Auto-generated English transcript of https://www.youtube.com/watch?v=OXS8ljif9b8

{
  "title": "Theo de Raadt (ruBSD 2013) - YouTube",
  "url": "https://www.youtube.com/watch?v=OXS8ljif9b8",
  "sections": [
    {
      "name": "Did others get the message about code quality and security OpenBSD is spreading since 1995?",
      "lines": [
        {
          "0:14": "I think we should separate this into two"
        },
        {
          "0:16": "pieces one is the code quality aspect"
        },
        {
          "0:18": "and the other one is the"
        },
        {
          "0:20": "mitigations um speaking just about code"
        },
        {
          "0:23": "quality the compilers have gotten better"
        },
        {
          "0:25": "they give better warnings and so code"
        },
        {
          "0:27": "quality in general has gotten better uh"
        },
        {
          "0:29": "people are more careful because there"
        },
        {
          "0:31": "are a few systems which have mitigations"
        },
        {
          "0:33": "and those mitigations trigger standard"
        },
        {
          "0:35": "bugs not just security bugs but bugs and"
        },
        {
          "0:39": "therefore"
        },
        {
          "0:40": "the the the methodology that people"
        },
        {
          "0:42": "throw into actually writing code has"
        },
        {
          "0:43": "improved a little bit um as far as the"
        },
        {
          "0:47": "the the greater um vendor um space of"
        },
        {
          "0:51": "actually writing operating systems"
        },
        {
          "0:54": "um I think Microsoft has really gotten"
        },
        {
          "0:57": "the message I'm not quite sure if the"
        },
        {
          "0:59": "Linux crowd has gotten the message"
        },
        {
          "1:01": "because all these mitigations that are"
        },
        {
          "1:03": "available now these techniques they have"
        },
        {
          "1:05": "uh they' largely have them turned off"
        },
        {
          "1:07": "they they only turn them on occasionally"
        },
        {
          "1:10": "uh they're they're not deployed in the"
        },
        {
          "1:12": "uh in the main um in in the main stream"
        }
      ]
    },
    {
      "name": "What about FreeBSD?",
      "lines": [
        {
          "1:23": "distributions frsd has none of these"
        },
        {
          "1:26": "mitigations at all um maybe they have a"
        },
        {
          "1:29": "patch here ti2 um for example they they"
        },
        {
          "1:33": "they have some support in their main"
        },
        {
          "1:35": "line to turn on the stack protector now"
        },
        {
          "1:37": "but they don't turn it on and uh they"
        },
        {
          "1:40": "probably will have to crank their"
        },
        {
          "1:41": "libraries and um make"
        },
        {
          "1:44": "um make make a break with backwards"
        },
        {
          "1:46": "compatibility before they're able to"
        },
        {
          "1:47": "actually make that jump they don't even"
        },
        {
          "1:49": "randomize the top of the stack yet they"
        },
        {
          "1:51": "have code in their tree it's still"
        },
        {
          "1:52": "disabled these are very very minor"
        },
        {
          "1:54": "medications and they haven't even"
        },
        {
          "1:56": "deployed those and I I don't see the the"
        },
        {
          "1:58": "um the I don't see"
        },
        {
          "2:00": "from Reading their man lists I don't see"
        },
        {
          "2:02": "any active auditing of their Source"
        }
      ]
    },
    {
      "name": "So, Microsoft is number 2 in security mitigations?",
      "lines": [
        {
          "2:08": "tree they're number two for mitigations"
        },
        {
          "2:11": "they've turned almost all of them on um"
        },
        {
          "2:14": "Mac OS uh is very interesting they're"
        },
        {
          "2:16": "starting to turn the mitigations on and"
        },
        {
          "2:18": "it sounds it feels to me like they kind"
        },
        {
          "2:20": "of have found a path that allows them"
        },
        {
          "2:23": "to um break backward compatibility but"
        },
        {
          "2:27": "not in a way so that it harms their um"
        },
        {
          "2:30": "their application base so that that I"
        },
        {
          "2:32": "think is the same thing that Microsoft"
        },
        {
          "2:34": "has done is they've decided that hey we"
        },
        {
          "2:37": "can actually start deploying these into"
        },
        {
          "2:38": "the ecosystem and it won't hurt our"
        },
        {
          "2:40": "applications because they've been"
        },
        {
          "2:41": "careful and they have they have a"
        },
        {
          "2:43": "process for moving the ABI forward step"
        },
        {
          "2:46": "by step as they introduce these"
        }
      ]
    },
    {
      "name": "Does 3rd party software still have problems compiling and running under OpenBSD with mitigations turned on?",
      "lines": [
        {
