« first day (4375 days earlier)      last day (519 days later) » 

forest
forest
12:01 AM
Ah that thing. It just hooks calls and tries to re-implement the simple ones in userspace. I don't think it's very secure.
 
ThoriumBR
ThoriumBR
12:18 AM
0
Q: How to secure privatekey

breton natashiI wanna develop cex but have some issue about private key .How can i secure private key (from inside and outside) in db When generated wallets for customers ?

attacks databases
you'd better not develop a crypto exchange...
 
CaffeineAddiction
CaffeineAddiction
12:39 AM
@forest is reg rootless podman w/ direct access to the host kernal better?
 
forest
forest
@CaffeineAddiction I don't know enough about gVisor to say. I would recommend allowing direct access to the kernel, but load a seccomp filter.
 
CaffeineAddiction
CaffeineAddiction
@forest do you have a link for seccomp so I can look into it?
 
forest
forest
Yeah, although I'd check the libseccomp manpages. They are much better.
 
CaffeineAddiction
CaffeineAddiction
kk, ty
 
forest
forest
Because although you can use raw seccomp, that requires writing cBPF code, which can be a pain. The libseccomp library makes things much easier. I actually have a few answers with examples. Let me get one.
60
A: How is Sandboxing implemented?

forestWell this answer ended up fairly long, but sandboxing is a huge topic. At its most basic, sandboxing is a technique to minimize the effect a program will have on the rest of the systems in the case of malice or malfunction. This can be for testing or for enhancing the security of a system. The re...

 
CaffeineAddiction
CaffeineAddiction
12:42 AM
ty
 
forest
forest
There's also security.stackexchange.com/a/210424/106285 where I go into a little more detail. But as always, the manpage of libseccomp is the best (and you'd want to use mode 2 seccomp, not mode 1, which is too restrictive). And github.com/google/minijail might help if you don't want to manually write seccomp policies.
 
 
2 hours later…
forest
forest
2:23 AM
Saw this posted in another channel. This is interesting.
 
 
2 hours later…
Fire Quacker
Fire Quacker
4:38 AM
Iirc from the thread, researchers alerted Mozilla/Apple/Google to TrustCor's weirdness, but it was the evasive responses from the TrustCor representative that made everyone decide they couldn't be trusted
 
 
10 hours later…
CaffeineAddiction
CaffeineAddiction
2:43 PM
@forest am I understanding this correctly? If I write some c code and setup seccomp, and then fork bash as a child process from that c code ... bash would be filtered as well?
or would I have to re-compile bash w/ the filters in place
also Pledge does that apply to running OpenBSD inside a container?
 
CaffeineAddiction
CaffeineAddiction
3:01 PM
"""
In the end, a user namespace simply allows an unprivileged user to interact with far more of the kernel. The surface area is increased to such an extent that many vulnerabilities that otherwise would be relatively harmless instead become LPEs.
"""
does that also apply to non-root users in the container?
 
 
8 hours later…
forest
forest
11:31 PM
@CaffeineAddiction Yes, bash would be filtered as well. Seccomp filters will apply to children.
@CaffeineAddiction Non-root users have less access to kernel attack surface area than root users.
@CaffeineAddiction If the container has an OpenBSD kernel, then pledge should behave similarly to seccomp.
 

« first day (4375 days earlier)      last day (519 days later) »