codesniperjoe
Joined 3 years ago
Karma
151
Submissions
27
Member since
Dec 21
https://paepcke.de
View on Hacker NewsRecent submissions
Comment · 3 years ago
Warning:
Do not go to this site with enabled javascript! They spam your uplink DNS provider with thousands of uniq, uncachable (fingerprinting?) 'test' dns keys without your consent, to identify & track the DNS service you are using!
Take a look at your DNS outbound log yourself!
Comment · 3 years ago
Projects
Console screen reader infrastructure
Vessel - Integrated Application Containers for FreeBSD
Enable the NFS server to run in a vnet prison
Pytest support for the FreeBSD testing framework
Userland
Base System OpenSSH Update
Kernel
Enabling Snapshots on Filesystems Using Journaled Soft Updates
Wireless updates
Netlink on FreeBSD
Adding basic CTF support to ddb
Architectures
CheriBSD 22.12 release
FreeBSD/riscv64 Improvements
go on FreeBSD riscv64
FreeBSD/ARM64 on Xen
Cloud
FreeBSD on Microsoft HyperV and Azure
FreeBSD as a Tier 1 cloud-init Platform
OpenStack on FreeBSD
Documentation
Documentation Engineering Team
FreeBSD Presentations and Papers
Ports
FreshPorts - help wanted
PortsDB: Program that imports the ports tree into an SQLite database
KDE on FreeBSD
Xfce on FreeBSD
Pantheon desktop on FreeBSD
Budgie desktop on FreeBSD
GCC on FreeBSD
Another milestone for biology ports
Third Party Projects
Containers and FreeBSD: Pot, Potluck and Potman
Comment · 3 years ago
TLDR: Avoid it if you can!
Comment · 3 years ago
TDLR: How You Respond to Security Researchers Says Everything ... [ About Your Business State ].
Comment · 3 years ago
The compiler (go) is part of a static read-only (compressed/in-memory) RootFS. Build on a air-gap build server, touching only signed/verified/reviewed code from git-offline mirror snaps. Go has no libs, all static. The resulting runtime only binaries are totally uniq/randomized and dependency free, straight from (signed) source code.
Comment · 3 years ago
Yes, the base idea is not that new. I store since years every GO based application I use as small (few kb) source code tree checkout only, no binary at all. At runtime the wrapper compiles a randomized individual one-time-temporary-uniq binary via garble [0].
Comment · 3 years ago
For this new feature you pay indeed with the need for r/w and executable tmpfs/overlay somewhere.
This does not replace classic ASLR: OpenBSD 5.7 activated position-independent static binaries (Static-PIE) by default.
https://en.wikipedia.org/wiki/Address_space_layout_randomiza...
Comment · 3 years ago
Plain, simple and effective as always!
The highly complex 'black magic' is 'sort --random' and (re-)link it all again. :)
Makefile.relink: cc -o sshd `echo ${OBJS} | tr ' ' '\n' | sort -R` ${LDADD} ./sshd -V && install -o root -g wheel -m ${BINMODE} sshd /usr/sbin/sshd
https://github.com/openbsd/src/commit/898412097f87ba70d4012f...
Comment · 3 years ago
Finally!
At least, someone finally understands that static, fully predictable, reproduce-able-builds are only an convenience feature for the attacker side.
Comment · 3 years ago
In general I would tend to agree, but have lately took a look at the gh dependencies this tool draws in today? [0]
This is not a (classic) unix cli tool, as it was some month before. Do you think anyone will be ever able to make a codereview? Like done for git [1]?
[0] https://github.com/cli/cli/blob/trunk/go.mod
[1] https://x41-dsec.de/security/research/news/2023/01/17/git-se...
On the other side: a simple and easy to understand plaintext curl one-liner.
Comment · 3 years ago
We should really pin a daily reminder about the unfixable SSL truststore dumpster fire situation (every day a different one) to the top of YC!
Comment · 3 years ago
Netflix contributes. Real Code. Rock stable. High quality. For so many years. So its not only the Free-Beer-License for them. I have never seen a single commit comming back from others, who build the most (financial) successfull trillion dollar bussines on top of FreeBSD, but comming back again and again, to (hard-)fork.