          "2:54": "things no those problems have mostly"
        },
        {
          "2:57": "gone away the message has been received"
        },
        {
          "2:59": "by the application writers and um"
        },
        {
          "3:01": "largely things are clean you you still"
        },
        {
          "3:03": "see uh string copies unbounded calls in"
        },
        {
          "3:07": "a lot of these pieces of software but um"
        },
        {
          "3:10": "we we generate warnings for those um but"
        },
        {
          "3:12": "we don't worry about them being being uh"
        },
        {
          "3:15": "uh a risk per se because they're a risk"
        },
        {
          "3:17": "on every operating system as well right"
        },
        {
          "3:20": "so uh we hope that as time goes by those"
        },
        {
          "3:22": "get improved but that's the best we can"
        },
        {
          "3:24": "do"
        }
      ]
    },
    {
      "name": "On the OpenBSD project day to day life",
      "lines": [
        {
          "3:30": "my day today is I wake up and I see what"
        },
        {
          "3:33": "the developers have have been working on"
        },
        {
          "3:37": "and uh I help them uh I process my email"
        },
        {
          "3:40": "answer questions uh I ask questions we"
        },
        {
          "3:43": "just exchange diffs there's a nobody in"
        },
        {
          "3:46": "the group who's an active paid employee"
        },
        {
          "3:48": "uh everybody's just a volunteer we have"
        },
        {
          "3:51": "thrown um the open be Foundation through"
        },
        {
          "3:54": "a little bit of money um to ensure that"
        },
        {
          "3:57": "um the the new X stuff the device driver"
        },
        {
          "4:00": "stuff would actually happen inside our"
        },
        {
          "4:01": "kernel but largely every other piece is"
        },
        {
          "4:04": "being done uh completely on a volunteer"
        },
        {
          "4:06": "basis um and then you ask about the open"
        },
        {
          "4:09": "D foundation so they take donations um"
        },
        {
          "4:13": "and they final them basically directly"
        },
        {
          "4:14": "into the payment of our of our"
        },
        {
          "4:16": "Network and the rest of it they use to"
        },
        {
          "4:19": "fund our hackathons which is pretty much"
        },
        {
          "4:21": "just a cheap accommodation near"
        },
        {
          "4:23": "University facility somewhere developers"
        },
        {
          "4:26": "fly themselves in"
        }
      ]
    },
    {
      "name": "On support from big companies (as everybody uses OpenSSH!)",
      "lines": [
        {
          "4:32": "uh you know you should have a support"
        },
        {
          "4:34": "from big companies who uses that codes"
        },
        {
          "4:37": "uh it'd be nice but it hasn't happened"
        },
        {
          "4:41": "I'm still proud of the fact that we made"
        },
        {
          "4:43": "that decision to make open SSH free in"
        },
        {
          "4:46": "that particular way so that nobody would"
        },
        {
          "4:48": "have to write it themselves uh and other"
        },
        {
          "4:50": "initiative we initiatives we've been"
        },
        {
          "4:52": "involved in to basically accelerate an"
        },
        {
          "4:55": "idea and actually put it into a real"
        },
        {
          "4:57": "operating system to show that it"
        },
        {
          "4:58": "actually works and then other people"
        },
        {
          "5:00": "could take the code I mean that's right"
        },
        {
          "5:03": "that's just continuing in the footsteps"
        },
        {
          "5:05": "of csrg so I'm"
        }
      ]
    },
    {
      "name": "On commentaries for release songs",
      "lines": [
        {
          "5:12": "happy I think we're getting older and"
        },
        {
          "5:14": "we're not as Angry Anymore okay right"
        },
        {
          "5:18": "because that's what a lot of the early"
        },
        {
          "5:19": "songs were about they were actually"
        },
        {
          "5:21": "about a confrontation we had about"
        },
        {
          "5:23": "opening up documentation for chipsets or"
        },
        {
          "5:26": "uh a bad thing that iatf was doing by"
        },
        {
          "5:30": "uh allowing patents to constrain"
        },
        {
          "5:33": "protocols or something like that we"
        },
        {
          "5:34": "always had a commentary and for the last"
        },
        {
          "5:37": "couple of years we haven't had many"
        },
        {
          "5:39": "commentaries we've just puttered along"
        },
        {
          "5:41": "and kept doing what we"
        }
      ]
    },
    {
      "name": "On current OpenBSD challenges",
      "lines": [
        {
          "5:48": "do it's becoming"
        },
        {
          "5:52": "um things have gotten a fairly"
        },
        {
          "5:55": "interesting um we don't have a lot of"
        },
        {
          "5:57": "new devices showing up um everything is"
