Theo De Raadt Says FreeBSD Is Just Catching Up On Security

An anonymous reader writes "The OpenBSD project has no reason to follow the steps taken by FreeBSD with regard to hardware-based cryptography because it has already been doing this for a decade, according to Theo de Raadt. 'FreeBSD has caught up to what OpenBSD has been doing for over 10 years,' the OpenBSD founder told iTWire. 'I see nothing new in their changes. Basically, it is 10 years of FreeBSD stupidity. They don't know a thing about security. They even ignore relevant research in all fields, not just from us, but from everyone.'"

Comments

Now, if...

[Dahamma]

...only OpenBSD would catch up in every OTHER category...

Re:Now, if...

[cold fjord]

...only OpenBSD would catch up in every OTHER category...

You can always port or build other software on OpenBSD.

You can't really bring other operating systems up to OpenBSD security standards with just a compile or two.

Make your pick: secure, or convenient.

Re:Now, if...

[Arker]

What method could possibly be more convenient, simple, and appropriate than opening the file with your text editor of choice and deleting the line?

What do you expect? Some bulky "management interface" to hold your hand while you take 10 times as long as necessary to do the simple task of *removing an entry from a text file*? What is wrong with you?

Re:Now, if...

[Anonymous Coward]

Secure By Default only seems obvious in retrospect. Remember when OSes like RedHat 5 and Windows 2000 automatically started a shitload of network services? No I don't need to run Finger or share my printers over HTTP. Predictably, they got owned before you could download the patches.

Re:Now, if...

[Bert64]

Still running default services and just hiding them behind a firewall is a stupid, not having them running at all is far more sensible.

Yeah

[Anonymous Coward]

Good old Theo De Raadt.

Half human, half cunt.

Re:Yeah

[ArchieBunker]

And usually right.

Re:Yeah

[TheRaven64]

I have a lot of respect for most of the OpenBSD team, but Theo is definitely trolling here.

Let's start with the premise of TFA, which cites the article on Ars that was covered here a few days ago and was complete nonsense about the new random number infrastructure in FreeBSD. We are not moving away from using the hardware random number generator directly, we have never used the hardware random number generator. The new code that the Ars article was talking about is to allow the PRNG to be easily switched. In 10 we're shipping both Fortuna and Yarrow and the infrastructure allows more to be added. The code has been reviewed by two cryptographers that I know of and possibly others. Neither the old nor the new implementation is vulnerable to the attack against random number generators that was published a couple of months ago (Linux was the subject of the paper, not sure if OpenBSD was vulnerable).

If Theo is going to make such remarks as this, he should think more carefully first:

"Basically, it is 10 years of FreeBSD stupidity. They don't know a thing about security. They even ignore relevant research in all fields, not just from us, but from everyone."

He'd be advised to take a look at the transactions for the IEEE Symposium on Security and Privacy over the last 10 years and see how many papers are describing techniques that were both originally implemented on FreeBSD and are now part of the default install. Let's take a look at the two systems, from a security perspective. Both FreeBSD use SSP and non-excutable stack by default, so I'll skip those. To begin with, OpenBSD features missing on FreeBSD:

W^X enforcement. Definitely a nice idea, but it breaks some things (JITs mostly). The default memory map in FreeBSD is W^X, but it is possible to explicitly mmap() memory both writeable and executable. It's generally considered a bad idea though, and we don't ship any code that allows it. We permit third-party code to shoot itself in the foot if it really wants to and provide mitigation techniques to reduce the risk.

Then there's ASLR. This is a pretty nice technique, which is currently not implemented on FreeBSD. We do support PIE, so it would not be a horrendously difficult thing to add, but current implementations (including OpenBSD) use a surprisingly small amount of entropy in the address layout and so don't provide as much mitigation as you'd hope (which, of course, Theo knows, because he's very familiar with 'relevant research'). This is especially true on 32-bit systems.

And that's it for OpenBSD. Well, unless you want to count , but since that's vulnerable to a timing attack (still not fixed), which was published in the USENIX Workshop on Offensive Technologies, and Theo is aware of all 'relevant research' in security then it can't really still be there.

Now let's look at FreeBSD security mechanisms:

First up, jails. Jails are somewhere between a chroot and a VM: a shared kernel, but all of the global namespaces (filesystems, IP addresses, users) are separated and so you can completely isolate a service, such as a web browser, from the rest of the system. Scripts like ez-jail in the ports tree make it easy to set up lightweight service jails.

Then there's the MAC framework, which allows modular access control policies. This is used by a couple of FreeBSD derivatives: JunOS uses it to implement code signing, OS X and iOS use it for application sandboxing. You can also use it for traditional type enforcement policies, as in SELinux and a variety of other things.

And then there's Capsicum, which adds a capability model on top

Quick Wiki Summary

[fustakrakich]

"De Raadt has been criticized for having a somewhat abrasive personality..."

Re:Quick Wiki Summary

[chill]

Note: That wiki summary was from the entry on "Understatement of the Year, 1996-2013 inclusive"

Re:Quick Wiki Summary

[TheRealMindChild]

We just need a flame war between him and Linus. Nerdwar will never be the same

Re:Quick Wiki Summary

[serviscope_minor]

I've personally exchanged emails with De Raadt on the OpenBSD mailing list. Actually, he weighed in on a conversation which didn't initially involve him. He wa calm, helpful and polite and the discussion was a productive one.

