6 ms·

How does security of OpenBSD compare to modern hardened cloud OS kernels?

• MuffinFlavored 6y ago
  I personally don't know why FreeBSD/NetBSD/OpenBSD a) split their already limited free/volunteer resources across which flavor they like best, and b) why anybody would run BSD over Linux. I've heard every argument that GNU sucks, the userland in BSD is developed alongside the kernel, the documentation is better, etc. But I think in 2020, you are just kind of being a hipster if you are subjecting yourself to the pain of BSD.
  • kstrauser 6y ago
    You’ve named three very different projects with very different goals and mostly separate developer sets. I can’t imagine a plausible scenario in which they would - or even could - join together, and it almost certainly would not make the resulting project move any faster than the separate ones do.
    • yjftsjthsd-h 6y ago
      It's also worth pointing out that at least OpenBSD was forked out of NetBSD specifically because people couldn't/wouldn't work together. Maybe 26 year later the human factors are less (maybe), but now there are significant technical differences.
    • MuffinFlavored 6y ago
      > You’ve named three very different projects with very different goals and mostly separate developer sets that all accomplish the same thing, with worse polish + support than larger, more successful projects who don't spend time building on top of "slightly different variations" of the same thing it's undeniable that linux has 10x the support of OpenBSD, and mac has 2x-5x the support for linux in terms of "actually getting stuff done", not tinkering with command files endlessly for no reason even the "linux is good for infrastructure" excuse is starting to fade away as more and more things get abstracted away with k8s, docker, cloud-config, etc. yes, by all means, they run linux. they don't (on average) run BSD. anything that runs BSD could in theory run linux and probably be ok overall. linux is not "worse" than BSD at any one thing and is better in terms of community support, performance, etc.
  • yjftsjthsd-h 6y ago
    Right? Why would anyone ever do anything differently? Let's all just go back to the most popular platform, NT. After all, everything else is a waste of time. (/s)
    • rvz 6y ago
      I know right? just imagine if WSL2 was supporting Linux GUI apps running on Windows, we wouldn't be needed a Linux distro install in the first place, Oh wait.
      • yjftsjthsd-h 6y ago
        If you're running Linux for application compatibility, I don't think you understand why people use Linux. (Although yes, if you want NT and only use Linux to run apps that don't work on raw NT, WSL1/2 are excellent)
        • rvz 6y ago
          At least for the desktop applications I'm developing, it is straight-forward to test them on Windows and Mac because they have the consistent underlying APIs that allow this. Linux distros however are still moving targets and there's no common stack apart from the kernel which is predictable to test against. This is why its hard for some maintainers to reproduce an issue a user has due to possibly apt-get, rpm, install package or use snap, flatpak or appimage and the app starts to break. Not a problem for CLI apps, but a problem for testing desktop apps on Linux. Perhaps you want your favourite app being fully supported and tested on your Linux distro of choice. If I know my app works and is tested on Linux distro A,B,C,etc I can confidently target a wider range of Linux users. At least that's how I increase my "Linux userbase". The fragmentation on this however is another story.
      • Koshkin 6y ago
        Indeed you can run Linux GUI apps on WSL. You just need to install one of the X Window servers that are available for Windows.
    • 6y ago
  • aquabeagle 6y ago
    Which of the hundreds of Linux distributions that have free/volunteer resources split amongst them do you run?
    • MuffinFlavored 6y ago
      i agree that linux distribution fragmentation is also "stupid". it's a free country/world, you can put your time into whatever you want. but if your goal is to deliver the best project with the best documentation/support/polish, you're absolutely right that 1,000 people working on 100 separate versions of "basically the same thing" is dumb imagine how much success windows + mac would have if they were as scattered and opinionated as the linux community
  • UI_at_80x24 6y ago
    >don't know why FreeBSD/NetBSD/OpenBSD a) split their already limited free/volunteer resources I don't know why people ride motorcycles, skateboards, or school buses when trains already exist. This is not one organization, these are different groups all trying to accomplish different goals. >why anybody would run BSD over Linux. We have our reasons. You have already quoted very valid reasons, the fact that you disregard them speaks more about yourself then the motivating factors of others. You have been given technical arguments, political arguments, and real-world examples of why others think that the BSD groups prefer their OS of choice. You have already made up your mind that BSD is inferior.