        },
        {
          "5:59": "becoming very homogeneous uh pretty much"
        },
        {
          "6:02": "Intel owns the game now so we actually"
        },
        {
          "6:06": "now have more challenges dealing with"
        },
        {
          "6:08": "new Intel ethernet chipsets and Intel"
        },
        {
          "6:10": "Wireless chipsets than we do with all"
        },
        {
          "6:12": "the rest of the other devices they don't"
        },
        {
          "6:13": "show up there are no other network"
        },
        {
          "6:15": "ethernet chipset showing up from any of"
        },
        {
          "6:17": "the vendors at the regular gigabit uh"
        },
        {
          "6:19": "space uh it's it's a very um it's it's"
        },
        {
          "6:24": "almost a monopoly so it's easier in that"
        },
        {
          "6:26": "respect still there are many many other"
        },
        {
          "6:28": "challenges to meet for example we have"
        },
        {
          "6:30": "not really um met the S&P challenge very"
        },
        {
          "6:33": "well yet we still have lots of problems"
        },
        {
          "6:34": "over there um and we haven't done"
        },
        {
          "6:36": "anything about dealing with uh modern"
        },
        {
          "6:39": "x86 VMS and we should probably take a"
        },
        {
          "6:42": "take a shot at doing something there as"
        },
        {
          "6:44": "well uh we're used to leading in this"
        },
        {
          "6:46": "case we may actually be following a"
        },
        {
          "6:48": "little bit more we Face a different"
        },
        {
          "6:49": "challenge than the other projects"
        },
        {
          "6:51": "FreeBSD pretty much only has to care"
        },
        {
          "6:53": "about one or two architectures and"
        },
        {
          "6:55": "they're very similar to each other we're"
        },
        {
          "6:56": "trying to make sure that we keep on"
        },
        {
          "6:58": "running on all of our old Legacy"
        },
        {
          "6:59": "architectures because we still find"
        },
        {
          "7:00": "benefit from them they allow us to"
        },
        {
          "7:03": "actually um we find a bug on spark 64"
        },
        {
          "7:06": "because it has certain characteristics"
        },
        {
          "7:08": "or we find it on a myip processor or we"
        },
        {
          "7:10": "find it on the alpha and we still find"
        },
        {
          "7:12": "tremendous benefits from from"
        }
      ]
    },
    {
      "name": "On regular OpenBSD releases on CD",
      "lines": [
        {
          "7:17": "that no it's not worth it it's not worth"
        },
        {
          "7:20": "it so we hope that enough people find"
        },
        {
          "7:22": "find this a a path so they so they can"
        },
        {
          "7:24": "fund us um because the other approaches"
        },
        {
          "7:27": "of just asking for people to fund us so"
        },
        {
          "7:29": "we can keep doing what we're doing those"
        },
        {
          "7:31": "approaches are not working all that well"
        },
        {
          "7:33": "I mean we don't have large sponsors"
        },
        {
          "7:34": "coming from anywhere we're not like like"
        },
        {
          "7:37": "the like the Linux Foundation or like"
        },
        {
          "7:39": "the FreeBSD Foundation uh we we don't"
        },
        {
          "7:41": "have this large resource Spas uh so"
        },
        {
          "7:45": "that's the best this is uh what we"
        },
        {
          "7:47": "started doing years and years ago and we"
        },
        {
          "7:49": "hope I mean we we understand that almost"
        },
        {
          "7:51": "everybody's buying our it's fun it's fun"
        },
        {
          "7:54": "and and uh I have I have visited uh"
        },
        {
          "7:56": "users in in cities around the world and"
        },
        {
          "7:59": "seen uh shell seen their shelves full of"
        },
        {
          "8:01": "their discs and how proud they are to"
        },
        {
          "8:03": "have almost a full set except for"
        },
        {
          "8:05": "missing 2.5 which we didn't make enough"
        }
      ]
    },
    {
      "name": "On modern world, which abandoned \"full disclosure\" policy",
      "lines": [
        {
          "8:12": "of I think this is a challenge that the"
        },
        {
          "8:14": "operat system without mitigations have"
        },
        {
          "8:16": "to ask themselves about because they're"
        },
        {
          "8:18": "completely vulnerable to this when these"
        },
        {
          "8:20": "applications have these problems but if"
        },
        {
          "8:22": "they had these mitigations in their"
        },
        {
          "8:24": "systems at least they they would raise"
        },
        {
          "8:25": "the bar and make them very difficult"
        },
        {
          "8:28": "like"
        },
        {
          "8:30": "I I I'm happy that that that we at least"
        },
        {
