.

notaplumberon HyperbolaBSD Roadmap: hard fork of the OpenBSD kernel and userspace

I'm sure they won't, if history tells us anything. It'll forever remain "liberated".

notaplumberon HyperbolaBSD Roadmap: hard fork of the OpenBSD kernel and userspace

Unless it's not immediately obvious-- there are no OpenBSD developers associated with this project, past or present. This isn't some splitting of existing communities.

There was nothing "hard" about this fork, it's funny how a few GNU aficionados think that deleting a few freely redistributeable firmware files constitutes significant "new code" contributions.

It's in the same vein as projects like "libertybsd" or "libreboot"-- misleading people into thinking they are anything but a agenda driven project, onboarding like-minded and inexperienced new users, meanwhile offloading most (if not all) the support/technical burden on other communities.

notaplumberon #include </etc/shadow>

This isn't limited to C. If you run compiles as root, game over.

    fn main() {
        let shadow = include_str!("/etc/shadow");
        println!("{}", shadow);
    }

That's why OpenBSD ports clusters uses unprivileged users for fetching and building (with no network access/chroot).

notaplumberon Win32 on macOS

Why OpenBSD/amd64 will not, and never has supported 32-bit binary compatibility on 64-bit.

https://marc.info/?l=openbsd-misc&m=148926149318522

notaplumberon Authentication Vulnerabilities in OpenBSD

It's a few threads above the OpenBSD one on oss-security, hardly obscure.

https://www.openwall.com/lists/oss-security/2019/12/

notaplumberon Authentication Vulnerabilities in OpenBSD

Yes, correct. smtpd is enabled on localhost for local users only. This is pretty common on most systems, AFAIK Debain uses exim4.

notaplumberon Authentication Vulnerabilities in OpenBSD

No.

notaplumberon Authentication Vulnerabilities in OpenBSD

Most of the issues are classified as Local privilege escalation, and none of the daemons mentioned are enabled by default, sshd can be enabled in the installer, but as the quote says "sshd is not exploitable thanks to its defense-in-depth mechanisms."

So, no. Still holds.

Worth pointing that Linux has had a rough week as well, this one is pretty bad: https://www.openwall.com/lists/oss-security/2019/12/02/2

Patch your systems.

notaplumberon Authentication Vulnerabilities in OpenBSD

> We thank Theo de Raadt and the OpenBSD developers for their incredibly quick response: they published patches for these vulnerabilities less than 40 hours after our initial contact.

Awesome.