6 ms·

> OpenBSD has an even stronger security culture. BIG citation needed. > Not sure it makes a difference over Linux It doesn't. Edit: listen, I understand tha

> OpenBSD has an even stronger security culture. BIG citation needed. > Not sure it makes a difference over Linux It doesn't. Edit: listen, I understand that people are religious about their operating system kernel, but please make a reply to these points if you have one to refute.

zokula 6y ago
Because OpenBSD is security snake oil. Linux and FreeBSD are more secure than OpenBSD.
- sanxiyn 6y ago
  That is a surprising claim. You should substantiate it with evidences, say, on exploits.
- anthk 6y ago
  FreeBSD was a joke on defaults. Look: https://vez.mrsk.me/freebsd-defaults.html https://vez.mrsk.me/freebsd-defaults.html On Linux, I won't even start on the policy on most distros.
eredengrin 6y ago
> > OpenBSD has an even stronger security culture. > BIG citation needed. While it may be debatable how much of an effect the OpenBSD security culture has on real world security outcomes, it is pretty obvious to most people I think that OpenBSD has a culture of security (or a focus on it) that Linux simply does not have. Security is practically the entire branding of the project. Just go to its home page, literally the first sentence is an advertisement for its security record. The culture is very much there, regardless of results. Now, if you did want to argue that the security culture does not necessarily result in better outcomes, 1) that intention should probably be made more clear, and 2) why not at least provide an argument or some amount of evidence for it?
- VWWHFSfQ 6y ago
  Look at the OpenBSD security advisories in the last 3 years: * https://www.cvedetails.com/vulnerability-list.php?vendor_id=97&product_id=163&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&cweid=0&order=1&trc=168&sha=5cb5970bad25a1cd40911997bbae089e28d21872 https://www.cvedetails.com/vulnerability-list.php?vendor_id=... And then look at the same number of security advisories for the Linux kernal during the same time: * https://www.cvedetails.com/vulnerability-list.php?vendor_id=33&product_id=47&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=7&cvssscoremax=7.99&year=0&cweid=0&order=1&trc=662&sha=27cc1be095dd1cc4189b3d337cc787289500c13e https://www.cvedetails.com/vulnerability-list.php?vendor_id=... And then remember that NOBODY uses OpenBSD. Literally no big-time company uses OpenBSD. Who uses OpenBSD??? Literally nobody.
  - throwaway8941 6y ago
    Doesn't the first link list CVEs for the whole system, not only the kernel?
    - VWWHFSfQ 6y ago
      Let's say I want to set up 16 frontend firewall/load-balancers. In aggregate they will serve/distribute 34 GB/s. This is a business-critical workload. Would you put this on OpenBSD? And if so, who would you call when it breaks? Would you put this on FreeBSD? And if so, who would you call when it breaks? We put this on Linux. And we can Red Hat when it breaks. It has broken for us in the past. And we get absolutely top-notch Linux kernel TCP experts on the phone to help us fix the issues in no time.
      - beachhead 6y ago
        Who is we?
      - bawolff 6y ago

zokula 6y ago

Because OpenBSD is security snake oil. Linux and FreeBSD are more secure than OpenBSD.

sanxiyn 6y ago
That is a surprising claim. You should substantiate it with evidences, say, on exploits.
anthk 6y ago
FreeBSD was a joke on defaults. Look: https://vez.mrsk.me/freebsd-defaults.html https://vez.mrsk.me/freebsd-defaults.html On Linux, I won't even start on the policy on most distros.

eredengrin 6y ago

> > OpenBSD has an even stronger security culture. > BIG citation needed. While it may be debatable how much of an effect the OpenBSD security culture has on real world security outcomes, it is pretty obvious to most people I think that OpenBSD has a culture of security (or a focus on it) that Linux simply does not have. Security is practically the entire branding of the project. Just go to its home page, literally the first sentence is an advertisement for its security record. The culture is very much there, regardless of results. Now, if you did want to argue that the security culture does not necessarily result in better outcomes, 1) that intention should probably be made more clear, and 2) why not at least provide an argument or some amount of evidence for it?

VWWHFSfQ 6y ago
Look at the OpenBSD security advisories in the last 3 years: * https://www.cvedetails.com/vulnerability-list.php?vendor_id=97&product_id=163&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&cweid=0&order=1&trc=168&sha=5cb5970bad25a1cd40911997bbae089e28d21872 https://www.cvedetails.com/vulnerability-list.php?vendor_id=... And then look at the same number of security advisories for the Linux kernal during the same time: * https://www.cvedetails.com/vulnerability-list.php?vendor_id=33&product_id=47&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=7&cvssscoremax=7.99&year=0&cweid=0&order=1&trc=662&sha=27cc1be095dd1cc4189b3d337cc787289500c13e https://www.cvedetails.com/vulnerability-list.php?vendor_id=... And then remember that NOBODY uses OpenBSD. Literally no big-time company uses OpenBSD. Who uses OpenBSD??? Literally nobody.
- throwaway8941 6y ago
  Doesn't the first link list CVEs for the whole system, not only the kernel?
  - VWWHFSfQ 6y ago
    Let's say I want to set up 16 frontend firewall/load-balancers. In aggregate they will serve/distribute 34 GB/s. This is a business-critical workload. Would you put this on OpenBSD? And if so, who would you call when it breaks? Would you put this on FreeBSD? And if so, who would you call when it breaks? We put this on Linux. And we can Red Hat when it breaks. It has broken for us in the past. And we get absolutely top-notch Linux kernel TCP experts on the phone to help us fix the issues in no time.
    - beachhead 6y ago
      Who is we?
    - bawolff 6y ago