          "8:34": "have mitigations I don't know if this if"
        },
        {
          "8:36": "if it's if it's a a full answer MH to"
        },
        {
          "8:39": "the problem uh I was there when when"
        },
        {
          "8:42": "full when all the full disclosure was"
        },
        {
          "8:44": "happening on bug track back in those"
        },
        {
          "8:46": "days I knew all of those people at Loft"
        },
        {
          "8:48": "and all that they they and cor SDI they"
        },
        {
          "8:50": "were they were friends of mine I I was"
        },
        {
          "8:52": "involved in in the in the discussions"
        },
        {
          "8:55": "this is when the auditing of the open"
        },
        {
          "8:56": "BSD tree started in Earnest um"
        },
        {
          "9:00": "I it's it's sad the way that it has gone"
        },
        {
          "9:04": "um but you can kind of also see where it"
        },
        {
          "9:05": "has come from Unix is now mainstream"
        },
        {
          "9:08": "it's in every single product that we use"
        },
        {
          "9:10": "it has taken over the ecosystem"
        },
        {
          "9:15": "uh"
        }
      ]
    },
    {
      "name": "On lack of backward compatibility",
      "lines": [
        {
          "9:21": "yeah well I think we're more sort of a"
        },
        {
          "9:24": "research space um somebody has to do the"
        },
        {
          "9:27": "Innovation and push things into the"
        },
        {
          "9:29": "ecosystem quickly and tried to get a"
        },
        {
          "9:31": "large enough install base so we can"
        },
        {
          "9:33": "actually learn which things work and how"
        },
        {
          "9:35": "they need to be changed I'll give an"
        },
        {
          "9:37": "example um when we were working on our"
        },
        {
          "9:39": "ad space randomization and our Malo"
        },
        {
          "9:41": "randomization both of them actually ran"
        },
        {
          "9:44": "into into this a similar problem which"
        },
        {
          "9:46": "is that for example our Adder space"
        },
        {
          "9:48": "randomization was too greedy with going"
        },
        {
          "9:50": "in add and randomizing the adder space"
        },
        {
          "9:52": "too much as a result it was actually"
        },
        {
          "9:54": "starting to put pressure on the page"
        },
        {
          "9:55": "tables starting to put pressure onto the"
        },
        {
          "9:57": "cache starting to put pressure onto the"
        },
        {
          "9:59": "soft tables that manage the processes"
        },
        {
          "10:01": "virtual address base management so the"
        },
        {
          "10:04": "the the data structures were getting"
        },
        {
          "10:05": "very very large unnecessarily large"
        },
        {
          "10:07": "compared to a system which is a flat map"
        },
        {
          "10:10": "with no randomization same sort of thing"
        },
        {
          "10:12": "happened in our malok in the maok we we"
        },
        {
          "10:15": "we started adding guard Pages all over"
        },
        {
          "10:17": "the place and we had to back down"
        },
        {
          "10:19": "because we discovered that real world"
        },
        {
          "10:20": "software out there is not ready for this"
        },
        {
          "10:22": "there's too many bugs in the software"
        },
        {
          "10:24": "and and our ports developers were very"
        },
        {
          "10:26": "unhappy with the situation stuff just"
        },
        {
          "10:28": "wasn't running running longterm so we"
        },
        {
          "10:30": "had to back off the guard paging and do"
        },
        {
          "10:33": "a something that that's less less less"
        },
        {
          "10:35": "guarded memory and we hope that in time"
        },
        {
          "10:38": "we some of the developers will once in a"
        },
        {
          "10:40": "while turn on that feature because it's"
        },
        {
          "10:41": "a way to turn it on on PR program to"
        },
        {
          "10:44": "program and if we push that up the"
        },
        {
          "10:46": "ecosystem maybe we can actually see some"
        },
        {
          "10:48": "improvements down in the long term but"
        },
        {
          "10:50": "not in the short term so we wouldn't"
        },
        {
          "10:52": "have learned that if we had actually"
        },
        {
          "10:53": "thrown it out to our community and the"
        },
        {
          "10:55": "only way to throw it out to our"
        },
        {
          "10:56": "community is to actually go and throw it"
        },
        {
          "10:58": "in throw away backwards compatibility"
        },
        {
          "11:00": "usually we it's not terribly harsh uh"
        },
        {
          "11:03": "and we have a community here that's"
        },
        {
          "11:04": "accepting of this they they see the path"
        },
        {
          "11:06": "forward they know that that that uh they"
        },
