3 ms·

It does, the whole thing is a thinly veiled OpenBSD uber alles rant. The author's twitter bio states "i'm a weeb / dj / photographer that likes openbsd" -- Th

by kev009 7y ago

It does, the whole thing is a thinly veiled OpenBSD uber alles rant. The author's twitter bio states "i'm a weeb / dj / photographer that likes openbsd" -- The references in the doc to LibreSSL, OpenSSH purity, OpenSMTPD, pf "unmaintained", OpenNTPD are codewords for "OpenBSD is better than FreeBSD".

SwellJoe 7y ago
The article mentions OpenBSD 4 times (vs Linux 2, Windows 2), in all cases directly comparing a default or feature in OpenBSD to the same default or feature in FreeBSD. Whether the author is an OpenBSD fan or not, I didn't come away with the feeling that OpenBSD was the suggested solution to the problem. I found it interesting, anyway, but didn't come away with any inclination to use OpenBSD on my next deployment.
verytrivial 7y ago
It's the topic that matters, no? When talking about BSD security, comparisons to how a security-focused BSD does it seems fair to me. OpenBSD is indeed "better" than FreeBSD when discussing security defaults. Not features or performance, security. I felt the theme was also whether FreeBSD users were aware of the situation, and whether they were able to meaningfully consent to it because they're defaults after all.
- kev009 7y ago
  I don't think I can agree scientifically. OpenBSD developers do subjectively seem to think more holistically about security, and having less features lowers the total number but not the ratio and in practice it doesn't seem to have what I would consider a statistical magnitude difference in the type and ratio of incidents that plague C Unix-likes. In the article the author links to one of Ilja van Sprundel's excellent talks; the takeaway is basically that more eyes actually work for security and you could therefore infer Linux is a magnitude more secure than BSD. I've been quite negative in this thread because the overall debate on these topics is pretty frivolous. We already have the tools at our disposal to do magnitude greater secure software and splitting hairs over which BSD has better defaults is missing the forest for the trees.
  - ksec 7y ago
    >incidents that plague C Unix-likes Do you have a specific language in mind that offers improvement? Or am I reading too much into the sentence? >We already have the tools at our disposal to do magnitude greater secure software Mind sharing more details on the tools? Specifically with respect to System / OS Level programming.
    - tatersolid 7y ago
      >Do you have a specific language in mind that offers improvement? Any language with memory and type safety should comprise as much as possible of the whole system. See the Singularity OS from Microsoft Research, or whatever that Rust OS project is called. Almost all the major, nicknamed, headline-grabbing RCE bugs in the last two decades are memory or type safety issues in C or C++ code. Every C or C++ developer claims safe code is possible or even easy in their favorite language, but history has proven them very wrong.
    - kev009 7y ago
      I'm not banking on any language shift at the moment but could see a plausible case in the past for Ada and maybe now Rust after some more years of maturity both down to the metal. But both of these suffer from some awkwardness around the toolchain for integration into a traditional BSD right now, at least Rust may overcome that in time. syskaller is in use by the major BSDs and stricter compilers and other static analysis tools have been a far bigger impact IMHO than the OpenBSD style mitigations. I would like to actually see some kind of case studies where OpenBSD mitigations have protected a user where they'd have been let down by say Linux or FreeBSD or OpenBSD without them. I think a less snake oil approach to security is done by the seL4 folks, the difference in approach makes the *nix security mitigation people somewhat cringe worthy.
andoriyu 7y ago
pf is still single threaded in both OS, right?
c256 7y ago
As someone who hasn’t cared especially much about any *BSD since moving on from NetBSD, I can’t help but notice that a) your bio here calls out FreeBSD, and b) your posts here seem way more rant-like than anything in the post or the comment thread. Maybe - and I'm only saying this because I care - there are a lot of decaffeinated brands on the market that are just as tasty as the real thing.
- kev009 7y ago
  Heh except if you actually read the comments I present Linux as the high water mark twice for security and stability. Maybe - and I'm only saying this because I care - you should consider through hiking and come back to the discussion when you are less easily offended by the facts at hand into low grade trolling and have requisite attention span and reading comprehension to participate meaningfully in the conversation.

