8 ms·

I’ve always wanted to run OpenBSD for our Wireguard bastion host (the one machine that is “open”. Not sure it makes a difference over Linux but OpenBSD has an e

by atonse 6y ago

I’ve always wanted to run OpenBSD for our Wireguard bastion host (the one machine that is “open”. Not sure it makes a difference over Linux but OpenBSD has an even stronger security culture. Was satisfied with the state of affairs before but genuinely excited about this development.

tptacek 6y ago
OpenBSD has a different security culture. "Stronger" hasn't been the right word in over a decade.
- atonse 6y ago
  Yeah I don’t know if at this point it even matters. I was nervous about even leaving this comment. Maybe showing my decade old bias.
  - dicknuckle 6y ago
    I use alpine for my bastion machine, but I'm not even sure if it's the best solution.
  - sirtoffski 6y ago
    Same sentiment here. I could come up with one "advantage" of OpenBSD over Linux - smaller user base. In a simplistic kind of a view that should make it less compelling to put in as much effort into developing exploits vs more common OS'. I couldn't back this up with any concrete data though.
    - Hnrobert42 6y ago
      Security through obscurity isn’t foolproof, but it isn’t entirely foolish, either. It can reduce risk if part of a layered defense strategy. It is important to remember though that it is not the number of users but but the value of the compromise that determines how compelling the O/S is. There are like vintage mainframe O/Ses for which folks are actively developing compromises because some government or telco hasn’t migrated off. Then again, those teams aren’t going to waste a exploit on somebody’s home Usenet archive. TL;DR: nevermind. I am too busy arguing with myself to be coherent.
- jooize 6y ago
  What do you mean?
  - woodruffw 6y ago
    OpenBSD has historically been eager to add new security mitigations without explaining their intended threat model. Here's an excellent talk (in website form) on the subject: https://isopenbsdsecu.re/about/ https://isopenbsdsecu.re/about/
    - ta17711771 6y ago
      In the face of the Linux kernel not taking care of known exploits, regardless of their usability, I'll take it.
    - bawolff 6y ago
      I dont think that website is very compelling. It claims a bunch of things as not good practise, and then asserts without evidence or example that openbsd does them. Quite frankly it reads like someone with an axe to grind against openbsd.
      - woodruffw 6y ago
        > I dont think that website is very compelling. It claims a bunch of things as not good practise, and then asserts without evidence or example that openbsd does them. Here's a material example: OpenBSD has expended considerable effort into removing ROP gadgets from their compilation products[1]. As the website documents[2], these efforts haven't made a single exploit harder to write. GCC even removed their (mostly equivalent) ROP mitigation approach, documenting it as "fairly ineffective" and "lur[ing] developers to the land of false security"[3]. (Another good example is PID randomization: OpenBSD added this over 20 years ago as part of their "randomize anything that can be randomized" approach. It's never had any real positive security impact, and has made other PID-based vulnerabilities more viable.) [1]: https://www.openbsd.org/papers/eurobsdcon2018-rop.pdf https://www.openbsd.org/papers/eurobsdcon2018-rop.pdf [2]: https://isopenbsdsecu.re/mitigations/rop_removal/ https://isopenbsdsecu.re/mitigations/rop_removal/ [3]: https://patchwork.ozlabs.org/project/gcc/patch/CAFULd4ZL-wa3wBaH4cNmvW=nxMYDgXtybinE4sg5EmsAgtasMA@mail.gmail.com/ https://patchwork.ozlabs.org/project/gcc/patch/CAFULd4ZL-wa3...
wglb 6y ago
I use it for critical functions largely because it is simpler.
VWWHFSfQ 6y ago
> OpenBSD has an even stronger security culture. BIG citation needed. > Not sure it makes a difference over Linux It doesn't. Edit: listen, I understand that people are religious about their operating system kernel, but please make a reply to these points if you have one to refute.
- zokula 6y ago
  Because OpenBSD is security snake oil. Linux and FreeBSD are more secure than OpenBSD.
  - sanxiyn 6y ago
    That is a surprising claim. You should substantiate it with evidences, say, on exploits.
  - anthk 6y ago
    FreeBSD was a joke on defaults. Look: https://vez.mrsk.me/freebsd-defaults.html https://vez.mrsk.me/freebsd-defaults.html On Linux, I won't even start on the policy on most distros.
- eredengrin 6y ago
  > > OpenBSD has an even stronger security culture. > BIG citation needed. While it may be debatable how much of an effect the OpenBSD security culture has on real world security outcomes, it is pretty obvious to most people I think that OpenBSD has a culture of security (or a focus on it) that Linux simply does not have. Security is practically the entire branding of the project. Just go to its home page, literally the first sentence is an advertisement for its security record. The culture is very much there, regardless of results. Now, if you did want to argue that the security culture does not necessarily result in better outcomes, 1) that intention should probably be made more clear, and 2) why not at least provide an argument or some amount of evidence for it?
  - VWWHFSfQ 6y ago
    Look at the OpenBSD security advisories in the last 3 years: * https://www.cvedetails.com/vulnerability-list.php?vendor_id=97&product_id=163&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&cweid=0&order=1&trc=168&sha=5cb5970bad25a1cd40911997bbae089e28d21872 https://www.cvedetails.com/vulnerability-list.php?vendor_id=... And then look at the same number of security advisories for the Linux kernal during the same time: * https://www.cvedetails.com/vulnerability-list.php?vendor_id=33&product_id=47&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=7&cvssscoremax=7.99&year=0&cweid=0&order=1&trc=662&sha=27cc1be095dd1cc4189b3d337cc787289500c13e https://www.cvedetails.com/vulnerability-list.php?vendor_id=... And then remember that NOBODY uses OpenBSD. Literally no big-time company uses OpenBSD. Who uses OpenBSD??? Literally nobody.

