logoalt Hacker News

loegyesterday at 9:21 PM5 repliesview on HN

Just yesterday, cperciva was bragging about the FreeBSD approach to security: https://news.ycombinator.com/item?id=48056853 You can certainly argue the response here was well-coordinated, but having an LPE in a nearly 50-year old core syscall like execve() isn't ideal from a security perspective. (That is: security response isn't the entire picture; culture and bug surface matter too.)


Replies

broken-kebabyesterday at 9:36 PM

Or in other words, the response is well-coordinated so cperciva's bragging is justified, isn't it?

show 1 reply
yjftsjthsd-hyesterday at 10:00 PM

I think cperciva may have been a touch overenthusiastic, but surely this is in fact proving his point? His claim was, as you note before trying to ignore it, about coordination. When one of the recent Linux LPEs broke, the fix wasn't in distro packages yet; there was a vulnerability that users couldn't practically do anything about. This is an LPE that is fixed in the binaries that have already shipped. If I was playing cheerleader, this is exactly the case I'd use to argue that FreeBSD being a single unified system is a win and that its approach to handing security problems is very on top of things.

tptacekyesterday at 10:03 PM

He was talking about managing disclosure and patch flow, and you're just taking it as an opportunity to dunk on him.

show 1 reply
bchyesterday at 9:40 PM

Its like rain on your wedding day - not actually ironic, just unfortunate.

stackghostyesterday at 9:53 PM

A not-insignificant chunk of the userbase of the various BSDs is there because they were turned off of Linux after controversial things like Gnome 3, systemd being shoved down users' throats despite being a broken mess, wayland (though nobody was as arrogant about wayland as Poettering was about systemd), etc.

All that to say, the BSD userbase as a sizeable subset that are there for countercultural reasons, rather than technical. These are the people who buy into, say, OpenBSD's vaunted security reputation, or believe that "linux bad because reasons", so you're always going to get people in here bragging, because "not using linux" has become part of their identity.

I run a mix of FreeBSD and Linux on my personal devices. The ground truth is that FreeBSD is yet another unix-like OS written in C, and thus not immune from the types of bugs that stem from that lineage. None of the BSD distros are materially more secure or better than a properly-configured and patched Linux.

show 3 replies