Summary:    

In this podcast episode of Security Headlines our host talks with Kristaps Dzonsons, a long time

OpenBSD user, writer of beautiful software and deep water diver.

We cover a lot of software development, security, the BSD space and of course diving.    

Security is something that is very hard, we are all human and mistakes happen.

In 2014 at a EuroBSD conference, Kristaps

gave a great talk about what we should think about when we want to

produce safe code.    

One of the things he highlights is that ideally, we should:    

Write defensive code, use a team of code auditors, QA

Use up-to-date, audited libraries with a history of attention to security

use a language with formal underpinnings and proof of correctness

run on systems supporting your defensive strategy

And while we're at it, we might as well ride our unicorns to work.

Unfortunately this workflow is not yet adopted.  But since the tools are getting

smarter and smarter, more and more people are adopting fuzzing and the ecosystem is evolving.

There is a lot of reasons to be optimistic about the future!     

One thing we can do to make our programs a bit safer is to look at each

part of the program and ask ourselves, does this part really need

privileges to do these things?   Luckily a great new innovation from OpenBSD comes riding

in like a knight in shine armor, like a hero in a medieval movie.

And its name is Pledge, pledge allows your program to easily predefined the access rights it

needs and if it breaks the promise, the process dies.

It's an easy to use way to approach the entire Mandatory Access Control swamp...      

Pledge

Originally implemented as Tame in OpenBSD, but rebranded as Pledge in OpenBSD's 5.9 release.

Pledge makes security a lot easier for the developer!  If you want a function you have to

only have the privileges of being able to open files or something similar. Pledge makes it super-easy for

you as a developer to in 3 lines of code, in order to only allow a function to do what its suppose to do and

nothing more, so when attackers come and manipulate your function to do other things, Pledge comes riding in

and kills the process, no questions asked!

Kristaps has implemented both Tame and Pledge into production and we get to hear his advice

on how to do it.

Pledge adoption is growing and growing, and you can use it with a large number of programming

languages.  Just search for pledge and the programming language of your choice and someone has

most likely made a library for it.

External links:

https://kristaps.bsd.lv/

https://github.com/kristapsdz

https://learnbchs.org/portability.html

https://man.OpenBSD.org/acme-client.1

https://kristaps.bsd.lv/kcgi/

https://kristaps.bsd.lv/sqlbox/

https://man.OpenBSD.org/pledge

https://man.OpenBSD.org/unveil

https://en.wikipedia.org/wiki/Scuba_diving

https://en.wikipedia.org/wiki/Freediving

https://kristaps.bsd.lv/openradtool/

https://www.openrsync.org/

https://asiabsdcon.org/

https://www.eurobsdcon.org/

https://www.bsdcan.org/

https://bsd.lv/

https://man.OpenBSD.org/sysmerge

https://man.OpenBSD.org/OpenBSD-5.8/tame.2

https://manpagez.com/man/3/sandbox_init/

https://en.wikipedia.org/wiki/Systrace

https://en.wikipedia.org/wiki/UFRaw

https://en.wikipedia.org/wiki/Diving_reflex