Forum Overview :: Rants

New BSD record (alternately titled OMG BSD) by Senor Barborito 07/01/2003, 2:29pm PDT OpenBSD version 3.3 (the latest) has made it 6 weeks into a new version without a single security advisory. That's a new record. To those of you looking shocked and going "what?! I thought OpenBSD was secure!!!", I'll explain . . . You see, OpenBSD has had only one major remote hole in the default installation in 7 years or so. However, non-default there have been a few problems (they're rare, but they are there) remotely. Far, far worse, however, and this applies to every other OS in existence as well, are the internal holes. Namely - how quickly can someone who has non-root login access (just a normal user) break into the root account without actually being physically present at the terminal (anyone can break into any machine with physical access)? Usually there are patches for these kinds of bugs - a slew of them, in fact, starting around 2 weeks after a new version is released. In 3.3, a lot of the programs that played around with running under alternate (root) credentials (also known as SUID (or set user id) programs) have been rewritten as non-suid, many programs that had string-formatting vulnerabilities have been gone through, painfully line by line, and had all string functions rewritten to link to 'safe' string function libraries. ProPolice, a modification to the system compiler, makes it nearly impossible to compile a program that has a buffer overflow on the system as well. The end result is that instead of the usual five or so local exploits chiming in around two weeks post-release when everybody's had time to examine the code, we're six weeks in and . . . nothing. Not one security advisory remote or local. There's a problem with MySQL's pthreads in the 3.3 --release branch (what was released in May), but that's been patched in the --stable branch (which is version release plus security advisory patches plus a few, safe, 'no duh' patches). Upcoming in 3.4, and already present in the 'experimental' --current branch of the codebase is something called WorX, or 'write or execute'. This is a pretty cool technology that makes memory pages writeable or executable, but not both. Practical upshot? Not only can buffer overflows not be compiled on a system, with this modification it's all but impossible to run them in the first place. A problem plaguing the i386 since inception . . . more or less vanishes as of OpenBSD 3.4. I'm really starting to love this OS. --SB

New BSD record (alternately titled OMG BSD) by Senor Barborito 07/01/2003, 2:29pm PDT     Re: New BSD record (alternately titled OMG BSD) by E. L. Koba 07/02/2003, 8:01pm PDT         Apparently implementation is pretty nasty. NT by Senor Barborito 07/02/2003, 9:12pm PDT