6 ms·

"That claim has probably never been true." Well, pretty easy to disprove. All you have to do is name a single remote hole in the default install in the last,

"That claim has probably never been true." Well, pretty easy to disprove. All you have to do is name a single remote hole in the default install in the last, oh, 8 or so years.

nickpsecurity 11y ago
Real quick, as I'm clearly not an OpenBSD user. Does the "default install" include the apps a deployment will almost certainly use? That is to make the claim meaningful. And have there been any software defects in OpenBSD or its critical apps over past "8 or so years" that could've been exploited by attackers? That would be a start. My guess was that OpenBSD team didn't track (and update web site claim for) the number of defects that might have been exploitable: just fixed all defects as they found them instead. If so, that makes for great QA practice but inaccurate claim on web site. Otherwise, there's a tracker somewhere listing all bugs found in privileged software, their exploitability, and time it took to fix them. That tracker will have a huge list of issues with only 2 marked as security issues.
- pyvpx 11y ago
  no, the claim is the default install. anything you install afterwards is...not the default.
  - nickpsecurity 11y ago
    So, the claim is meaningless for most users unless they restrict themselves to the tiniest subset of software. That answers the first question. Ok, so the second is, "Have there been defects found in any parts of the default install after those parts were distributed? And were they just fixed or analyzed for exploitability with an update on the website if necessary?"
    - jethro_tell 11y ago
      It's generally a security by obscurity claim. Which is strange coming from the OpenBSD guys. I don't think you can even log in with their own OpenSSHd from a default install.
      - nickpsecurity 11y ago
        That's what I'm thinking and suggesting. Because, if we get down to it, anyone reading the claim would have to believe something along these lines: 1. There's never been a defect that could affect security in any OpenBSD software, from kernel to protocols, after it was released. 2. For meaningfulness, the default install supports real-world usage (and usefulness) of the system. The good news for No 1 means that they never had to issue a patch in a protocol or software due to defects with potential to leak data, allow hijacking, or experience DOS. Knowing that, once released, every OpenBSD system was unhackable and needs no patches past functionality fixes would greatly reduce administrator overhead. Truly fire-and-forget system. If the website claim is true, that is. :) Further, if No 2 is true, users won't have to use anything but the base install to handle day-to-day tasks on their network. Anything critical is included, usable, and secure-by-default. Users would only need to rely on 3rd party stuff for non-obvious use cases or stuff that truly doesn't belong in a baseline. So, the ports collection wouldn't even be necessary in most deployments (esp infrastructure, console desktop) as the functionality and what counts in security claims were batteries included like the competition. I'll leave it to users and people following their bug trackers to determine if either is the case. Especially No 1 which is my main point. The mere existence of security patches would kill the web site claim. It would instead become, "Of all the defects found, only two were analyzed and shown to be exploitable over X years." Makes for a totally different impression, eh? ;)
        slasaus 11y ago
        I think most of your posts are very informative. But your lack of knowledge about OpenBSD surprises me. Perhaps it would save you and the reader some time if you spent a bit more reading about OpenBSD instead of reasoning about all theoretical directions OpenBSD could have taken.
    - tedunangst 11y ago
      The claim is quite old, and comes from an era where a fresh install of an operating system would have web servers and DNS servers and file servers globally exposed. Many projects have adjusted since then, but there was definitely an era of Apache worms that could spread juat by pwning the default "it's working!" Web site that many operators didn't even know they were running.
      - nickpsecurity 11y ago
        Best explanation I've heard. Still supports my concern more than the claim's truth. Nonetheless, I can totally understand that given I was around back then and remember what that was like. It would certainly have been a differentiator back then before sane defaults were a thing.
- ams6110 11y ago
  OpenSMTPD is in the default install, however in the default configuration it does not accept remote connections.
  - nickpsecurity 11y ago
    That's a good start.

"That claim has probably never been true." Well, pretty easy to disprove. All you have to do is name a single remote hole in the default install in the last, oh, 8 or so years.

nickpsecurity 11y ago

Real quick, as I'm clearly not an OpenBSD user. Does the "default install" include the apps a deployment will almost certainly use? That is to make the claim meaningful. And have there been any software defects in OpenBSD or its critical apps over past "8 or so years" that could've been exploited by attackers? That would be a start. My guess was that OpenBSD team didn't track (and update web site claim for) the number of defects that might have been exploitable: just fixed all defects as they found them instead. If so, that makes for great QA practice but inaccurate claim on web site. Otherwise, there's a tracker somewhere listing all bugs found in privileged software, their exploitability, and time it took to fix them. That tracker will have a huge list of issues with only 2 marked as security issues.

pyvpx 11y ago
no, the claim is the default install. anything you install afterwards is...not the default.
- nickpsecurity 11y ago
  So, the claim is meaningless for most users unless they restrict themselves to the tiniest subset of software. That answers the first question. Ok, so the second is, "Have there been defects found in any parts of the default install after those parts were distributed? And were they just fixed or analyzed for exploitability with an update on the website if necessary?"
  - jethro_tell 11y ago
    It's generally a security by obscurity claim. Which is strange coming from the OpenBSD guys. I don't think you can even log in with their own OpenSSHd from a default install.
    - nickpsecurity 11y ago
      That's what I'm thinking and suggesting. Because, if we get down to it, anyone reading the claim would have to believe something along these lines: 1. There's never been a defect that could affect security in any OpenBSD software, from kernel to protocols, after it was released. 2. For meaningfulness, the default install supports real-world usage (and usefulness) of the system. The good news for No 1 means that they never had to issue a patch in a protocol or software due to defects with potential to leak data, allow hijacking, or experience DOS. Knowing that, once released, every OpenBSD system was unhackable and needs no patches past functionality fixes would greatly reduce administrator overhead. Truly fire-and-forget system. If the website claim is true, that is. :) Further, if No 2 is true, users won't have to use anything but the base install to handle day-to-day tasks on their network. Anything critical is included, usable, and secure-by-default. Users would only need to rely on 3rd party stuff for non-obvious use cases or stuff that truly doesn't belong in a baseline. So, the ports collection wouldn't even be necessary in most deployments (esp infrastructure, console desktop) as the functionality and what counts in security claims were batteries included like the competition. I'll leave it to users and people following their bug trackers to determine if either is the case. Especially No 1 which is my main point. The mere existence of security patches would kill the web site claim. It would instead become, "Of all the defects found, only two were analyzed and shown to be exploitable over X years." Makes for a totally different impression, eh? ;)
      - slasaus 11y ago
        I think most of your posts are very informative. But your lack of knowledge about OpenBSD surprises me. Perhaps it would save you and the reader some time if you spent a bit more reading about OpenBSD instead of reasoning about all theoretical directions OpenBSD could have taken.
  - tedunangst 11y ago
    The claim is quite old, and comes from an era where a fresh install of an operating system would have web servers and DNS servers and file servers globally exposed. Many projects have adjusted since then, but there was definitely an era of Apache worms that could spread juat by pwning the default "it's working!" Web site that many operators didn't even know they were running.
    - nickpsecurity 11y ago
      Best explanation I've heard. Still supports my concern more than the claim's truth. Nonetheless, I can totally understand that given I was around back then and remember what that was like. It would certainly have been a differentiator back then before sane defaults were a thing.
ams6110 11y ago
OpenSMTPD is in the default install, however in the default configuration it does not accept remote connections.
- nickpsecurity 11y ago
  That's a good start.