[ home / board list / faq / random / create / bans / search / manage / irc ] [ ]

/tech/ - Technology

Catalog

Name
Email
Subject
Comment *
File
* = required field[▶ Show post options & limits]
Confused? See the FAQ.
Flag
Oekaki
Show oekaki applet
(replaces files and can be used instead)
Options
Password (For file and post deletion.)

Allowed file types:jpg, jpeg, gif, png, webm, mp4, pdf
Max filesize is 8 MB.
Max image dimensions are 10000 x 10000.
You may upload 3 per post.


File: 1458575294906.jpg (74.04 KB, 469x150, 469:150, grsec.jpg)

 No.547789

This thread is about the advantages of a hardened kernels. Why would you use one? What are the advantages and disadvantages?

Would a hardened kernel really make one safer online? Would it really protect from, or slow down hackers?

How do they work?

inb4 ledditfag.

 No.547791

File: 1458575644060.jpg (20.63 KB, 500x377, 500:377, Haibara-Ai-ai-haibara-1428….jpg)

animu 2 bump


 No.547843

Read the fucking manual


 No.547884

cause if you don't linus will rape you in your sleep


 No.548168

>why would you secure your computer?

>what are the advantages and disadvantages?

>would securing your computer really make one safer online?

>would it really protect from, or slow down hackers?

>how does it work?


 No.548189

>>547789

Imo it's not worth the hassle if you're not a company which has at least 2 experts who maintain this shit 24/7. Secondly, it's not as secure as everyone thinks. SEL was found compromised recently due to a bug which present in the code since several YEARS, making every SEL implementation basically worthless up to that date, no matter how well configured.

If you're into security go with compartmentalization. qubes, whonix. In IT security it's always better to assume that nothing is secure and build your system with mitigation in mind than trying to build a stronghold which contains several unknowns.

Security by isolation is the best approach you can have to achieve mitigation and security at the same time. Otherwise it's a waste of time and money.

Same goes for browsers. Why spent 100 hours trying to harden an already compromised browser if you could just use fucking Internet Explorer in a throwaway-sandbox.

If you can't afford a machine to run a qubes/whonix setup, you can just buy a cheap piece of hardware (old notebook / pc) and treat it as your sandbox and isolate it to your work/privacy related machine.


 No.548192

>>548168

he asked about hardening kernels you fucking quadra kike. It's good to explain things to new people from time to time, especially if you were a fucking pleb once yourself.


 No.548200

File: 1458617547423.jpeg (2.79 MB, 5209x2927, 5209:2927, mr-sel4bot.jpeg)

Yes.

You are missing out.


 No.548207

>>548189

This is the worst advice I have ever seen.

You should try to prevent getting pwned in the first place, which is what grsec tries to do, all while preparing to get pwned by compartmentalizing and sandboxing as you said.

You're saying "why should we bother trying to harden our software if it's already fucked?"


 No.548208

File: 1458618575520.gif (45.51 KB, 225x225, 1:1, 9nnnw4D.gif)

I've never understood why kernel.org (or even some 3rd party like linuxlibre) don't put out a stripped-down purpose-built hardened kernel, or a few different ones to choose from. I guess it's easy enough to roll your own tho.

I just don't trust shit like SEL or grsecurity for that matter. Better to roll your own I guess.


 No.548213

>>548208

>I just don't trust shit like SEL or grsecurity for that matter. Better to roll your own I guess

Do you trust the linux kernel? Do you trust Firefox? Do you trust your firmware? Do you trust your hardware? Do you trust every single process that's running your computer right now?


 No.548219

>>548213

>Do you trust the linux kernel?

Not especially.

>Do you trust Firefox?

Nope.

Do you trust your firmware? Do you trust your hardware?

More than my OS, generally.

>Do you trust every single process that's running your computer right now?

Yes, all that are listed by ps, anyway...


 No.548221

>>548219

Why not trust grsec then? You do realize it's free right?


 No.548224

>>548221

It just seems like there should be a kernel.org kernel that's fucking tight-hard and built for security. That there is not is my main bitch against Linux. Honestly IMO the Linux kernel itself is the shittiest part of any given Linux distro.


 No.548233

File: 1458621848696.jpg (8.09 KB, 275x183, 275:183, images.jpg)

>>you can just buy a cheap piece of hardware (old notebook / pc) and treat it as your sandbox and isolate it to your work/privacy related machine.

Perfect comment - physical separation.

Exactly! Who in this world told us only one laptop is allowed?


 No.548241

File: 1458623538076.jpg (35.97 KB, 400x233, 400:233, harden.jpg)

>>Would a hardened kernel really make one safer online?

Absolutely!

Hardening = look for ways to reduce the size of the attack surface ...

Best example: disable JavaScript in our browser. This is 'hardening'.

xtreme hardening for Android:

https://copperhead.co/android/

xtreme hardening for BSD:

https://hardenedbsd.org/

xtreme hardening for Debian:

https://subgraph.com/sgos/graph/index.en.html

https://subgraph.com/sgos/hardening/index.en.html

xtreme hardening for Gentoo:

https://wiki.gentoo.org/wiki/Project:Hardened

But more important is ENCRYPTION and FIREWALL.

SANDBOX = not hardening, more the controll of an process.

Hardening is always a passive action or what you like to attack doesn't exist.


 No.548259

>>547789

Asking in the correct sticky.

Actually you and TP~* can step into >>>/oven/ , so that you stop shitting up /tech/ even more.


 No.548273

>>548207

>This is the worst advice I have ever seen.

This is the most ironically hyperbolic post I've ever made


 No.548318

Hardened kernels are useful in any applications where security is important.

Because most hardening mechanisms exhibit minimal slowdown, and because adding compiler flags and recompiling your kernel isn't particularly difficult, it is advisable to utilize hardening mechanisms wherever possible.

The only cons are slightly increased memory usage and reduced execution speed for some hardening mechanisms.


 No.548371

>>548189

>Container is compromised because of buffer overflow vulnerability

>Attacker escalates privileges because all security measures were relegated to the compartimentalization software

>Get pwnd anyway

You know grsecurity does way more than permission control, right? Fuck, you can use it for containers too.

>>548208

Are you seriously considering coding your own patches? Why not go all the way and code your own kernel from scratch too?

>>548318

>The only cons are slightly increased memory usage and reduced execution speed for some hardening mechanisms.

Someone should tell the Debian maintainers about that. More specifically, the Iceweasel maintainer seems to have little to no idea about hardening.




[Return][Go to top][Catalog][Post a Reply]
Delete Post [ ]
[]
[ home / board list / faq / random / create / bans / search / manage / irc ] [ ]