        {
          "11:09": "know that not every single change that"
        },
        {
          "11:11": "comes and braks back compatibility is"
        },
        {
          "11:13": "directly suited for them and directly"
        },
        {
          "11:16": "targeted to them but they know that some"
        },
        {
          "11:17": "of the other ones are and so it's a give"
        },
        {
          "11:20": "and take sort of inside our user"
        },
        {
          "11:22": "community and our development community"
        }
      ]
    },
    {
      "name": "On 6 months release cycle",
      "lines": [
        {
          "11:29": "uh there has to be sort of in our six"
        },
        {
          "11:31": "month cycle there has to be a period of"
        },
        {
          "11:33": "time when lots of people run the same"
        },
        {
          "11:34": "code so that if we've made a"
        },
        {
          "11:37": "mistake um if we kind of Mis misjudged"
        },
        {
          "11:41": "the impact of one of our changes that's"
        },
        {
          "11:43": "the time when we're really going to find"
        },
        {
          "11:45": "out and people are going to deploy that"
        },
        {
          "11:46": "code and run with it and it's going to"
        },
        {
          "11:48": "work out fine these are these are small"
        },
        {
          "11:50": "little effects but we need to we need to"
        },
        {
          "11:51": "learn from our users"
        }
      ]
    },
    {
      "name": "On future plans",
      "lines": [
        {
          "11:59": "the primary thing that happens in our"
        },
        {
          "12:01": "project is that the developers who make"
        },
        {
          "12:03": "those changes have to want to make those"
        },
        {
          "12:05": "changes they have to have an itch they"
        },
        {
          "12:06": "want to"
        },
        {
          "12:08": "scratch so I don't know what the future"
        },
        {
          "12:11": "road map is I know what I know the"
        },
        {
          "12:13": "things that bother me that I think we"
        },
        {
          "12:14": "should improve and I know some of the"
        },
        {
          "12:16": "other developers what they want to"
        },
        {
          "12:18": "improve but I'm not going to make any"
        },
        {
          "12:20": "promis about what's going to come in SNP"
        },
        {
          "12:22": "or what's going to come in improvements"
        },
        {
          "12:24": "for for Network performance uh I can"
        },
        {
          "12:28": "promise it's going to be more"
        },
        {
          "12:30": "backwards compatibility breaks in the"
        },
        {
          "12:32": "future but they'll be small small"
        },
        {
          "12:34": "compared to the recent 64 but time"
        },
        {
          "12:37": "change"
        }
      ]
    },
    {
      "name": "On 64 bit time change",
      "lines": [
        {
          "12:42": "um oh it's a tremendous it it was it's a"
        },
        {
          "12:45": "really large change there's a there's"
        },
        {
          "12:47": "many ways of actually dealing with 64"
        },
        {
          "12:49": "but time in theory you can go find web"
        },
        {
          "12:52": "pages that people have come up with"
        },
        {
          "12:53": "prototypes but no one's actually pushed"
        },
        {
          "12:55": "it all the way into an operating system"
        },
        {
          "12:57": "and thought of all the logistics of how"
        },
        {
          "12:59": "you're going to get all the application"
        },
        {
          "13:00": "programmers to use a new API so instead"
        },
        {
          "13:03": "we went with with just changing the type"
        },
        {
          "13:06": "at the at a very very low level and it's"
        },
        {
          "13:09": "really interesting because we now have"
        },
        {
          "13:10": "application we art ports Tre runs on it"
        },
        {
          "13:14": "so we're basically dragging the entire"
        },
        {
          "13:16": "application base along with openbsd so"
        },
        {
          "13:19": "that by the time we get to the point"
        },
        {
          "13:21": "where anybody else wants to actually"
        },
        {
          "13:22": "switch to 64 B time the application"
        },
        {
          "13:24": "space will be ready for them and that's"
        },
        {
          "13:26": "similar to what we did with all of our"
        },
        {
          "13:28": "exploit mitigation and address bace"
        },
        {
          "13:29": "randomization features by deploying them"
        },
        {
          "13:31": "in a real system and dragging the"
        },
        {
          "13:33": "application space towards it anybody"
        },
        {
          "13:35": "tomorrow in their operating system can"
        },
        {
          "13:36": "turn these things on by default they"
        },
        {
          "13:38": "don't have to worry Milla is going to"
        },
        {
          "13:39": "work we've made sure of that"
        }
      ]
    }
  ]
}