by kev009 7y ago

SwellJoe 7y ago

The article mentions OpenBSD 4 times (vs Linux 2, Windows 2), in all cases directly comparing a default or feature in OpenBSD to the same default or feature in FreeBSD. Whether the author is an OpenBSD fan or not, I didn't come away with the feeling that OpenBSD was the suggested solution to the problem. I found it interesting, anyway, but didn't come away with any inclination to use OpenBSD on my next deployment.

verytrivial 7y ago

It's the topic that matters, no? When talking about BSD security, comparisons to how a security-focused BSD does it seems fair to me. OpenBSD is indeed "better" than FreeBSD when discussing security defaults. Not features or performance, security. I felt the theme was also whether FreeBSD users were aware of the situation, and whether they were able to meaningfully consent to it because they're defaults after all.

kev009 7y ago
I don't think I can agree scientifically. OpenBSD developers do subjectively seem to think more holistically about security, and having less features lowers the total number but not the ratio and in practice it doesn't seem to have what I would consider a statistical magnitude difference in the type and ratio of incidents that plague C Unix-likes. In the article the author links to one of Ilja van Sprundel's excellent talks; the takeaway is basically that more eyes actually work for security and you could therefore infer Linux is a magnitude more secure than BSD. I've been quite negative in this thread because the overall debate on these topics is pretty frivolous. We already have the tools at our disposal to do magnitude greater secure software and splitting hairs over which BSD has better defaults is missing the forest for the trees.
- ksec 7y ago
  >incidents that plague C Unix-likes Do you have a specific language in mind that offers improvement? Or am I reading too much into the sentence? >We already have the tools at our disposal to do magnitude greater secure software Mind sharing more details on the tools? Specifically with respect to System / OS Level programming.
  - tatersolid 7y ago
    >Do you have a specific language in mind that offers improvement? Any language with memory and type safety should comprise as much as possible of the whole system. See the Singularity OS from Microsoft Research, or whatever that Rust OS project is called. Almost all the major, nicknamed, headline-grabbing RCE bugs in the last two decades are memory or type safety issues in C or C++ code. Every C or C++ developer claims safe code is possible or even easy in their favorite language, but history has proven them very wrong.
  - kev009 7y ago
    I'm not banking on any language shift at the moment but could see a plausible case in the past for Ada and maybe now Rust after some more years of maturity both down to the metal. But both of these suffer from some awkwardness around the toolchain for integration into a traditional BSD right now, at least Rust may overcome that in time. syskaller is in use by the major BSDs and stricter compilers and other static analysis tools have been a far bigger impact IMHO than the OpenBSD style mitigations. I would like to actually see some kind of case studies where OpenBSD mitigations have protected a user where they'd have been let down by say Linux or FreeBSD or OpenBSD without them. I think a less snake oil approach to security is done by the seL4 folks, the difference in approach makes the *nix security mitigation people somewhat cringe worthy.

andoriyu 7y ago

pf is still single threaded in both OS, right?

c256 7y ago

As someone who hasn’t cared especially much about any *BSD since moving on from NetBSD, I can’t help but notice that a) your bio here calls out FreeBSD, and b) your posts here seem way more rant-like than anything in the post or the comment thread. Maybe - and I'm only saying this because I care - there are a lot of decaffeinated brands on the market that are just as tasty as the real thing.

kev009 7y ago
Heh except if you actually read the comments I present Linux as the high water mark twice for security and stability. Maybe - and I'm only saying this because I care - you should consider through hiking and come back to the discussion when you are less easily offended by the facts at hand into low grade trolling and have requisite attention span and reading comprehension to participate meaningfully in the conversation.