News for hackers. Stuff that matters.

A comment on Authentication Vulnerabilities in OpenBSD. Parent comment

Re:Authentication Vulnerabilities in OpenBSD by mjevans on Wednesday December 04, 2019 @06:17PM (#21708238)
Probably historic compatibility. If making a breaking change this might be a good time to implement a design benefiting from decades of real world experiences.
[ Parent | on HN ]
Re:Authentication Vulnerabilities in OpenBSD by anthk on Wednesday December 04, 2019 @07:31PM (#21708764)
That's literally what OpenBSD was doing over decades,

starting with binary compatibility

with Linux and a lot of legacy stuff

which came from NetBSD and BSD 4.4 lite/BSD 4.3.

You described OpenBSD with that comment.

- Xenocara with rootless privileges as a fork of X

- LibreSSL

- Linux compat going away

- Pledge/Unveil

- Some daemons belonging to ports

- HTTPD/SMTPD and so on as replacement of bloated daemons

- OpenSSH itself

- Retguard

This vulnerability is bad, but pledge

and unveil will have even

more prominent roles in base soon, so even

if you get privs, you can do either nil or just crash because of pledge.

[ Parent | on HN ]
Re:Authentication Vulnerabilities in OpenBSD by pnako on Thursday December 05, 2019 @12:14AM (#21710153)
Hu? Those vulnerabilities are authentication bypass and local privilege escalation; sandboxing like pledge is not going to help you at all there.
[ Parent | on HN ]
Re:Authentication Vulnerabilities in OpenBSD by anthk on Thursday December 05, 2019 @01:56AM (#21710484)
He was talking on innovation vs legacy cruft.
[ Parent | on HN ]