9 ms·

I'm old enough to remember back in 2002, Openbsd.org had a banner: "Five years without a remote hole in the default install!" Then, later that year OpenSSH had

I'm old enough to remember back in 2002, Openbsd.org had a banner: "Five years without a remote hole in the default install!" Then, later that year OpenSSH had a critical, remotely exploitable vulnerability that allowed an attacker to gain remote root access. They changed the banner to: "One remote hole in the default install, in nearly 6 years!" It stayed that way almost 5 more years when in 2007 a flaw in IPv6 was discovered that resulted in a kernel-level buffer overflow, and the banner was updated to: "Only two remote holes in the default install, in a heck of a long time!" At some point, that slogan was removed, probably because of the fierce criticism and debate it sparked. Even still, OpenBSD pretty much designed the idea of "secure by default" and still to this day, probably lead all modern software OS in this ideology. I can't think of any other major software distribution where I can count exploits on a single hand after many, many years.

hellcow 6y ago
openbsd.org still has the banner, and it still lists just 2 remote holes 13 years later.
- _nickwhite 6y ago
  Indeed it does, I see it now: "Only two remote holes in the default install, in a heck of a long time!" My old greybeard eyes completely missed the red text, centered right under the top banner.
staticassertion 6y ago
Are remote exploits in minimal server installs particularly common? Like for any OS? Feels like probably not very. I can think of one off the top of my head in Windows. But like, let's imagine a minimal Linux server install, not even something hardened - I feel like there probably aren't too many RCEs in there. Even fewer that are legitimately exploitable with a bit of work to harden. It's not really to diss OpenBSD so much as to say that, yes, a lack of RCE in a default install is cool, but you also have to wonder what anyone is doing with a default install, and if that's really something you should care much about.
- nine_k 6y ago
  While each piece of software may be solid, insecure defaults are totally not unheard of.
- throwawayboise 6y ago
  How far back are you thinking? There was a time when an unpatched Windows install would be owned within minutes of connecting it to the internet.
  - joshspankit 6y ago
    Those were fun days. We even had a couple races: fresh install, who can get infected the fastest.
  - staticassertion 6y ago
    Windows is sort of an easy one since it's hardly a minimal server OS, but idk, even then, post-Windows7 I imagine things started getting far less common. OpenBSD's claim is fine and all it's just not all that important. No one just ships OpenBSD without adding something to it.
    - yjftsjthsd-h 6y ago
      > Windows is sort of an easy one since it's hardly a minimal server OS OpenBSD ships X and a window manager in the base system
      - ac29 6y ago
        X is an optional set of packages: https://www.openbsd.org/faq/faq4.html#FilesNeeded https://www.openbsd.org/faq/faq4.html#FilesNeeded
        yjftsjthsd-h 6y ago
        It is optional, but still part of the base system. It's a bit like how you could use Add/Remove Features to remove "standard" parts of Windows.
spijdar 6y ago
The reason why it's so controversial is because OpenBSD doesn't actually enable any services by default except for ssh, IIRC. Which means that the attack surface for OpenBSD is just their TCP/IP stack and SSH. The slogan, while technically correct, sounds like (and dare I say, is often taken as) saying that there have been no security bugs/network RCE bugs in OpenBSD. OpenBSD has shipped with many RCE vulnerabilities over the years (in its included FTP and HTTP servers, for example). Simply in services not enabled by default. Because none of them are enabled by default. I'm not particularly impressed by OpenBSD in this particular regard because if you want to do something with your computer, you will eventually end up needing to enable services, some of which have had bugs shipped with OpenBSD. And once you install 3rd party software, all bets are off. One thing OpenBSD has focused on recently I am a huge fan of is their documentation and focus on making consistent and easy to read and write config files. That is a huge bonus to security IMO. Making it easier to learn how and to write configs makes the chances of misconfiguring a server much lower, which is more often the bigger security risk.
- blhack 6y ago
  Isn't the exactly what secure by default means?
  - joshspankit 6y ago
    It also must imply that the base install has no insecurities, including when you enable a built-in service. Adding 3rd party packages sure: you’ve left “default” behind, but ones installed by the OS? They count imho
  - spijdar 6y ago
    It is "secure by default" but I find that phrase disingenuous when the "default" doesn't really do anything. Sure, it's secure, but that doesn't help me much if I have to immediately make changes that could instantly make it insecure. "Secure by default" would be most meaningful IMO when describing a "fat" OS with services and such already enabled, and configured securely. OpenBSD's "secure by default" is nice and useful so far as you can trust it's extremely unlikely someone will be able to nail you with a 0-day when you're doing your OS install and early setup, but that's the biggest part of that. Not to say OpenBSD doesn't do other secure things. I'm just not impressed by their claim of "secure by default".
pjmlp 6y ago
Easy, non UNIX OSes, ClearPath born as Burroughs, 10 years before C was invented. Unisys marketing? Safer than any UNIX you want to trust your government most valuable documents. Or closer to home, DoD security assessment of Multics and PL/I language features that prevented exploits similar to UNIX systems.
1vuio0pswjnm7 6y ago
https://grugq.github.io/presentations/COMSEC%20beyond%20encryption.pdf https://grugq.github.io/presentations/COMSEC%20beyond%20encr... Everyone has an opinion. This presenter claimed Windows is the most secure (for his particular use case: "COMSEC").
fsflover 6y ago
> OpenBSD pretty much designed the idea of "secure by default" and still to this day, probably lead all modern software OS in this ideology. If you care about security today you should consider Qubes OS instead. It provides security through isolation. Snowden uses it. https://qubes-os.org https://qubes-os.org

hellcow 6y ago

openbsd.org still has the banner, and it still lists just 2 remote holes 13 years later.

