Privilege Separation and Pledge (video)

Contributed by tj on 2016-05-25 from the feathered-edges dept.

This year's dotSecurity conference featured a presentation from OpenBSD founder Theo de Raadt, titled "Privilege Separation and Pledge."

The video is now available here, in addition to the slides.

(Comments are closed)

Comments

By Anonymous Coward (2601:186:4480:479:a0e8:b325:f88:ae47) on 2016-05-25 17:40

imo, a very good video.

A concise and informative explanation of where pledge came from and the benefits it provides.
By Jorden Verwer (94.209.61.183) on 2016-05-25 23:30

What I like about new technologies like pledge is not really the mitigating effect they have on security vulnerabilities, but rather the actual improvements in code quality that are a result of applying them correctly. This video nicely illustrates how pledge helps to improve the privilege separation in several components of OpenBSD.

Likewise, I myself recently found a use-after-free bug in an application I wrote because of the malloc junking behavior introduced in 5.6. This shows that the OpenBSD approach of actively creating a hostile environment for programs that misbehave actually works and makes everybody's code better.

I'm looking forward to the next step in enforcing correct behavior. Keep up the good work, guys!
By Just Another OpenBSD User (77.85.130.233) on 2016-05-28 07:13

Thanks!

Latest Articles

Wed, Jan 08
- 10:07 rpki-client 9.4 released (0)
Mon, Dec 30
- 03:57 Game of Trees 0.107 released (0)
Thu, Dec 19
- 16:38 rpki-client stricter aging policy for Trust Anchor certificates commited to -current (0)
- 08:04 FRAME sockets added to OpenBSD (0)
Wed, Dec 18
- 19:57 OpenBGPD 8.7 released (0)
Sat, Nov 30
- 18:42 Initial list of 21 EuroBSDcon 2024 videos released (0)
- 18:39 Rafael Sadowski on dpb(1) (1)
Fri, Nov 29
- 09:31 -current now has more flexible performance policy (0)
Mon, Nov 25
- 07:13 unwind: wildcard in blacklist (0)

Credits

Copyright © 2004-2008 Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to April 2nd 2004 as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]