Why was this? I didn't start off by being extremely rude to him. Because I did my homework and found out as much as I reasonable could with my knowledge and skills. Expecting someone like that to hold my hand and do my homework for me for free no less is exceptionally rude. Somehow many people are too dumb and selfcentred to realise this.

Framing the debate

[Anonymous Coward]

As usual:

- Theo is a complete asshole, but also quite correct about most things. OpenBSD is rather behind the
times in general, but very good at what it does do. And their stance on BSD license and making BSD tools is great.

- FreeBSD really is stupid about some things.
Let's take for instance their complete refusal to implement any strong security in their distribution chain.
You can't verify their ISO's or packages back to their source in any way. Their repo is ancient svn, not
git or monotone, so they have no signable hashes in their repos. There's no deterministic builds. etc.
And when you bring it up, they just handwave about process and workflow as reasons to continue
doing the same. FreeBSD is pretty damn good as an OS, but their standing on these things is BULLSHIT.

Re:Framing the debate

[Anonymous Coward]

How is OpenBSD any different in that regard? They rewrote CVS (OpenCVS) for heaven's sake, so they didn't have to move to SVN, let alone Git.

And Git's hashes are not for the sake of security. Linus made that abundantly clear when he refused to allow SHA-2 to be used, even after people were able to manufacture a Git collision using SHA-1.

People misunderstand what makes OpenBSD secure. OpenBSD is about being conservative and simple. Lots of the things they do seem backwards or antiquated. In this case, XORing your random bit streams is as conservative as you can get. And when Theo talks about following the research, it's not to jump on fancy new technology, but in tracking the evolution of software and cryptographic exploits and trying to preemptively get out of those paths. That's opposite of Linux and FreeBSD, where they're constantly chasing new features, new optimizations, and new technologies.

Re:Framing the debate

[styrotech]

- Theo is a complete asshole, but also quite correct about most things. OpenBSD is rather behind the times in general, but very good at what it does do. And their stance on BSD license and making BSD tools is great.

Yeah the bit that struck me here was that Theo was relatively complimentary about Linux and Linux devs. eg mentioning Linux also did this stuff ages ago and that OpenBSD used some research from Ted Ts'o (and others) in their implementation.

So the complaint wasn't about credit for who was first, just about how FreeBSD got a bunch of Snowden related media coverage for something practically everyone else did ages ago as if it was something new to worry about.

Re:so letting the nsa hire someone

[EdIII]

to write your ipsec, thats the definition of security.

Exactly.

The NSA is the one you are protecting yourself against . Why would you EVER trust any cryptographic primitives designed by them at all?

Being able to fully trust the cryptographic primitives on a system is not a new thing though... those NSA guys have tainted so much everywhere simply because it is their job description to decrypt sensitive communications for the intelligence community.

Microsoft anyone?

Re:Do these projects OpenBSD, FreeBSD matter anywa

[Anonymous Coward]

...Why should I care? Where in the world is serious stuff being done on any of these platforms? Just asking...

When it comes to security, De Raadt is like House

So I guess it matters if you care about security. Then again, since we don't really use secure software or systems, that point is kind of moot.

Re:Do these projects OpenBSD, FreeBSD matter anywa

[utkonos]

You may want to pose that question to Netflix. They account for about 1/3 of the traffic on the internet and all that traffic is served from FreeBSD servers.

Also, Mac OS X is essentially a fork of FreeBSD.

The OS on all Juniper equipment is a modified version of FreeBSD.

The Playstation 3 and 4 OS are both modified FreeBSD.

Plus more.

Re:Do these projects OpenBSD, FreeBSD matter anywa

[Anonymous Coward]

A new 10x faster network stack is coming to Linux via FreeBSD, enjoy your 10gb routing speeds with a 1ghz cpu and in user mode, not kernel. Nginx, that's BSD, Varnish, that's BSD. Actually, most OS research is done on FreeBSD, then ported to Linux. Anecdotally, several large datacenters are claiming they're seeing a rise in BSD services and VMs and some major customers with millions invested, switching to BSD from Linux.

One corp claimed to have over 10,000 VMs and paid RedHat for enterprise support for those VMs with a 5 year contract. They're still locked into contract, but they switched to FreeBSD because they can cut down their number of VMs by 30% and get the same performance. They also found it easier to manage FreeBSD. They're paying for that contract, but not using it. I bet that was a fun sell to management.

Re:so letting the nsa hire someone

[EvanED]

...those NSA guys have tainted so much everywhere simply because it is their job description to decrypt sensitive communications for the intelligence community.

To play devil's advocate for a second (and from someone who is as opposed to the NSA's spying as anyone), they job is also to prevent adversarial spying on us. That presumably applies much more to government functions than day-to-day ones, but if, say, the military or state department actually follows the NSA's suggestions, there's a decent chance that those suggestions are pretty close to as good as it gets.

Re:Not really

[Architect_sasyr]

Pretty sure whoever wrote "House" was looking at Theo and thinking "You know... that fucker could make a great TV show character". Of course it was probably followed by "but screw that IT crap" but whatever.

Re:Not really

[gmhowell]

He's often "technically correct".

You are aware that that is the best kind of correct, right?

Re:Not really

[gman003]

Technically, yes.