I’m rewatching the talk just now. My main point is still standing: Linux probably has all these features as well, but look at the slides at minute 19:30 and 19:35, pledge and unveil are *really easy to use*. He didn’t even shorten the code:
https://github.com/openbsd/src/blob/master/usr.bin/nc/netcat.c#L364-L418
unveil this, unveil that, pledge this, pledge that, done. Such a simple, concise, and yet powerful API. You don’t see that very often.
I’m rewatching the talk just now. My main point is still standing: Linux probably has all these features as well, but look at the slides at minute 19:30 and 19:35, pledge and unveil are *really easy to use*. He didn’t even shorten the code:
https://github.com/openbsd/src/blob/master/usr.bin/nc/netcat.c#L364-L418
unveil this, unveil that, pledge this, pledge that, done. Such a simple, concise, and yet powerful API. You don’t see that very often.
I’m rewatching the talk just now. My main point is still standing: Linux probably has all these features as well, but look at the slides at minute 19:30 and 19:35, pledge and unveil are *really easy to use*. He didn’t even shorten the code:
https://github.com/openbsd/src/blob/master/usr.bin/nc/netcat.c#L364-L418
unveil this, unveil that, pledge this, pledge that, done. Such a simple, concise, and yet powerful API. You don’t see that very often.
I’m rewatching the talk just now. My main point is still standing: Linux probably has all these features as well, but look at the slides at minute 19:30 and 19:35, pledge and unveil are *really easy to use*. He didn’t even shorten the code:
https://github.com/openbsd/src/blob/master/usr.bin/nc/netcat.c#L364-L418
unveil this, unveil that, pledge this, pledge that, done. Such a simple, concise, and yet powerful API. You don’t see that very often.
/https://duque-terron.cat/media/photos/photo_18502-07-2024_17-50-33.jpg) #catsoftwtxt
#catsoftwtxt
#catsoftwtxt
soooo humid!
#running
soooo humid!
#running
soooo humid!
#running
Conciencia de clase. ⌘ Read more****
#running #treadmill
#running #treadmill
#running #treadmill
pacman itself
The two key advantages of landlock (or pledge/unveil) would be: a) Much easier to use / more lightweight, b) usable by non-root users.
Been a while since I watched it, I think this talk by one of the OpenBSD devs was pretty good: https://www.youtube.com/watch?v=gvmGfpMgny4
The two key advantages of landlock (or pledge/unveil) would be: a) Much easier to use / more lightweight, b) usable by non-root users.
Been a while since I watched it, I think this talk by one of the OpenBSD devs was pretty good: https://www.youtube.com/watch?v=gvmGfpMgny4
The two key advantages of landlock (or pledge/unveil) would be: a) Much easier to use / more lightweight, b) usable by non-root users.
Been a while since I watched it, I think this talk by one of the OpenBSD devs was pretty good: https://www.youtube.com/watch?v=gvmGfpMgny4
The two key advantages of landlock (or pledge/unveil) would be: a) Much easier to use / more lightweight, b) usable by non-root users.
Been a while since I watched it, I think this talk by one of the OpenBSD devs was pretty good: https://www.youtube.com/watch?v=gvmGfpMgny4
- ✅ Laundry.
- ✅ Dishes.
- ✅ Killed the alien queen in Duke 3D.
- ✅ Taxes.
- ✅ Laundry.
- ✅ Dishes.
- ✅ Killed the alien queen in Duke 3D.
- ✅ Taxes.
- ✅ Laundry.
- ✅ Dishes.
- ✅ Killed the alien queen in Duke 3D.
- ✅ Taxes.
- ✅ Laundry.
- ✅ Dishes.
- ✅ Killed the alien queen in Duke 3D.
- ✅ Taxes.
One common pattern would be this: Early during startup, a process reads some configuration files. Once done, it can lock itself down and tell the kernel that it won’t need any further filesystem access at all (or only access to certain paths). If the process gets hacked later on, the attacker won’t be able to read files.
As I understand it, this is better than static restrictions like AppArmor and the likes, because those apply to the entire lifespan of the process.