    • MuffinFlavored 6y ago
      > speaks more about yourself then the motivating factors of others are you talking down to me because I choose not to waste my time with an operating system that has 1/100th the resources + hardware support + usage of a mainstream OS like Mac OS X/Windows and even Linux? what does that say about you...
      • tomhoward 6y ago
        Nobody's criticising your choices, they're criticising your way of criticising other people's choices. You initiated the hostilities.
  • clort 6y ago
    Well, here is the answer you are looking for: https://bible.org/illustration/die-heretic https://bible.org/illustration/die-heretic
  • linksnapzz 6y ago
    Funny, I find any of the above to be mostly painless; might it be just you?
  • black_knight 6y ago
    While your comment is inflammatory and commits several rhetorical crimes, I will just reply with saying that there are many valid uses of BSD. OpenBSD in particular is an attractive option for some servers, since it has builtin httpd, acme-client (for tls certs), smtpd and excellent documentation of how to get it all up and running with minimal, secure configuration. While people have a tendency to believe that there is "only one True Way", and it is a popular argument that "X is most popular, therefore it is The True Way." – this is not in fact true for operating systems. Every system will have its drawbacks, and… Regarding a): Everyone working on one thing does not optimise the quality of the outcome. A rich flora of operating systems encourages experimentation, trying out different compromises and learning from each other’s experience.
    • MuffinFlavored 6y ago
      > OpenBSD in particular is an attractive option for some servers, since it has builtin httpd, acme-client (for tls certs), smtpd and excellent documentation of how to get it all up and running with minimal, secure configuration. it is an attractive option that is less attractive than Linux because it is less popular and has less support
      • saagarjha 6y ago
        n.b. to you.
• TimSchumann 6y ago
  Disclaimer: Not an expert on the topic by any means, just my take as a someone running this release on a few boxes. Have less experience with the latter portion of your question, more with OpenBSD. I think it's comparable in terms of features, and many of those features even originated or have canonical implementations that started under the umbrella of OpenBSD. Also some of the most sane defaults, and simple install process, of any OS I've ever used. I think where OpenBSD really shines though is the documentation. Most issues I run into can be solved by reading the man pages included with the default install. Also the video linked by q3k elsewhere in this thread is a great watch.
• throwaway2048 6y ago
  What is a "modern hardened cloud OS kernel"?
  • blablabla123 6y ago
    The cloud part makes much more sense when combining it with the user land. I think that's also where OpenBSD (or *BSD in general) really shines, everything is very coherent. Regarding Linux, I'd probably see CentOS/RHEL as "modern hardened cloud OS" with all it's measures in place. But even as a complete BSD beginner, I find OpenBSD or FreeBSD easier to configure than CentOS, which IIRC requires a lot of manual whitelisting of capabilities for server daemons.
  • justin66 6y ago
    It's an operating system kernel that can apparently provoke a response from a number of people in spite of having two buzzwords prefacing it.
  • rvp-x 6y ago
    Presumably something like CoreOS which makes extensive use of containers and any security feature it can get its hands on. If I personally put my own opinion on it, I don't like unnecessary use of containers because the model gives you a lot of outdated dependencies, and I'm not sure whether containing a vulnerability once it happens is that noteworthy. Old skool "use good, secure code. update dependencies" and not focusing on containing a vulnerability produces a much safer system IMO.
