3 ms·

OpenBSD security is more than few security patches and kernel configuration. Check out their web site for more information. Most Linux distributions I've playe

OpenBSD security is more than few security patches and kernel configuration. Check out their web site for more information. Most Linux distributions I've played with (CentOS, Redhat, Ubuntu Server, Debian) are pretty mediocre when it comes to security. I've actually stopped using Debian since this incident : http://www.debian.org/security/2008/dsa-1571 http://www.debian.org/security/2008/dsa-1571 In addition, my own experience would point out that OpenBSD is more reliable than Linux, but I'm just a single data point. For development however, we use FreeBSD for a wide range of reasons including ports freshness.

danieldk 16y ago
It's funny that you mention Red Hat (and CentOS), since they invest very heavily in attack mitigation and sandboxing through virtual machines: http://www.awe.com/mark/blog/20101130.html http://www.awe.com/mark/blog/20101130.html And as much as people dislike SELinux, it does help a lot in confining applications. OpenBSD does not provide comparable techniques.
- 16s 16y ago
  They have clearly stated why they do not support those technologies multiple times, but it continually comes up. OpenBSD always goes with simple, easy to understand solutions that "just work out of the box" and can be easily configured and maintained. They build those simple solutions into the OS, they do not (and will not) bolt on complexity.
  - danieldk 16y ago
    OpenBSD always goes with simple, easy to understand solutions that "just work out of the box" and can be easily configured and maintained. Yes, we hear this every time. But this is the same project that advocated systrace, which provided access control with respect to syscalls. I do not see much of a difference between systrace and a mandatory access control framework, except that the implementation of systrace was flawed, it didn't support file labels, and SELinux has a more sophisticated policy language. The OpenBSD Project has a very narrow view of security, and do little to improve attack mitigation for software that is not in the base system (ports).
    - tedunangst 16y ago
      Most of OpenBSD's attack mitigation is at the kernel or libc level. It applies equally to the base system and third party software.
  - runjake 16y ago
    This doesn't articulate your point at all. What simple solutions are you referring to? systrace? "Don't install ports"?
- dj_axl 16y ago
  I don't know about now, but ~4 years ago installing from scratch I tried SELinux and after hours of configuring it still wasn't recognizing some hardware. Then I tried OpenBSD or FreeBSD, and it was up and running with minimal configuration. YMMV.
  - tedunangst 16y ago
    You discovered the difference between "works" and "can be made to work". There are many people who still believe they are synonymous.
  - evangineer 16y ago
    I've worked with SELinux in the past, it works but it can be a real pain to get up and running and there's a bit of a learning curve associated with it.

danieldk 16y ago

It's funny that you mention Red Hat (and CentOS), since they invest very heavily in attack mitigation and sandboxing through virtual machines: http://www.awe.com/mark/blog/20101130.html http://www.awe.com/mark/blog/20101130.html And as much as people dislike SELinux, it does help a lot in confining applications. OpenBSD does not provide comparable techniques.

16s 16y ago
They have clearly stated why they do not support those technologies multiple times, but it continually comes up. OpenBSD always goes with simple, easy to understand solutions that "just work out of the box" and can be easily configured and maintained. They build those simple solutions into the OS, they do not (and will not) bolt on complexity.
- danieldk 16y ago
  OpenBSD always goes with simple, easy to understand solutions that "just work out of the box" and can be easily configured and maintained. Yes, we hear this every time. But this is the same project that advocated systrace, which provided access control with respect to syscalls. I do not see much of a difference between systrace and a mandatory access control framework, except that the implementation of systrace was flawed, it didn't support file labels, and SELinux has a more sophisticated policy language. The OpenBSD Project has a very narrow view of security, and do little to improve attack mitigation for software that is not in the base system (ports).
  - tedunangst 16y ago
    Most of OpenBSD's attack mitigation is at the kernel or libc level. It applies equally to the base system and third party software.
- runjake 16y ago
  This doesn't articulate your point at all. What simple solutions are you referring to? systrace? "Don't install ports"?
dj_axl 16y ago
I don't know about now, but ~4 years ago installing from scratch I tried SELinux and after hours of configuring it still wasn't recognizing some hardware. Then I tried OpenBSD or FreeBSD, and it was up and running with minimal configuration. YMMV.
- tedunangst 16y ago
  You discovered the difference between "works" and "can be made to work". There are many people who still believe they are synonymous.
- evangineer 16y ago
  I've worked with SELinux in the past, it works but it can be a real pain to get up and running and there's a bit of a learning curve associated with it.