6 ms·

The reason why it's so controversial is because OpenBSD doesn't actually enable any services by default except for ssh, IIRC. Which means that the attack surfa

The reason why it's so controversial is because OpenBSD doesn't actually enable any services by default except for ssh, IIRC. Which means that the attack surface for OpenBSD is just their TCP/IP stack and SSH. The slogan, while technically correct, sounds like (and dare I say, is often taken as) saying that there have been no security bugs/network RCE bugs in OpenBSD. OpenBSD has shipped with many RCE vulnerabilities over the years (in its included FTP and HTTP servers, for example). Simply in services not enabled by default. Because none of them are enabled by default. I'm not particularly impressed by OpenBSD in this particular regard because if you want to do something with your computer, you will eventually end up needing to enable services, some of which have had bugs shipped with OpenBSD. And once you install 3rd party software, all bets are off. One thing OpenBSD has focused on recently I am a huge fan of is their documentation and focus on making consistent and easy to read and write config files. That is a huge bonus to security IMO. Making it easier to learn how and to write configs makes the chances of misconfiguring a server much lower, which is more often the bigger security risk.

blhack 6y ago
Isn't the exactly what secure by default means?
- joshspankit 6y ago
  It also must imply that the base install has no insecurities, including when you enable a built-in service. Adding 3rd party packages sure: you’ve left “default” behind, but ones installed by the OS? They count imho
- spijdar 6y ago
  It is "secure by default" but I find that phrase disingenuous when the "default" doesn't really do anything. Sure, it's secure, but that doesn't help me much if I have to immediately make changes that could instantly make it insecure. "Secure by default" would be most meaningful IMO when describing a "fat" OS with services and such already enabled, and configured securely. OpenBSD's "secure by default" is nice and useful so far as you can trust it's extremely unlikely someone will be able to nail you with a 0-day when you're doing your OS install and early setup, but that's the biggest part of that. Not to say OpenBSD doesn't do other secure things. I'm just not impressed by their claim of "secure by default".
  - blhack 6y ago
    >"default" doesn't really do anything. This is an unbelievably absurd statement. What do you mean it doesn't """do""" anything? I can boot up my openBSD desktop machine and write computer software, edit graphics, play media files, etc. Basically anything that you would want a computer to do. Before that computer starts interacting with other computers over the network however, I generally have to ask it to. That's GOOD.
    - spijdar 6y ago
      > Basically anything that you would want a computer to do. Some people will be okay playing uncompressed WAV and Sun AU files cat'ed to the audio device. Other people are going to want to play other audio formats. This kind of reasoning is a bit reductionist. Sure, as long as my computer has a compiler and basic interfaces, I can "do anything that you would want a computer to do", given <x> amount of work on my part to re-implement the functionality I want. Unless I want to write my own MP3 decoder, though, I'll need to install 3rd party software from ports. > Before that computer starts interacting with other computers over the network however, I generally have to ask it to. That's GOOD. Right, it is -- but most linux distributions also don't start a lot of network services. Linux has had a few more TCP/IP stack vulnerabilities than OpenBSD, but not many. And of course (mostly) Linux distros uses OpenBSD's SSH package. Your empty Linux install and empty OpenBSD install will, from the network, appear mostly identical. And the bug in Firefox that pops a shell on your system likely won't be either Linux or OpenBSD's fault, but Firefox's.
      - dagw 6y ago
        but most linux distributions also don't start a lot of network services. While that is mostly true today, it certainly didn't used to be. Back when OpenBSD was really earning its security reputation, a default install of Red Hat would be rooted almost as soon as you connected it to the internet.
    - arp242 6y ago
