5 ms·

Are remote exploits in minimal server installs particularly common? Like for any OS? Feels like probably not very. I can think of one off the top of my head in

Are remote exploits in minimal server installs particularly common? Like for any OS? Feels like probably not very. I can think of one off the top of my head in Windows. But like, let's imagine a minimal Linux server install, not even something hardened - I feel like there probably aren't too many RCEs in there. Even fewer that are legitimately exploitable with a bit of work to harden. It's not really to diss OpenBSD so much as to say that, yes, a lack of RCE in a default install is cool, but you also have to wonder what anyone is doing with a default install, and if that's really something you should care much about.

nine_k 6y ago
While each piece of software may be solid, insecure defaults are totally not unheard of.
throwawayboise 6y ago
How far back are you thinking? There was a time when an unpatched Windows install would be owned within minutes of connecting it to the internet.
- joshspankit 6y ago
  Those were fun days. We even had a couple races: fresh install, who can get infected the fastest.
- staticassertion 6y ago
  Windows is sort of an easy one since it's hardly a minimal server OS, but idk, even then, post-Windows7 I imagine things started getting far less common. OpenBSD's claim is fine and all it's just not all that important. No one just ships OpenBSD without adding something to it.
  - yjftsjthsd-h 6y ago
    > Windows is sort of an easy one since it's hardly a minimal server OS OpenBSD ships X and a window manager in the base system
    - ac29 6y ago
      X is an optional set of packages: https://www.openbsd.org/faq/faq4.html#FilesNeeded https://www.openbsd.org/faq/faq4.html#FilesNeeded
      - yjftsjthsd-h 6y ago
        It is optional, but still part of the base system. It's a bit like how you could use Add/Remove Features to remove "standard" parts of Windows.
- cpach 6y ago
  Yeah I remember back in the early naughts. Windows 98 was sooo insecure :)
  - arp242 6y ago
    This was even the case with Windows 2000 and XP at some point. Installing a default 2000 or XP without any updates and then using Windows Update was a no-no as you'd have malware before you could install the updates.
tedunangst 6y ago
Kids these days. Default redhat installs used to run more services than you could count. There were extensive post install howtos to guide you through turning it all back off.
tptacek 6y ago
No, they're not.
IcePic 6y ago
Redhat used to ship running pop2, pop3 and imapd running by default, all open. Windows was SO exploitable that ISPs to this day block 137-139 and 445 just so people do not get hacked immediately. Par for the course was to get owned within hours (or minutes) if you were on the net, that was the context where not-getting-random-remote-admins was a differentiating factor.
- staticassertion 6y ago
  Sure, of course. I'm talking within last decade.
  - IcePic 6y ago
    Well, do ISPs suddenly allow 137-139,445 nowadays or is this still considered to be a hole wide enough for a truck to drive through? If those are still blocked, then the major OS in this world still proves that there are bad defaults and good defaults, one which leads to compromise and one that leaves you secure until you screw up in some other way. If other OSes have "caught up" with not starting and exposing lots of random* daemons just because they exist on disk on a default install, then that is for the better of the world. That doesn't take away the idea that some OSs did it long before others, and hence have given their users a safer experience for a longer time. *) random in the sense that "running a pop2 daemon when your box wasn't even intended to be a mail server" is beyond silly. Same for httpd, ftpd, ntpd-claiming-to-be-stratum-1-on-motherboard-clock (happened) and all other services a full default installation might provide.
    - flomo 6y ago
      137-139 was originally about the old lanman broadcast stuff more than "security". They did not want your "network neighborhood" to be populated with your actual neighbors because that's creepy. I assume MS fixed this at some point, and I also assume ISPs will never change this.
jjav 6y ago
> Are remote exploits in minimal server installs particularly common? Extremely common, windows was infamous for this. You couldn't do a fresh install of the OS and patch it because by the time you downloaded the patch it had already been rooted just by being on the network.

nine_k 6y ago

While each piece of software may be solid, insecure defaults are totally not unheard of.

throwawayboise 6y ago

How far back are you thinking? There was a time when an unpatched Windows install would be owned within minutes of connecting it to the internet.

joshspankit 6y ago
Those were fun days. We even had a couple races: fresh install, who can get infected the fastest.
staticassertion 6y ago
Windows is sort of an easy one since it's hardly a minimal server OS, but idk, even then, post-Windows7 I imagine things started getting far less common. OpenBSD's claim is fine and all it's just not all that important. No one just ships OpenBSD without adding something to it.
- yjftsjthsd-h 6y ago
  > Windows is sort of an easy one since it's hardly a minimal server OS OpenBSD ships X and a window manager in the base system
  - ac29 6y ago
    X is an optional set of packages: https://www.openbsd.org/faq/faq4.html#FilesNeeded https://www.openbsd.org/faq/faq4.html#FilesNeeded
    - yjftsjthsd-h 6y ago
      It is optional, but still part of the base system. It's a bit like how you could use Add/Remove Features to remove "standard" parts of Windows.
cpach 6y ago
Yeah I remember back in the early naughts. Windows 98 was sooo insecure :)
- arp242 6y ago
  This was even the case with Windows 2000 and XP at some point. Installing a default 2000 or XP without any updates and then using Windows Update was a no-no as you'd have malware before you could install the updates.

tedunangst 6y ago

Kids these days. Default redhat installs used to run more services than you could count. There were extensive post install howtos to guide you through turning it all back off.

tptacek 6y ago

No, they're not.

IcePic 6y ago

Redhat used to ship running pop2, pop3 and imapd running by default, all open. Windows was SO exploitable that ISPs to this day block 137-139 and 445 just so people do not get hacked immediately. Par for the course was to get owned within hours (or minutes) if you were on the net, that was the context where not-getting-random-remote-admins was a differentiating factor.

staticassertion 6y ago
Sure, of course. I'm talking within last decade.
- IcePic 6y ago
  Well, do ISPs suddenly allow 137-139,445 nowadays or is this still considered to be a hole wide enough for a truck to drive through? If those are still blocked, then the major OS in this world still proves that there are bad defaults and good defaults, one which leads to compromise and one that leaves you secure until you screw up in some other way. If other OSes have "caught up" with not starting and exposing lots of random* daemons just because they exist on disk on a default install, then that is for the better of the world. That doesn't take away the idea that some OSs did it long before others, and hence have given their users a safer experience for a longer time. *) random in the sense that "running a pop2 daemon when your box wasn't even intended to be a mail server" is beyond silly. Same for httpd, ftpd, ntpd-claiming-to-be-stratum-1-on-motherboard-clock (happened) and all other services a full default installation might provide.
  - flomo 6y ago
    137-139 was originally about the old lanman broadcast stuff more than "security". They did not want your "network neighborhood" to be populated with your actual neighbors because that's creepy. I assume MS fixed this at some point, and I also assume ISPs will never change this.

jjav 6y ago

> Are remote exploits in minimal server installs particularly common? Extremely common, windows was infamous for this. You couldn't do a fresh install of the OS and patch it because by the time you downloaded the patch it had already been rooted just by being on the network.