3 ms·
This may be true, but --- When I encounter comments like these, a common theme is something like ~"OpenBSD didn't even set out to be a secure system. They fork
by milcron 10y ago
This may be true, but ---
When I encounter comments like these, a common theme is something like ~"OpenBSD didn't even set out to be a secure system. They forked NetBSD intending to audit the codebase and write clean, simple code going forwards. That such a system ended up being relatively secure is just a bonus."
To which I reply, this doesn't seem like a terrible downside. I like clean and simple code. There may be other options which offer more technical security features (something with ACLs, for instance), but none come even close to OpenBSD's simplicity.
- sverige 10y agoAnd simplicity and readability really are fundamental to a secure OS, especially from the user's standpoint. It seems this was the main point of the article. Secure by default means I don't have to turn off a bunch of stuff to make it secure. Rather, I have to think about what it is I really need to run on this particular system for whatever it is I'm trying to do. It requires a little more thought, since it isn't usually one of the 100+ processes and apps automatically started after installation on most distros. No, I have to figure out what I need, and maybe even port something. (That hasn't happened to me yet, but it could.) But that starting point is far preferable to weeding out a bunch of shit some distro roller thought I should have and disabling or uninstalling it. And as the OpenBSD team occasionally points out, there really isn't a way to know that you have a 100% secure system now that all hardware has binary blobs that do unknown things. (Well, I guess you could fabricate your own chips and build your own motherboards from components you made and ....)