Hackfest 2015: Theo de Raadt presented "Pledge: A new security technology in openbsd"

What people said

lloydde · 2015-12 · Strong recommendation

I thoroughly enjoyed Theo de Raadt recent talk, "Pledge: A new security technology in openbsd". It left me itching to try OpenBSD. "Pledge() is designed as a mitigation rather than a cure-all, de Raadt explains, but it's a mitigation with an interesting approach: a process or application stipulates the system services it needs, and if it steps beyond its boundaries, it's killed." [LINK] Hackfest 2015: Theo de Raadt presented "Pledge: A new security technology in openbsd" video: [VIDEO] slides: [LINK]

Read the original HN comment ↗

Timothycquinn · 2017-04 · Recommendation

Until we build in security mitigation into the kernel and standard libraries of our operating systems, we will always have failure modes where minor errors in code can result in critical vulnerabilities and privilege escalation. I love what OpenBSD is doing with pledges[0] and hope to see this gain traction in other operating systems. Here is a good overview of Pledge[1] by Theo de Raadt. Unfortunately for Linux ecosystem, the Kernel does not include any standard libs for developers, so this type of security mitigation will take a long time to arrive. But for Unix based operating systems we should expect this much sooner. [0]: [LINK] , [1] [VIDEO]

Read the original HN comment ↗

Rendello · 2022-03 · Reference

The specific syscalls are quite new. Theo de Raadt gave this talk on pledge in 2015, and you can see that it was a bit different then. The "pledge path" feature never had a good enough API that didn't slow down the system too much, so they split that functionality into unveil a few years later. [VIDEO]

Read the original HN comment ↗