notaplumber1

6 ms·

1.
by notaplumber1 2y ago
> I will say, though, that single VCPU guests would not have met our immediate needs in the Oxide product! Could Oxide not have helped push multi-vcpu guests out the door by sponsoring one of the main developers working on it, or contrib
2.
by notaplumber1 3y ago
OpenBSD developers are making a serious effort to kill off indirect syscalls, the base system is completely clean, take a look at the work Andrew Fresh did to adapt Perl. He wrote a complete syscall "dispatcher" or emulator for th
3.
Making OpenBSD look like Ubuntu Linux(functionallyparanoid.com)
8 points by notaplumber1 3y ago|1 comments
4.
by notaplumber1 3y ago
OpenBSD disables jump tables in Clang on amd64 due to IBT, some architectures also had jump tables disabled as part of the switch to --execute-only ("xonly") binaries by default, e.g: powerpc64/sparc64/hppa. https:&#x2F
5.
by notaplumber1 3y ago
All of those are examples of privilege seperated software imported from OpenBSD, pf and thus pflogd(8), dhclient(8) and yplapd(8). https://www.openbsd.org/innovations.html
6.
by notaplumber1 3y ago
Won't help you with Docker containers, but OpenBSD/arm64 will run OOTB on the MS Dev Kit, NVMe works, USB-3 works, 2.5Gbe Realtek NIC is supported by the ure(4) driver. The ath11k wireless is not supported though, so you'll n
7.
by notaplumber1 3y ago
I didn't say it wasn't a problem. I said it was not the problem here. Important distinction. Licensing is not the reason for the sanitizers not being enabled in the default build, a lot of stuff isn't. If it were supported, i
8.
by notaplumber1 3y ago
I'm pretty sure parsing ELF binaries is out of scope for kdump(1), sorry, but I don't think that's going to happen. It's not that difficult to run addr2line yourself with the information provided, and that's really
9.
by notaplumber1 3y ago
OpenBSD begrudgingly made an exception for LLVM/Clang, after vocal opposition to the re-licencing. It currently uses LLVM/Clang 13 and has been making progress towards 15. Licensing is not the problem here. Most of the sanitizers
10.
by notaplumber1 3y ago
Are you asking why doesn't it execv(2) addr2line deep within the libc malloc implementation? Because calling execv(2) within libraries is frowned upon.. ;-) The leak report is being generated internally by malloc. It is then logged via
11.
by notaplumber1 3y ago
Dragos Ruiu (@dragosr) also provided the video recording on his Twitter account. https://twitter.com/dragosr/status/1639015014177841153
12.
Synthetic Memory Protections: An update on ROP mitigations [pdf](openbsd.org)
96 points by notaplumber1 3y ago|55 comments
13.
Theo de Raadt on pinsyscall(2) (OpenBSD)(undeadly.org)
17 points by notaplumber1 4y ago|5 comments
14.
by notaplumber1 4y ago
OpenSSH developers documented some issues they found with PAM, in implementation and design. https://www.dtucker.net/pam/ BSD Authentication is much nicer, but has only been adopted by OpenBSD. https://man.o
15.
by notaplumber1 4y ago
Additional context, and status about recent developments in OpenBSD. BROP: https://www.scs.stanford.edu/brop/ (paper "Hacking Blind" (2014): https://www.scs.stanford.edu/brop/bittau-brop.
16.
BROP mitigation on systems without xonly (execute-only) hw-enforcement (OpenBSD)(marc.info)
2 points by notaplumber1 4y ago|1 comments
17.
Viable xonly functionality on amd64 using Memory Protection Keys/PKU (OpenBSD)(marc.info)
5 points by notaplumber1 4y ago|0 comments
18.
by notaplumber1 4y ago
I will agree that you have chosen your words carefully, and with obvious intent.
19.
by notaplumber1 4y ago
> I'd argue that things like msyscall and mstack don't at all because they cost attackers only a couple of minutes of time once to develop a bypass technique (ie move the stack pointer before a syscall, reuse the authorized sys
20.
by notaplumber1 4y ago
> As others have mentioned as well using ROP to jump to the syscall instructions in libc with your own arguments (it’s not special…) bypasses restrictions in the current design. ...ignoring other mitigations. > In fact I can extend it
21.
by notaplumber1 4y ago
If you look at the mitigations OpenBSD is doing as attack surface reduction, it means ultimately fewer tools in the attackers toolbox. It seems many of you are missing the forest for the trees.
22.
by notaplumber1 4y ago
> But using it to prevent the introduction of new code is not all that effective, unless you are far more stringent about how you allow processes to allocate executable regions. For example, if you prevent a program from mapping in any n
23.
by notaplumber1 4y ago
Apologies, I was pointing out the commit message itself rather than the contents of the commit, it's indeed full of magic numbers. It's reverse engineered, there are no docs from Qualcomm. This is commit is plumbing work fixing GP
24.
by notaplumber1 4y ago
Appreciate the additional context. It does seem like though a lot of magic is contained in the Qualcomm Windows drivers, with large parts of the ACPI tables being stubs or broken (requiring hardcoded driver quirks/workarounds).
25.
by notaplumber1 4y ago
I believe the Samsung Galaxy Book Go was tested with OpenBSD during the initial development for the ThinkPad x13s, keyboard support was added in this commit. https://github.com/openbsd/src/commit/74edc71ccae40
26.
by notaplumber1 4y ago
The upstreamed Qualcomm drivers in the Linux kernel require a device tree from the vendor which doesn't exist yet for this machine, I believe the Linux community has something cobbled together for the ThinkPad x13s, or got something fr
27.
by notaplumber1 4y ago
The recently released OpenBSD 7.2 boots and installs on it, support for the same Qualcomm Snapdragon SoC used in the ThinkPad x13s was added during last release cycle, so support for the Microsoft Dev Kit 2023 came for the most part for fre
28.
by notaplumber1 4y ago
This talk was given at this years EuroBSDcon in Vienna, recording is up on YouTube. https://2022.eurobsdcon.org/ https://www.youtube.com/watch?v=36qZYL5RlgY Some really great talks this year from all the *B
29.
OpenBSD on the Windows Dev Kit 2023(twitter.com)
3 points by notaplumber1 4y ago|0 comments
30.
by notaplumber1 4y ago
That's what BitPay handles. The OpenBSD Foundation doesn't hold onto any Bitcoin, it's immediately converted into USD.

More ›