unbalancedparentheseson Lobsters • Recommends
Pledge: A new security technology in OpenBSD - Theo de Raadt
0:00 / 0:00
Hackfest 2015: Theo de Raadt presented "Pledge: A new security technology in openbsd"
Hackfest Communication
4K subscribers • 1 video on Hallway
- Recommended by 4 people: 2 on Hacker News, 1 on Lobsters and 1 in engineering communities.
- Presented by Theo de Raadt, founder of OpenBSD
Advanced. Deep dive for people who know the field.
26K views10 years ago4 recommendations
SecuritySystems programmingOperating systemsWeb and application securityExploits and vulnerabilities
Theo de Raadt introduces pledge, a security mechanism in OpenBSD that restricts the system calls a process is allowed to make.
In this late night talk, Theo presented a new security feature in openbsd : Pledge. Presented by: Hackfest communication - hackfest.caWhy it's here
4 people recommend thisWhat people say. Highly recommended as an excellent explanation of OpenBSD's innovative approach to process sandboxing and privilege mitigation.
lloyddeon Hacker News • Recommends
On “Software developed or maintained by the OpenBSD project”
I thoroughly enjoyed Theo de Raadt recent talk, "Pledge: A new security technology in openbsd". It left me itching to try OpenBSD. "Pledge() is designed as a mitigation rather than a cure-all, de Raadt explains, but it's a mitigation with an interesting approach: a process or application stipulates the system services it needs, and if it steps beyond its boundaries, it's killed." link Hackfest 2015: Theo de Raadt presented "Pledge: A new security technology in openbsd" video: link to this video slides: link
Timothycquinnon Hacker News • Recommends
On “Computer security is broken, but things are starting to improve”
Until we build in security mitigation into the kernel and standard libraries of our operating systems, we will always have failure modes where minor errors in code can result in critical vulnerabilities and privilege escalation. I love what OpenBSD is doing with pledges0 and hope to see this gain traction in other operating systems. Here is a good overview of Pledge1 by Theo de Raadt. Unfortunately for Linux ecosystem, the Kernel does not include any standard libs for developers, so this type of security mitigation will take a long time to arrive. But for Unix based operating systems we should expect this much sooner. 0: link , 1 link to this video
u/netscape101in r/netsec • Recommends
Theo de Raadt presented "Pledge: A new security technology in openbsd" - 2015 Hackfest
mrweaselon Hacker News • Mentions
On “One of the three OpenBSD users”
Google patches the snot out of the Linux kernel in Android. In fact in now contains a fair amount of ideas from OpenBSD. Theo De Raadt talks about some of the in his Pledge talk: link to this video
cuckcuckspruceon Hacker News • Mentions
On “Software developed or maintained by the OpenBSD project”
...and the slides and linked presentation address this. Here is the slide: link And here is a link into the presentation video: link to this video
rgacoteon Hacker News • Mentions
On “Support of OpenBSD pledge(2) in programming languages”
I was just listening to Theo's pledge presentation ( link to this video ) and immediately wondered how this is applied to scripting languages. The github link for Python seems to be a high-level wrapping of the entire Python environment itself. I was wondering if there is a way to surface pledge in an environment such as Python so that a developer could drop privileges, for example, open files for writing and then drop the privilege to open any further files.
Rendelloon Hacker News • Mentions
On “Heap Overflow in OpenBSD's Slaacd via Router Advertisement”
The specific syscalls are quite new. Theo de Raadt gave this talk on pledge in 2015, and you can see that it was a bit different then. The "pledge path" feature never had a good enough API that didn't slow down the system too much, so they split that functionality into unveil a few years later. link to this video