      > I can boot up my openBSD desktop machine and write computer software, edit graphics, play media files, etc. Basically anything that you would want a computer to do. But if mg has a bug allowing malicious files to run code, then this won't increment the"remote holes in the default install"-claim, just to name an example. If I go to the CVE database and search for "Windows 10" or "FreeBSD" then I might find 200 security holes of varying severity, and people will say "Windows 10 has had 200 security problems" Not all those problems will affect everyone, but this is the common-sense way most people would understand it. But OpenBSD has a subtly different definition, and I think this subtly distinction is lost on many. I have nothing against OpenBSD and generally like it, but I always found this claim to be a bit misleading (even though it's technically correct). It's not a meaningless metric though; I remember installing Windows 2000 back in the day and it had malware before I could install the updates. But it is a very incomplete one.
- Shish2k 6y ago
  By that logic all software is 100% "secure by default" - if I don’t choose to add my own electricity into the equation, then there are no bugs in the running software at all, because no software is running :D It’s technically correct, but a meaningless metric :P
  - blhack 6y ago
    It is not even a remotely meaningless metric. OpenBSD doing NOTHING by default is exactly what I want. Somebody said that sshd starts by default, but actually it doesn't unless you specify that you want it to during installation. When you finish an openBSD installation, you are presented with a fully functioning system that will boot up to a shell, which has a networking stack available, and will allow you to then install the things you want. That's what I want a computer to do. I don't want it to start up the kitchen sink unless I ask it to.
    - diffeomorphism 6y ago
      > OpenBSD doing NOTHING by default is exactly what I want. True, but that does not have anything to do with the metric. For example, see https://xkcd.com/641/ https://xkcd.com/641/ . Cereal being asbestos-free is definitely a good thing and "exactly what I want". Yet, people will complain about that advertisement. Or "No vulnerabilities in the webservers turned on by default^1. Also, all default-enabled webservers are giraffes." 1: There are none, so this is true.
- jjav 6y ago
  Yes, that is "secure by default". It's a very reasonable claim to make. This was a contrast to a fresh install of Windows which would get infected within minutes of being connected to the network (I'm assuming this is no longer true, but have never used windows).
  - peteretep 6y ago
    Any OS that shipped OpenSSH earlier than June 2002 could get infected within minutes of being connected to the network, which is basically a set of all Linuxes or their parents.
    - chungus_khan 6y ago
      (and OpenBSD as well)
theonemind 6y ago
As you enable each thing, you have to think about it. Maybe you don't really need it. You probably won't configure whatever as wide open as most vendors do for ease-of-use, but consider your own use case. I mean, historically, some OSes might as well have had the slogan "insecure by default", like Windows XP before service pack 2. Just enable everything and make it wide open. In that era, Linux distributions weren't much different. Possibly, OpenBSD moved the needle in the right direction on that sort of thinking.
enriquto 6y ago
> The reason why it's so controversial is because OpenBSD doesn't actually enable any services by default except for ssh Sounds reasonable. Why is it controversial? Enabling stuff by default is not only in bad taste, it is also insecure.
- deepstack 6y ago
  exactly. SSH is the only thing needed. BTW, debian with only ssh enabled is also pretty good. Wonder how it stack against openbsd in that regard.
  - deleted 6y ago
    [deleted]
- spijdar 6y ago
  The fact they don't enable services isn't what is controversial, it's the claim that they have "no remote bugs in a heck of a long time" on an install that doesn't enable anything. OpenBSD has shipped several vulnerabilities in other network services included in base, including some which would be commonly enabled like FTP and HTTP daemons. Many Linux distros also don't enable services at boot, and use OpenBSD's SSH client/server. They would essentially be just "as secure" out of the box as OpenBSD is, with the exception of RCE vulnerabilities in the TCP/IP stack of Linux itself, which are about as uncommon as those in OpenBSD itself. Giving you a minimal install base is a nice touch, and I greatly prefer it myself. I do not see it as a great security feature, however, since almost (not all, but almost) everyone will immediately install or configure additional services. OS security should be about mitigating exploits and protecting that other software you're running. OpenBSD does do other things to increase security. I just think their tagline is a touch deceptive.