• efficax 6y ago
  You'd have to be more specific! For a long time OpenBSD was focussed on security through correctness and code review, so that portion is not necessarily reflected in any of the grsecurity/pax type hardened linuxes. But OpenBSD does have things like ASLR and kernel address randomization, advanced memory protection (W^X etc) and while it doesn't have ACLs or PAM it has pledge which is a great way of restricting system call access at the program level.
• cipher_314159 6y ago
  Sort of depends on how you look at it. A shitty, misconfigured install of MySQL on an OpenBSD box won't automatically become secure. And the default install is pretty spartan-- you're not likely to use an OpenBSD machine without installing outside software, which is not going to be developed by the OpenBSD guys. So you're only as secure as your weakest public-facing program. I tend to look at OpenBSD as a sort of "security incubator" program, where good security ideas and practices have the chance to grow. I think that the biggest impact of OpenBSD tends to be felt in OTHER operating systems and on the internet at large. One of the big areas where OpenBSD has pushed things forward, in my opinion, is defense-in-depth for software. They put a lot of effort into maintaining high coding standards and an emphasis on correctness. They've been active in the area of exploit prevention and detection-- they were the first to really do W^X, they've been using ProPolice by default since forever, they randomize memory addresses, etc. But they're also very active in exploit mitigation-- that is, if we start by assuming that a program IS going to have a security bug, how do we limit the damage? OpenBSD has invented or popularized techniques like privilege separation, their "pledge" and "reveal" systems, and various other forms of sandboxing. There's also the crypt side-- their work on cleaning up OpenSSL to create LibreSSL has been an incredible service. OpenSSH has been adopted EVERYWHERE. Their work has done a LOT to reduce the amount of unencrypted traffic going across the internet generally.
  • ori_b 6y ago
    > Sort of depends on how you look at it. A shitty, misconfigured install of MySQL on an OpenBSD box won't automatically become secure. And the default install is pretty spartan-- you're not likely to use an OpenBSD machine without installing outside software, which is not going to be developed by the OpenBSD guys Depends on what you're doing with it -- but the base system ships with many things that you would want to use, and it's definitely concievable that you'd only run with OpenBSD software. Web servers? OpenHTTPd. Mail wervers? OpenSMTPd. Proxies? Relayd Firewalls? pf Routing? Depends on what you need, but there's probably a daemon for that.
  • hedora 6y ago
    The OpenBSD base image includes a web server, dhcp client/server, a dns server, X11, a compiler, a (basic, for now) hypervisor, and so on. You can get a lot done without relying on ports. (Also, the ports are somewhat vetted, as far as I can tell.)
• yjftsjthsd-h 6y ago
  Arguably OpenBSD is a "modern hardened cloud OS"; they're pretty aggressive at pushing kernel and userland hardening (in combination, ex. adding pledge, then patching the base system and some ports to use it).
• hedora 6y ago
  OpenBSD definitely has a longer track record with a lower rate of remote exploits in the default install. Since they keep userspace stable, they generally have more stable programs running there as well. For instance, systemd has has multiple remote exploits in a time window when the default OpenBSD base install has had zero. Moving up the stack, OpenBSD often rewrites or simplifies important daemons (like httpd), and those tend to have closed or mitigated security holes before upstream exploits are discovered.
• 0xdeadbeefbabe 6y ago
  It all depends on the modern hardened cloud OS hacker.
• ori_b 6y ago
  What "hardened cloud OS kernels" are you talking about? I'm not aware of anything under that description in use.
• fpoling 6y ago
  My impression is that Linux tries to give sysadmins tools to secure existing binaries with containers, secomp, syscall filters etc. OpenBSD focuses on securing things at the source level. Hence all the compiler tricks to mitigate memory safety bugs, API for programmers to limit syscall exposure, privilege separation within individual programs, drive to avoid unnecessary complexity so the source is readable etc.
• MintelIE 6y ago
  Isn't OpenBSD a modern hardened cloud OS kernel? Could you provide a couple examples of the kinds of hardened kernels you're thinking of?