☭
Normal Vaporeon thoughts such as "maybe I should try OpenBSD for security-critical stuff that's exposed to the Internet"
Second box running a Fediverse instance and e-mails
Put them in OpenBSD jails
@vaporeon_ freebsd is the one with jails, openbsd’s hardening looks more like linux, in that you can drop somewhat fine grained purrivileges via system calls
@aescling Oops. I am not particularly smart. 
If you use those systems, can you tell me more about both FreeBSD and OpenBSD?
@aescling I did read about pledge() in OpenBSD, where a program promises that it will only use specific system calls, and if it ever tries any other system calls, it gets killed by the operating system
Seems like a cool and useful feature; why do other operating systems not have it? Is it hard to implement? Does it affect performance a lot?
@vaporeon_ the reason is that other systems/kernels have diffurent ideas about how to design similar kinds of features; FreeBSD has capsicum, a security model based on really fine grained capabilities. linux from what i understand kinda does not really have a design when it comes to security and has multiple overlapping systems fur locking down a purrocess
@aescling Honestly, I liked pledge(), I read the man page and the idea seemed intuitively obvious to me as a C programmer
@aescling Do you know what the options are for locking down a program whose security I don't trust? Maybe I want to run a Luanti server for friends, but I don't trust them to be 100% secure all the time as much as I'd trust Apache or vsFTPD.
Basic thing is running it as a separate user account with minimal permissions, so that if someone pwns my Luanti server, all they can do is ruin the server and do whatever malicious things a normal user can do (mine Bitcoins on the CPU of a Raspberry Pi? fill up 100% of disk space? do evil network requests from my computer?)
I wonder how I could lock down those things. I do need to allow that user to talk to the network, for hosting the server. I don't know how much CPU a Luanti server needs, but I assume that it's enough that imposing a CPU quota wouldn't work. Disk quota would probably work. Maybe run a cronjob that notifies me if that account suddenly runs processes that aren't Luanti?
@aescling You host a bunch of web services, too. What do you do for security?
@vaporeon_ mostly i use unpurrivileged users with isolated access to the filesystem and purrobably otherwise trust the software i’m using too much if anything. systemd gives you an interface to a lot of linux’s hardening tools (e.g.) but i don’t know it well and purrefur not to use it anyway
@aescling Ah. I hate systemd, none of my Linux computers run systemd at this point, and the BSD computers definitely don't
How do you isolate the filesystem?
@vaporeon_ maybe isolate is too strong a word here. nothing fancy. i create a new user, have the purrocess run in a directory owned by that user (or by root, even) and if i need it to write at all just have a purrticular directory that that dedicated user owns
@vaporeon_ among many, many other things, yes
@aescling Do you mean stuff like SElinux?