blhack 6y ago

Isn't the exactly what secure by default means?

joshspankit 6y ago
It also must imply that the base install has no insecurities, including when you enable a built-in service. Adding 3rd party packages sure: you’ve left “default” behind, but ones installed by the OS? They count imho
spijdar 6y ago
It is "secure by default" but I find that phrase disingenuous when the "default" doesn't really do anything. Sure, it's secure, but that doesn't help me much if I have to immediately make changes that could instantly make it insecure. "Secure by default" would be most meaningful IMO when describing a "fat" OS with services and such already enabled, and configured securely. OpenBSD's "secure by default" is nice and useful so far as you can trust it's extremely unlikely someone will be able to nail you with a 0-day when you're doing your OS install and early setup, but that's the biggest part of that. Not to say OpenBSD doesn't do other secure things. I'm just not impressed by their claim of "secure by default".
- blhack 6y ago
  >"default" doesn't really do anything. This is an unbelievably absurd statement. What do you mean it doesn't """do""" anything? I can boot up my openBSD desktop machine and write computer software, edit graphics, play media files, etc. Basically anything that you would want a computer to do. Before that computer starts interacting with other computers over the network however, I generally have to ask it to. That's GOOD.
  - spijdar 6y ago
    > Basically anything that you would want a computer to do. Some people will be okay playing uncompressed WAV and Sun AU files cat'ed to the audio device. Other people are going to want to play other audio formats. This kind of reasoning is a bit reductionist. Sure, as long as my computer has a compiler and basic interfaces, I can "do anything that you would want a computer to do", given <x> amount of work on my part to re-implement the functionality I want. Unless I want to write my own MP3 decoder, though, I'll need to install 3rd party software from ports. > Before that computer starts interacting with other computers over the network however, I generally have to ask it to. That's GOOD. Right, it is -- but most linux distributions also don't start a lot of network services. Linux has had a few more TCP/IP stack vulnerabilities than OpenBSD, but not many. And of course (mostly) Linux distros uses OpenBSD's SSH package. Your empty Linux install and empty OpenBSD install will, from the network, appear mostly identical. And the bug in Firefox that pops a shell on your system likely won't be either Linux or OpenBSD's fault, but Firefox's.
    - dagw 6y ago
      but most linux distributions also don't start a lot of network services. While that is mostly true today, it certainly didn't used to be. Back when OpenBSD was really earning its security reputation, a default install of Red Hat would be rooted almost as soon as you connected it to the internet.
  - arp242 6y ago
    > I can boot up my openBSD desktop machine and write computer software, edit graphics, play media files, etc. Basically anything that you would want a computer to do. But if mg has a bug allowing malicious files to run code, then this won't increment the"remote holes in the default install"-claim, just to name an example. If I go to the CVE database and search for "Windows 10" or "FreeBSD" then I might find 200 security holes of varying severity, and people will say "Windows 10 has had 200 security problems" Not all those problems will affect everyone, but this is the common-sense way most people would understand it. But OpenBSD has a subtly different definition, and I think this subtly distinction is lost on many. I have nothing against OpenBSD and generally like it, but I always found this claim to be a bit misleading (even though it's technically correct). It's not a meaningless metric though; I remember installing Windows 2000 back in the day and it had malware before I could install the updates. But it is a very incomplete one.
Shish2k 6y ago
By that logic all software is 100% "secure by default" - if I don’t choose to add my own electricity into the equation, then there are no bugs in the running software at all, because no software is running :D It’s technically correct, but a meaningless metric :P
- blhack 6y ago
  It is not even a remotely meaningless metric. OpenBSD doing NOTHING by default is exactly what I want. Somebody said that sshd starts by default, but actually it doesn't unless you specify that you want it to during installation. When you finish an openBSD installation, you are presented with a fully functioning system that will boot up to a shell, which has a networking stack available, and will allow you to then install the things you want. That's what I want a computer to do. I don't want it to start up the kitchen sink unless I ask it to.
  - diffeomorphism 6y ago
    > OpenBSD doing NOTHING by default is exactly what I want. True, but that does not have anything to do with the metric. For example, see https://xkcd.com/641/ https://xkcd.com/641/ . Cereal being asbestos-free is definitely a good thing and "exactly what I want". Yet, people will complain about that advertisement. Or "No vulnerabilities in the webservers turned on by default^1. Also, all default-enabled webservers are giraffes." 1: There are none, so this is true.
jjav 6y ago
Yes, that is "secure by default". It's a very reasonable claim to make. This was a contrast to a fresh install of Windows which would get infected within minutes of being connected to the network (I'm assuming this is no longer true, but have never used windows).
- peteretep 6y ago
  Any OS that shipped OpenSSH earlier than June 2002 could get infected within minutes of being connected to the network, which is basically a set of all Linuxes or their parents.
  - chungus_khan 6y ago
    (and OpenBSD as well)

theonemind 6y ago

As you enable each thing, you have to think about it. Maybe you don't really need it. You probably won't configure whatever as wide open as most vendors do for ease-of-use, but consider your own use case. I mean, historically, some OSes might as well have had the slogan "insecure by default", like Windows XP before service pack 2. Just enable everything and make it wide open. In that era, Linux distributions weren't much different. Possibly, OpenBSD moved the needle in the right direction on that sort of thinking.

enriquto 6y ago

> The reason why it's so controversial is because OpenBSD doesn't actually enable any services by default except for ssh Sounds reasonable. Why is it controversial? Enabling stuff by default is not only in bad taste, it is also insecure.

deepstack 6y ago
exactly. SSH is the only thing needed. BTW, debian with only ssh enabled is also pretty good. Wonder how it stack against openbsd in that regard.
- deleted 6y ago
  [deleted]
spijdar 6y ago
The fact they don't enable services isn't what is controversial, it's the claim that they have "no remote bugs in a heck of a long time" on an install that doesn't enable anything. OpenBSD has shipped several vulnerabilities in other network services included in base, including some which would be commonly enabled like FTP and HTTP daemons. Many Linux distros also don't enable services at boot, and use OpenBSD's SSH client/server. They would essentially be just "as secure" out of the box as OpenBSD is, with the exception of RCE vulnerabilities in the TCP/IP stack of Linux itself, which are about as uncommon as those in OpenBSD itself. Giving you a minimal install base is a nice touch, and I greatly prefer it myself. I do not see it as a great security feature, however, since almost (not all, but almost) everyone will immediately install or configure additional services. OS security should be about mitigating exploits and protecting that other software you're running. OpenBSD does do other things to increase security. I just think their tagline is a touch deceptive.