Hackfest 2015: Theo de Raadt presented "Pledge: A new security technology in openbsd"
Hackfest 2015: Theo de Raadt presented "Pledge: A new security technology in openbsd" on HackerTube: recommended by 2 Hacker News commenters across 2 separate months, 2015–2022.
Theo de Raadt presents pledge, a new OpenBSD security mechanism that kills processes which exceed the system calls they declared they need. The talk was given late at night at Hackfest 2015.
What HN commenters said
6 Hacker News comments link this video. Each one links back to its thread.
lloyddeDec 2015Strongly recommends
I thoroughly enjoyed Theo de Raadt recent talk, "Pledge: A new security technology in openbsd". It left me itching to try OpenBSD. "Pledge() is designed as a mitigation rather than a cure-all, de Raadt explains, but it's a mitigation with an interesting approach: a process or application stipulates the system services it needs, and if it steps beyond its boundaries, it's killed." [link] Hackfest 2015: Theo de Raadt presented "Pledge: A new security technology in openbsd" video: ▶ this video slides: [link]
in “Software developed or maintained by the OpenBSD project” · View on HN
TimothycquinnApr 2017Recommends
Until we build in security mitigation into the kernel and standard libraries of our operating systems, we will always have failure modes where minor errors in code can result in critical vulnerabilities and privilege escalation. I love what OpenBSD is doing with pledges[0] and hope to see this gain traction in other operating systems. Here is a good overview of Pledge[1] by Theo de Raadt. Unfortunately for Linux ecosystem, the Kernel does not include any standard libs for developers, so this type of security mitigation will take a long time to arrive. But for Unix based operating systems we should expect this much sooner. [0]: [link] , [1] ▶ this video
in “Computer security is broken, but things are starting to improve” · View on HN
RendelloMar 2022Cites it
The specific syscalls are quite new. Theo de Raadt gave this talk on pledge in 2015, and you can see that it was a bit different then. The "pledge path" feature never had a good enough API that didn't slow down the system too much, so they split that functionality into unveil a few years later. ▶ this video
in “Heap Overflow in OpenBSD's Slaacd via Router Advertisement” · View on HN
rgacoteApr 2016Cites it
I was just listening to Theo's pledge presentation ( ▶ this video ) and immediately wondered how this is applied to scripting languages. The github link for Python seems to be a high-level wrapping of the entire Python environment itself. I was wondering if there is a way to surface pledge in an environment such as Python so that a developer could drop privileges, for example, open files for writing and then drop the privilege to open any further files.
in “Support of OpenBSD pledge(2) in programming languages” · View on HN
cuckcuckspruceDec 2015Cites it
...and the slides and linked presentation address this. Here is the slide: [link] And here is a link into the presentation video: ▶ this video
in “Software developed or maintained by the OpenBSD project” · View on HN
mrweaselNov 2015Cites it
Google patches the snot out of the Linux kernel in Android. In fact in now contains a fair amount of ideas from OpenBSD. Theo De Raadt talks about some of the in his Pledge talk: ▶ this video
in “One of the three OpenBSD users” · View on HN