Hacker News Reader

Comment by t-3 | Hacker News Reader

OpenSSH and the OpenBSD init system are part of the base system, maintained by OpenBSD developers. There's no opportunity for an outsider to use dependencies to insert backdoors in critical components.

View on HN

It didn't matter where the init system came from, but where xz came from.

it does. If the init system links xz... and systemd does.

My understanding is that nothing in base has a dependency on anything outside. There may be some third party software in contrib (if OpenBSD has contrib, like FreeBSD), but I don't think the 3rd party software's build system would be used.

Some BSDs use an external compiler on some platforms, and in that case, you have a build dependency on that, and trusting trust may apply.

> that nothing in base has a dependency on anything outside.

From [0]

"The system includes the following major components from outside suppliers:

Xenocara (based on X.Org 7.7 with xserver 21.1.11 + patches,

freetype 2.13.0,

fontconfig 2.14.2,

Mesa 23.1.9,

xterm 378,

xkeyboard-config 2.20,

fonttosfnt 1.2.3 and more)

LLVM/Clang 16.0.6 (+ patches)

GCC 4.2.1 (+ patches) and 3.3.6 (+ patches)

Perl 5.36.3 (+ patches)

NSD 4.8.0

Unbound 1.18.0

Ncurses 6.4

Binutils 2.17 (+ patches)

Gdb 6.3 (+ patches)

Awk January 22, 2024

Expat 2.6.0

zlib 1.3.1 (+ patches)

[0] https://www.openbsd.org/75.html

What openbsd includes in the base system is the real star vs the way linux distros get made.

The critical piece was systemd, was it not? ssh is no dependent on xz, it only gets there through the "systemd notification" hook provided by vendor specific patches.

> The critical piece was systemd

Not really, systemd was 1 way that openssh could load liblzma, but another would have been thought the selinux PAM stack. It didn't exactly rely on anything systemd specific, just that it was a (transitive) dependency to openssh.

And the entire notification stuff can also be done without linking to libsystemd, but the maintainers that added the patch I guess didn't want to reimplement it manually (now the docs have a fully functional example ready to copy-paste, but before the protocol was just explained).

selinux PAM stack

So... Some other huge subsystems that OpenBSD does not include.

What I am trying to say is: it doesn't have to be any specific dependency, it can be any dependency that somehow loads liblzma. It can be a tiny mostly insignificant direct dependency if you want, it doesn't matter, it just needs to somehow be loaded into the address space.

But if such things are avoided across the board as policy, exactly to attain the result of reducing that attack surface, then there are few such possible examples, and so you can't just say "it could be anything" you have to show that there is actually much pool of "anything".

What's an equivalent example that could actually happen in openbsd?

no, it wasn't. But even if it was, the flaw was in xz.

Reply on news.ycombinator.com