OpenBSD always goes with simple, easy to understand solutions that "just work out of the box" and can be easily configured and maintained. Yes, we hear this ev

OpenBSD always goes with simple, easy to understand solutions that "just work out of the box" and can be easily configured and maintained. Yes, we hear this every time. But this is the same project that advocated systrace, which provided access control with respect to syscalls. I do not see much of a difference between systrace and a mandatory access control framework, except that the implementation of systrace was flawed, it didn't support file labels, and SELinux has a more sophisticated policy language. The OpenBSD Project has a very narrow view of security, and do little to improve attack mitigation for software that is not in the base system (ports).