OpenBSD Journal

OnLamp: Secure Programming Techniques

Contributed by jose on from the starting-with-the-basics dept.

The recently released Practical Unix & Internet Security, 3rd Edition includes basics on secure programming tips. An excerpt of this has appeared on the OnLamp site. In this article by the book's authors, Gene Spafford, Simson Garfinkel, and Alan Schwartz, a slew of sound, secure programming practices are introduced. This wont make you an advanced, secure programmer overnight, but it will help you understand the practice of secure programming and why OpenBSD makes some of the changes it does.

(Comments are closed)

Comments

  1. By Anonymous Coward () on

    if openbsd team would only aplly concepts..no need for errata page..

    till then, tis no more secure than linux..

    and linux/fbsd chroot(jail) can't be broken out of.

    Comments

    1. By Anonymous Coward () on

      OpenBSD should rather implement a kill_all_trolls() syscall than a jail().

    2. By Anonymous Coward () on

      hahahaha.

      linux/fbsd chroot(jail) can't be broken out of.

      I needed a good laugh this morning. THanks for trolling, please come again.

      Comments

      1. By Anonymous Coward () on

        did not see the discussion showing openbsd chroot can be broken out of?

        they defended this by saying chroot was not meant to be secure

        haha

        linux/fbsd have a jail, which can not be broken out of.

        Comments

        1. By Anonymous Coward () on

          keep living in your imaginary world.

          Many of the methods for breaking out of chroot apply fairly nicely to breaking out of jail on fbsd as well.

          Comments

          1. By Anonymous Coward () on

            You may want to do a little more research, and start thinking for yourself instead of swallowing everything you are fed.

    3. By krh () on

      Let me ask some simple questions:

      If you don't like OpenBSD, why are you here?

      Does it inflate your ego to insult the OpenBSD project? Do you think that your insults will change our opinions? Do you think your insults will end the OpenBSD project?

      Do you expect to accomplish anything other than making people mad?

      It's always a good idea to be nice to people.

    4. By Anonymous Coward () on

      "and linux/fbsd chroot(jail) can't be broken out of."

      If you are going to make such a statement you should back it up. Please give references to where we can find such exploits for OpenBSD.

      Comments

      1. By Anonymous Coward () on

        http://cvsweb.grsecurity.net/index.cgi/regression/

    5. By tedu () on

      whatever jail you're using can obviously be broken. just look at all the trolls streaming out of it.

      haha

    6. By NimaDeus () NimaDeus@nimadeus.be on mailto:NimaDeus@nimadeus.be

      Linux chrooted enviroment cannot be broken? wow damn this must be DOS then.

      slave:~# uname -a && ls / && ./break_chroot
      Linux Slave.TerraTrans.be TerraTrans Kernel #2 Mon Mar 17 22:02:15 PST 2003 i686
      bin dev etc home lib man mnt proc root sbin tmp usr var
      slave:/# ls
      CHROOTED boot dev floppy if lib lost+found opt root tmp var
      bin cdrom etc home initrd logins mnt proc sbin usr vmlinuz
      slave:/#

  2. By Anonymous Coward () on

    Holy crap! Where's the RSS stream gone, Jose? I've missed a whole bunch of stories :-( I have deadly.org in my top Slashbox at Slashdot to see what's happening, and there haven't been any new stories streamed in for a week or so!

    Comments

    1. By jose () on http://monkey.org/~jose/

      huh? it's still there, in fact i set it to now fill in the description tag with the text of the front page. if this really is a problem, ping me offline and we can figure this out. works for everyone else who is testing and using it that i have talked to (variety of platforms, aggregators).

      Comments

      1. By Anonymous Coward () on

        Odd. It's been going for me for a few days now. This is WinXP/IE6 (so shoot me). I was about to mail you a screenshot link but my page appears to be down. Have you tried putting OpenBSD Journal into a slashbox? Perhaps it's a Slashdot problem and not your fault at all :-)

  3. By Bob Beck () beck@openbsd.org on mailto:beck@openbsd.org


    Yeah, and if you look at their example they
    reccomend checking the return codes in security
    critical programs by using assert(). Then as
    soon as someone compiles it with -DNDEBUG
    you end up with a program with no tests in it.

    the author lectures about unitended consequences
    and doesn't even read assert(3).


    Comments

    1. By veins () veins@skreel.org on www.skreel.org

      well, actually i would not say calling assert() is checking return value at all :)

    2. By zil0g () on

      What did you expect?

      d'oh

    3. By Anonymous Coward () on

      This, sadly, is all too common. I'm in my second semester of a Comp Sci degree (economic downturn took my job, was able to get money for going to school, riding out the recession there), and the book we're learning from liberally sprinkles the code with them. When will professional tech writers realize that it's a _debugging_ tool?

      Comments

      1. By Anonymous Coward () on

        second _year_, goddammit

    4. By Anonymous Coward () on

      Yeah, and if you read what they wrote,
      you knew that:

      1) They only recommended it as a last resort.
      The authors never said it were the way to
      go. Having checks with assert() still is
      better than having none at all.

      2) If you can compile my binaries with -DNDEBUG
      you won't have to exploit them.. you can do
      a lot of meaner things to me.

      Well, before you try to insult people, read again and think it over.

Latest Articles

Credits

Copyright © - Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]