And it’s much easier to use than something like chroot. OpenBSD’s
pledge and unveil are particularly easy to use, making it feasible to use them in almost any program (not just the ones that you might consider “security critical”):- https://why-openbsd.rocks/fact/pledge/
- https://why-openbsd.rocks/fact/unveil/
Even something like
cal (that thing that prints a calendar) uses pledge in OpenBSD: https://github.com/openbsd/src/blob/master/usr.bin/cal/cal.c#L153
One common pattern would be this: Early during startup, a process reads some configuration files. Once done, it can lock itself down and tell the kernel that it won’t need any further filesystem access at all (or only access to certain paths). If the process gets hacked later on, the attacker won’t be able to read files.
As I understand it, this is better than static restrictions like AppArmor and the likes, because those apply to the entire lifespan of the process.
And it’s much easier to use than something like chroot. OpenBSD’s
pledge and unveil are particularly easy to use, making it feasible to use them in almost any program (not just the ones that you might consider “security critical”):- https://why-openbsd.rocks/fact/pledge/
- https://why-openbsd.rocks/fact/unveil/
Even something like
cal (that thing that prints a calendar) uses pledge in OpenBSD: https://github.com/openbsd/src/blob/master/usr.bin/cal/cal.c#L153
One common pattern would be this: Early during startup, a process reads some configuration files. Once done, it can lock itself down and tell the kernel that it won’t need any further filesystem access at all (or only access to certain paths). If the process gets hacked later on, the attacker won’t be able to read files.
As I understand it, this is better than static restrictions like AppArmor and the likes, because those apply to the entire lifespan of the process.
And it’s much easier to use than something like chroot. OpenBSD’s
pledge and unveil are particularly easy to use, making it feasible to use them in almost any program (not just the ones that you might consider “security critical”):- https://why-openbsd.rocks/fact/pledge/
- https://why-openbsd.rocks/fact/unveil/
Even something like
cal (that thing that prints a calendar) uses pledge in OpenBSD: https://github.com/openbsd/src/blob/master/usr.bin/cal/cal.c#L153
One common pattern would be this: Early during startup, a process reads some configuration files. Once done, it can lock itself down and tell the kernel that it won’t need any further filesystem access at all (or only access to certain paths). If the process gets hacked later on, the attacker won’t be able to read files.
As I understand it, this is better than static restrictions like AppArmor and the likes, because those apply to the entire lifespan of the process.
And it’s much easier to use than something like chroot. OpenBSD’s
pledge and unveil are particularly easy to use, making it feasible to use them in almost any program (not just the ones that you might consider “security critical”):- https://why-openbsd.rocks/fact/pledge/
- https://why-openbsd.rocks/fact/unveil/
Even something like
cal (that thing that prints a calendar) uses pledge in OpenBSD: https://github.com/openbsd/src/blob/master/usr.bin/cal/cal.c#L153
walked about 3/4 mile and then started c/d run. felt strong so endurance is in a great spot!
#running
walked about 3/4 mile and then started c/d run. felt strong so endurance is in a great spot!
#running
walked about 3/4 mile and then started c/d run. felt strong so endurance is in a great spot!
#running
after the warm-up the humidity hit me and i realized i was drenched and i could not stop sweating. it was going to be rough, and it was. kept a pretty steady pace which was great... and around 0.70 miles i upchucked in my mouth a bit, which was oh so great, so i eased off the gas towards the end. overall very happy with the effort since normally i do this in the cooler and drier conditions. in addition i have not been doing much speed work so this is great.
76.2F feels like 84.6F with 93% RH and 73.7F dew point
#running
after the warm-up the humidity hit me and i realized i was drenched and i could not stop sweating. it was going to be rough, and it was. kept a pretty steady pace which was great... and around 0.70 miles i upchucked in my mouth a bit, which was oh so great, so i eased off the gas towards the end. overall very happy with the effort since normally i do this in the cooler and drier conditions. in addition i have not been doing much speed work so this is great.
76.2F feels like 84.6F with 93% RH and 73.7F dew point
#running
after the warm-up the humidity hit me and i realized i was drenched and i could not stop sweating. it was going to be rough, and it was. kept a pretty steady pace which was great... and around 0.70 miles i upchucked in my mouth a bit, which was oh so great, so i eased off the gas towards the end. overall very happy with the effort since normally i do this in the cooler and drier conditions. in addition i have not been doing much speed work so this is great.
76.2F feels like 84.6F with 93% RH and 73.7F dew point
#running
included some strides and felt pretty strong
#running
included some strides and felt pretty strong
#running
included some strides and felt pretty strong
#running