23 ms·
> > OpenBSD has an even stronger security culture. > BIG citation needed. While it may be debatable how much of an effect the OpenBSD security culture has on
by eredengrin 6y ago
> > OpenBSD has an even stronger security culture.
> BIG citation needed.
While it may be debatable how much of an effect the OpenBSD security culture has on real world security outcomes, it is pretty obvious to most people I think that OpenBSD has a culture of security (or a focus on it) that Linux simply does not have. Security is practically the entire branding of the project. Just go to its home page, literally the first sentence is an advertisement for its security record. The culture is very much there, regardless of results.
Now, if you did want to argue that the security culture does not necessarily result in better outcomes, 1) that intention should probably be made more clear, and 2) why not at least provide an argument or some amount of evidence for it?
- VWWHFSfQ 6y agoLook at the OpenBSD security advisories in the last 3 years: * https://www.cvedetails.com/vulnerability-list.php?vendor_id=97&product_id=163&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&cweid=0&order=1&trc=168&sha=5cb5970bad25a1cd40911997bbae089e28d21872 https://www.cvedetails.com/vulnerability-list.php?vendor_id=... And then look at the same number of security advisories for the Linux kernal during the same time: * https://www.cvedetails.com/vulnerability-list.php?vendor_id=33&product_id=47&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=7&cvssscoremax=7.99&year=0&cweid=0&order=1&trc=662&sha=27cc1be095dd1cc4189b3d337cc787289500c13e https://www.cvedetails.com/vulnerability-list.php?vendor_id=... And then remember that NOBODY uses OpenBSD. Literally no big-time company uses OpenBSD. Who uses OpenBSD??? Literally nobody.
- throwaway8941 6y agoDoesn't the first link list CVEs for the whole system, not only the kernel?
- VWWHFSfQ 6y agoLet's say I want to set up 16 frontend firewall/load-balancers. In aggregate they will serve/distribute 34 GB/s. This is a business-critical workload. Would you put this on OpenBSD? And if so, who would you call when it breaks? Would you put this on FreeBSD? And if so, who would you call when it breaks? We put this on Linux. And we can Red Hat when it breaks. It has broken for us in the past. And we get absolutely top-notch Linux kernel TCP experts on the phone to help us fix the issues in no time.
- beachhead 6y agoWho is we?
- bawolff 6y agoThe fact you have a service contract with red hat is irrelavent to the question of if openbsd is more or less "secure" than linux
- nix23 6y agoI f you need to pay someone as a scapegoat because you break stuff and cannot revert it: FreeBSD: https://www.xinuos.com https://www.xinuos.com OpenBSD: https://www.openbsd.org/support.html https://www.openbsd.org/support.html NetBSD: https://www.netbsd.org/gallery/consultants.html https://www.netbsd.org/gallery/consultants.html Oh and load-balancer..Jupiter OS is based on FreeBSD, pfsense and Opnsense(HardenedBSD), Netflix, Cisco, Sophos, Stormshield and so on: https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/nutshell.html https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/n... PS: If you serve 34GB/s you should probably have your own 'top notch' TCP experts ;)
- beachhead 6y agoWord? Nobody uses OpenBSD? I reckon you've got some sources to back your claims, right? I mean surely you wouldn't just be making things up. Let's see them.