_nickwhite 6y ago
Indeed it does, I see it now: "Only two remote holes in the default install, in a heck of a long time!" My old greybeard eyes completely missed the red text, centered right under the top banner.

staticassertion 6y ago

Are remote exploits in minimal server installs particularly common? Like for any OS? Feels like probably not very. I can think of one off the top of my head in Windows. But like, let's imagine a minimal Linux server install, not even something hardened - I feel like there probably aren't too many RCEs in there. Even fewer that are legitimately exploitable with a bit of work to harden. It's not really to diss OpenBSD so much as to say that, yes, a lack of RCE in a default install is cool, but you also have to wonder what anyone is doing with a default install, and if that's really something you should care much about.

nine_k 6y ago
While each piece of software may be solid, insecure defaults are totally not unheard of.
throwawayboise 6y ago
How far back are you thinking? There was a time when an unpatched Windows install would be owned within minutes of connecting it to the internet.
- joshspankit 6y ago
  Those were fun days. We even had a couple races: fresh install, who can get infected the fastest.
- staticassertion 6y ago
  Windows is sort of an easy one since it's hardly a minimal server OS, but idk, even then, post-Windows7 I imagine things started getting far less common. OpenBSD's claim is fine and all it's just not all that important. No one just ships OpenBSD without adding something to it.
  - yjftsjthsd-h 6y ago
    > Windows is sort of an easy one since it's hardly a minimal server OS OpenBSD ships X and a window manager in the base system
    - ac29 6y ago
      X is an optional set of packages: https://www.openbsd.org/faq/faq4.html#FilesNeeded https://www.openbsd.org/faq/faq4.html#FilesNeeded
      - yjftsjthsd-h 6y ago
        It is optional, but still part of the base system. It's a bit like how you could use Add/Remove Features to remove "standard" parts of Windows.

spijdar 6y ago

The reason why it's so controversial is because OpenBSD doesn't actually enable any services by default except for ssh, IIRC. Which means that the attack surface for OpenBSD is just their TCP/IP stack and SSH. The slogan, while technically correct, sounds like (and dare I say, is often taken as) saying that there have been no security bugs/network RCE bugs in OpenBSD. OpenBSD has shipped with many RCE vulnerabilities over the years (in its included FTP and HTTP servers, for example). Simply in services not enabled by default. Because none of them are enabled by default. I'm not particularly impressed by OpenBSD in this particular regard because if you want to do something with your computer, you will eventually end up needing to enable services, some of which have had bugs shipped with OpenBSD. And once you install 3rd party software, all bets are off. One thing OpenBSD has focused on recently I am a huge fan of is their documentation and focus on making consistent and easy to read and write config files. That is a huge bonus to security IMO. Making it easier to learn how and to write configs makes the chances of misconfiguring a server much lower, which is more often the bigger security risk.

blhack 6y ago
Isn't the exactly what secure by default means?
- joshspankit 6y ago
  It also must imply that the base install has no insecurities, including when you enable a built-in service. Adding 3rd party packages sure: you’ve left “default” behind, but ones installed by the OS? They count imho
- spijdar 6y ago
  It is "secure by default" but I find that phrase disingenuous when the "default" doesn't really do anything. Sure, it's secure, but that doesn't help me much if I have to immediately make changes that could instantly make it insecure. "Secure by default" would be most meaningful IMO when describing a "fat" OS with services and such already enabled, and configured securely. OpenBSD's "secure by default" is nice and useful so far as you can trust it's extremely unlikely someone will be able to nail you with a 0-day when you're doing your OS install and early setup, but that's the biggest part of that. Not to say OpenBSD doesn't do other secure things. I'm just not impressed by their claim of "secure by default".

pjmlp 6y ago

Easy, non UNIX OSes, ClearPath born as Burroughs, 10 years before C was invented. Unisys marketing? Safer than any UNIX you want to trust your government most valuable documents. Or closer to home, DoD security assessment of Multics and PL/I language features that prevented exploits similar to UNIX systems.

1vuio0pswjnm7 6y ago

https://grugq.github.io/presentations/COMSEC%20beyond%20encryption.pdf https://grugq.github.io/presentations/COMSEC%20beyond%20encr... Everyone has an opinion. This presenter claimed Windows is the most secure (for his particular use case: "COMSEC").

fsflover 6y ago

> OpenBSD pretty much designed the idea of "secure by default" and still to this day, probably lead all modern software OS in this ideology. If you care about security today you should consider Qubes OS instead. It provides security through isolation. Snowden uses it. https://qubes-os.org https://qubes-os.org