4 ms·

OpenBSD stopped claiming "N years without a localhost hole in the default install!" in 2000. See https://web.archive.org/web/20000815063126/http://openbsd.org:8

OpenBSD stopped claiming "N years without a localhost hole in the default install!" in 2000. See https://web.archive.org/web/20000815063126/http://openbsd.org:80/ https://web.archive.org/web/20000815063126/http://openbsd.or... and https://web.archive.org/web/20001110110500/http://www.openbsd.org:80/ https://web.archive.org/web/20001110110500/http://www.openbs... But Page 6 of this pdf has OpenBSD developers going on about Linux and its 20 localhost kernel security holes in 2005. Seems a bit dishonest.

tedunangst 9y ago
There are numbers greater than zero and less than 20.
- RJIb8RBYxzAMX9u 9y ago
  And there's the Chinese proverb, roughly translated and paraphrased: "solder who ran away 50 paces mocks another who ran 100 paces for his cowardice" [0]. I get it, preventing local privilege escalation on *NIX is hard, and I appreciate OpenBSD's focus and stance on security, v.s. say Linus's more laid-back attitude. And having arguably fewest of them is an achievement, even if it's not zero. Let's focus on making OpenBSD better and not belittling other's shortcomings. [0] https://zh.wikipedia.org/zh/%E4%BA%94%E5%8D%81%E6%AD%A5%E7%AC%91%E7%99%BE%E6%AD%A5 https://zh.wikipedia.org/zh/%E4%BA%94%E5%8D%81%E6%AD%A5%E7%A...
  - 43224gg252 9y ago
    Does OpenBSD have so few vulnerabilities because no one looks for them (compared to Linux/Windows) or because it's actually more secure? I have an OS I coded my self that no one has ever found a vulnerability on.
    - ender341341 9y ago
      I would imagine that it's a bit of both, but 1 point of comparison in OpenBSD's favor would be libressl vs openssl, the number & severity of issues in the OpenBSD maintained project has been significantly lower.
    - snikeris 9y ago
      No one can answer this question.
    - nopcode 9y ago
      I was at the defcon presentation & talked with Ilja after. The answer is a bit of both.
- calebl 9y ago
  FYI, since you're here: visiting your site on FF in Windows 10 is throwing an insecure error, saying you're using an invalid certificate. 100% possible that's somehow an error on my end - but just in case it isn't, thought you'd want to know. Sample URL throwing it: https://www.tedunangst.com/flak/post/books-chapter-three https://www.tedunangst.com/flak/post/books-chapter-three Side note: I'm hugely grateful for all your work on OpenBSD.
  - ams6110 9y ago
    Same in FF on Mac OS X: www.tedunangst.com uses an invalid security certificate. The certificate is not trusted because the issuer certificate is unknown. The server might not be sending the appropriate intermediate certificates. An additional root certificate may need to be imported. Error code: SEC_ERROR_UNKNOWN_ISSUER And in Chrome: Attackers might be trying to steal your information from www.tedunangst.com (for example, passwords, messages, or credit cards). NET::ERR_CERT_AUTHORITY_INVALID
    - vancan1ty 9y ago
      Despite the browsers' dire warnings, you are still far more protected visiting a website with a self-signed certificate than visiting a plain http website.
      - ams6110 9y ago
        more protected from what?
        vancan1ty 9y ago
        - protected from third parties reading the data in transit - protected from alteration of the data in transit without either end's knowledge and, IF you have a means to authenticate the owner of the certificate outside of the regular certificate signing process - protection from impersonation of the other end of the connection
        9y ago
- patrec 9y ago
  Given that one is one of the the most widely used OSs in the world and one is a fringe OS, which surely must affect likelihood of detection, I'm not sure any number above zero makes this a favorable comparison for OpenBSD.
- Crontab 9y ago
  Ted: I wanted to let you know that the one-page archive listing on Flak is no longer working.
43224gg252 9y ago
>Seems a bit dishonest. Welcome to *BSD

tedunangst 9y ago

There are numbers greater than zero and less than 20.

RJIb8RBYxzAMX9u 9y ago
And there's the Chinese proverb, roughly translated and paraphrased: "solder who ran away 50 paces mocks another who ran 100 paces for his cowardice" [0]. I get it, preventing local privilege escalation on *NIX is hard, and I appreciate OpenBSD's focus and stance on security, v.s. say Linus's more laid-back attitude. And having arguably fewest of them is an achievement, even if it's not zero. Let's focus on making OpenBSD better and not belittling other's shortcomings. [0] https://zh.wikipedia.org/zh/%E4%BA%94%E5%8D%81%E6%AD%A5%E7%AC%91%E7%99%BE%E6%AD%A5 https://zh.wikipedia.org/zh/%E4%BA%94%E5%8D%81%E6%AD%A5%E7%A...
- 43224gg252 9y ago
  Does OpenBSD have so few vulnerabilities because no one looks for them (compared to Linux/Windows) or because it's actually more secure? I have an OS I coded my self that no one has ever found a vulnerability on.
  - ender341341 9y ago
    I would imagine that it's a bit of both, but 1 point of comparison in OpenBSD's favor would be libressl vs openssl, the number & severity of issues in the OpenBSD maintained project has been significantly lower.
  - snikeris 9y ago
    No one can answer this question.
  - nopcode 9y ago
    I was at the defcon presentation & talked with Ilja after. The answer is a bit of both.
calebl 9y ago
FYI, since you're here: visiting your site on FF in Windows 10 is throwing an insecure error, saying you're using an invalid certificate. 100% possible that's somehow an error on my end - but just in case it isn't, thought you'd want to know. Sample URL throwing it: https://www.tedunangst.com/flak/post/books-chapter-three https://www.tedunangst.com/flak/post/books-chapter-three Side note: I'm hugely grateful for all your work on OpenBSD.
- ams6110 9y ago
  Same in FF on Mac OS X: www.tedunangst.com uses an invalid security certificate. The certificate is not trusted because the issuer certificate is unknown. The server might not be sending the appropriate intermediate certificates. An additional root certificate may need to be imported. Error code: SEC_ERROR_UNKNOWN_ISSUER And in Chrome: Attackers might be trying to steal your information from www.tedunangst.com (for example, passwords, messages, or credit cards). NET::ERR_CERT_AUTHORITY_INVALID
  - vancan1ty 9y ago
    Despite the browsers' dire warnings, you are still far more protected visiting a website with a self-signed certificate than visiting a plain http website.
    - ams6110 9y ago
      more protected from what?
      - vancan1ty 9y ago
        - protected from third parties reading the data in transit - protected from alteration of the data in transit without either end's knowledge and, IF you have a means to authenticate the owner of the certificate outside of the regular certificate signing process - protection from impersonation of the other end of the connection
      - 9y ago
patrec 9y ago
Given that one is one of the the most widely used OSs in the world and one is a fringe OS, which surely must affect likelihood of detection, I'm not sure any number above zero makes this a favorable comparison for OpenBSD.
Crontab 9y ago
Ted: I wanted to let you know that the one-page archive listing on Flak is no longer working.

43224gg252 9y ago

>Seems a bit dishonest. Welcome to *BSD