Hacker News Reader

> One of the things I feel OpenBSD has gotten right with pledge and unveil is the placement of responsibility. It's the developers who know and understands the code the best, so they are the most qualified to lock down the code.

You mean those developers who put in the telemetry code (or back-door or security vulnerability) in to begin with?

What do the application developers know about the user's organization's security policy?

View on HN

They know how the program is intended to behave, what it's core functionality is. They have a model of how the software should work. A tool that allows them to encode that model into a policy is ideal.

The point is that they don't have to understand organizational policies, they just have to understand their program - does it use network, talk to the filesystem, etc.

If you want to enforce broader policies SELinux is not going anywhere.

The only thing you need to know to use pledge is what kernel features you access (file system, network, etc).

Reply on news.ycombinator.com