by atonse 6y ago

tptacek 6y ago

OpenBSD has a different security culture. "Stronger" hasn't been the right word in over a decade.

atonse 6y ago
Yeah I don’t know if at this point it even matters. I was nervous about even leaving this comment. Maybe showing my decade old bias.
- dicknuckle 6y ago
  I use alpine for my bastion machine, but I'm not even sure if it's the best solution.
- sirtoffski 6y ago
  Same sentiment here. I could come up with one "advantage" of OpenBSD over Linux - smaller user base. In a simplistic kind of a view that should make it less compelling to put in as much effort into developing exploits vs more common OS'. I couldn't back this up with any concrete data though.
  - Hnrobert42 6y ago
    Security through obscurity isn’t foolproof, but it isn’t entirely foolish, either. It can reduce risk if part of a layered defense strategy. It is important to remember though that it is not the number of users but but the value of the compromise that determines how compelling the O/S is. There are like vintage mainframe O/Ses for which folks are actively developing compromises because some government or telco hasn’t migrated off. Then again, those teams aren’t going to waste a exploit on somebody’s home Usenet archive. TL;DR: nevermind. I am too busy arguing with myself to be coherent.
jooize 6y ago
What do you mean?
- woodruffw 6y ago
  OpenBSD has historically been eager to add new security mitigations without explaining their intended threat model. Here's an excellent talk (in website form) on the subject: https://isopenbsdsecu.re/about/ https://isopenbsdsecu.re/about/
  - ta17711771 6y ago
    In the face of the Linux kernel not taking care of known exploits, regardless of their usability, I'll take it.
  - bawolff 6y ago
    I dont think that website is very compelling. It claims a bunch of things as not good practise, and then asserts without evidence or example that openbsd does them. Quite frankly it reads like someone with an axe to grind against openbsd.
    - woodruffw 6y ago
      > I dont think that website is very compelling. It claims a bunch of things as not good practise, and then asserts without evidence or example that openbsd does them. Here's a material example: OpenBSD has expended considerable effort into removing ROP gadgets from their compilation products[1]. As the website documents[2], these efforts haven't made a single exploit harder to write. GCC even removed their (mostly equivalent) ROP mitigation approach, documenting it as "fairly ineffective" and "lur[ing] developers to the land of false security"[3]. (Another good example is PID randomization: OpenBSD added this over 20 years ago as part of their "randomize anything that can be randomized" approach. It's never had any real positive security impact, and has made other PID-based vulnerabilities more viable.) [1]: https://www.openbsd.org/papers/eurobsdcon2018-rop.pdf https://www.openbsd.org/papers/eurobsdcon2018-rop.pdf [2]: https://isopenbsdsecu.re/mitigations/rop_removal/ https://isopenbsdsecu.re/mitigations/rop_removal/ [3]: https://patchwork.ozlabs.org/project/gcc/patch/CAFULd4ZL-wa3wBaH4cNmvW=nxMYDgXtybinE4sg5EmsAgtasMA@mail.gmail.com/ https://patchwork.ozlabs.org/project/gcc/patch/CAFULd4ZL-wa3...

wglb 6y ago

I use it for critical functions largely because it is simpler.

VWWHFSfQ 6y ago

> OpenBSD has an even stronger security culture. BIG citation needed. > Not sure it makes a difference over Linux It doesn't. Edit: listen, I understand that people are religious about their operating system kernel, but please make a reply to these points if you have one to refute.

zokula 6y ago
Because OpenBSD is security snake oil. Linux and FreeBSD are more secure than OpenBSD.
- sanxiyn 6y ago
  That is a surprising claim. You should substantiate it with evidences, say, on exploits.
- anthk 6y ago
  FreeBSD was a joke on defaults. Look: https://vez.mrsk.me/freebsd-defaults.html https://vez.mrsk.me/freebsd-defaults.html On Linux, I won't even start on the policy on most distros.
eredengrin 6y ago
> > OpenBSD has an even stronger security culture. > BIG citation needed. While it may be debatable how much of an effect the OpenBSD security culture has on real world security outcomes, it is pretty obvious to most people I think that OpenBSD has a culture of security (or a focus on it) that Linux simply does not have. Security is practically the entire branding of the project. Just go to its home page, literally the first sentence is an advertisement for its security record. The culture is very much there, regardless of results. Now, if you did want to argue that the security culture does not necessarily result in better outcomes, 1) that intention should probably be made more clear, and 2) why not at least provide an argument or some amount of evidence for it?
- VWWHFSfQ 6y ago
  Look at the OpenBSD security advisories in the last 3 years: * https://www.cvedetails.com/vulnerability-list.php?vendor_id=97&product_id=163&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&cweid=0&order=1&trc=168&sha=5cb5970bad25a1cd40911997bbae089e28d21872 https://www.cvedetails.com/vulnerability-list.php?vendor_id=... And then look at the same number of security advisories for the Linux kernal during the same time: * https://www.cvedetails.com/vulnerability-list.php?vendor_id=33&product_id=47&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=7&cvssscoremax=7.99&year=0&cweid=0&order=1&trc=662&sha=27cc1be095dd1cc4189b3d337cc787289500c13e https://www.cvedetails.com/vulnerability-list.php?vendor_id=... And then remember that NOBODY uses OpenBSD. Literally no big-time company uses OpenBSD. Who uses OpenBSD??? Literally nobody.