Hacker News new | ask | show | jobs
by WorldMaker 4 days ago
I was reading more into this specific in the project goals:

> Consistently use pledge(2) and unveil(2) across the code base.

Both link to man pages that seem rather OpenBSD-specific to me. Seems an interesting requirement/goal, but I'm afraid I don't know enough OpenBSD-specifics to know much more about why this is a goal or what the project gains from having it as a goal even if I can appreciate it as a goal that certainly seems unlikely to upstream into git itself.

(ETA: Which yeah, it does seem like the Comparisons page includes some of that reasoning, but not well enough I caught on first skim and I'm still not sure I understand it on second reading, but interesting.)

1 comments

i don't know OpenBSD either, but i am guessing they are similar to linux capabilities where a process can reject certain permissions, or where you can remove permissions before starting the process. so the goal is pretty clear. make those apps safer to reduce the risk of exploits. this goal goes through all apps written by OpenBSD devs. for apps that deal with foreign user data that is an important feature.