News for hackers. Stuff that matters.

A comment on Initial support for guided disk encryption in OpenBSD installer. Parent comment

Re:Initial support for guided disk encryption in OpenBSD ins... by stonogo on Wednesday March 08, 2023 @11:54AM (#35071429)
I don't know why you're acting like anyone actually uses SELinux the way you are describing it. It's notoriously a pain in the ass to configure any meaningful system-level protection from root accounts, to the degree that most deployments who bother at all only protect one or two directories. Even then SELinux is such a bolted-on mess that it's still subject to evil maid attacks and so forth.

And you're wrong about OpenBSD. I'm not going to get as angry about this as you appear to be, but I recommend you run "man 7 securelevel" on one of the OpenBSD systems you've been playing with for 20 years.

[ Parent | on HN ]
Re:Initial support for guided disk encryption in OpenBSD ins... by Zurrrrr on Wednesday March 08, 2023 @12:07PM (#35071633)
You're very wrong about SELinux and I assume haven't touched it in years. It's enabled by default in Fedora, other distros use it as well, and it really isn't at all that big a deal to learn and configure proportional to the benefit.

I'm not remotely wrong about OpenBSD, and that manpage doesn't contain anything that contradicts a point I've made.

[ Parent | on HN ]
Re:Initial support for guided disk encryption in OpenBSD ins... by stonogo on Wednesday March 08, 2023 @05:46PM (#35075847)
I administer thousands of selinux boxes professionally. I, like the vast majority of Earth's population, remain steadfastly uninterested in Fedora's default behavior.

You claim that OpenBSD has no conpromised-root mitigation. I have provided evidence to back my counterclaim. I will assume your rejection of actual evidence indicates a disinterest in good-faith argument, so I won't bother pressing the point, except to mention that you may be more successful persuading people to support your case if you adopt a reality-based approach to argument instead of just making wild-ass assumptions about other people.

[ Parent | on HN ]
Re:Initial support for guided disk encryption in OpenBSD ins... by Zurrrrr on Wednesday March 08, 2023 @06:13PM (#35076102)
You haven't provided evidence at all, that's the thing. You're either wrong or misunderstanding something.
[ Parent | on HN ]