6 ms·

It is "secure by default" but I find that phrase disingenuous when the "default" doesn't really do anything. Sure, it's secure, but that doesn't help me much if

It is "secure by default" but I find that phrase disingenuous when the "default" doesn't really do anything. Sure, it's secure, but that doesn't help me much if I have to immediately make changes that could instantly make it insecure. "Secure by default" would be most meaningful IMO when describing a "fat" OS with services and such already enabled, and configured securely. OpenBSD's "secure by default" is nice and useful so far as you can trust it's extremely unlikely someone will be able to nail you with a 0-day when you're doing your OS install and early setup, but that's the biggest part of that. Not to say OpenBSD doesn't do other secure things. I'm just not impressed by their claim of "secure by default".

blhack 6y ago
>"default" doesn't really do anything. This is an unbelievably absurd statement. What do you mean it doesn't """do""" anything? I can boot up my openBSD desktop machine and write computer software, edit graphics, play media files, etc. Basically anything that you would want a computer to do. Before that computer starts interacting with other computers over the network however, I generally have to ask it to. That's GOOD.
- spijdar 6y ago
  > Basically anything that you would want a computer to do. Some people will be okay playing uncompressed WAV and Sun AU files cat'ed to the audio device. Other people are going to want to play other audio formats. This kind of reasoning is a bit reductionist. Sure, as long as my computer has a compiler and basic interfaces, I can "do anything that you would want a computer to do", given <x> amount of work on my part to re-implement the functionality I want. Unless I want to write my own MP3 decoder, though, I'll need to install 3rd party software from ports. > Before that computer starts interacting with other computers over the network however, I generally have to ask it to. That's GOOD. Right, it is -- but most linux distributions also don't start a lot of network services. Linux has had a few more TCP/IP stack vulnerabilities than OpenBSD, but not many. And of course (mostly) Linux distros uses OpenBSD's SSH package. Your empty Linux install and empty OpenBSD install will, from the network, appear mostly identical. And the bug in Firefox that pops a shell on your system likely won't be either Linux or OpenBSD's fault, but Firefox's.
  - dagw 6y ago
    but most linux distributions also don't start a lot of network services. While that is mostly true today, it certainly didn't used to be. Back when OpenBSD was really earning its security reputation, a default install of Red Hat would be rooted almost as soon as you connected it to the internet.
- arp242 6y ago
  > I can boot up my openBSD desktop machine and write computer software, edit graphics, play media files, etc. Basically anything that you would want a computer to do. But if mg has a bug allowing malicious files to run code, then this won't increment the"remote holes in the default install"-claim, just to name an example. If I go to the CVE database and search for "Windows 10" or "FreeBSD" then I might find 200 security holes of varying severity, and people will say "Windows 10 has had 200 security problems" Not all those problems will affect everyone, but this is the common-sense way most people would understand it. But OpenBSD has a subtly different definition, and I think this subtly distinction is lost on many. I have nothing against OpenBSD and generally like it, but I always found this claim to be a bit misleading (even though it's technically correct). It's not a meaningless metric though; I remember installing Windows 2000 back in the day and it had malware before I could install the updates. But it is a very incomplete one.
flomo 6y ago
OpenBSD's "secure by default" slogan dates back to the days when you could install Windows NT/2000 or RedHat Linux or whatever UNIX from the CD-ROM, and end up with several very optional "exploitable by default" services running in the background. It might not seem like a huge claim now, but it was actually extremely influential and operating systems now ship with inessential services turned off.
- deleted 6y ago
  [deleted]
- pjmlp 6y ago
  Platforms like Tru64 did it first.

blhack 6y ago

>"default" doesn't really do anything. This is an unbelievably absurd statement. What do you mean it doesn't """do""" anything? I can boot up my openBSD desktop machine and write computer software, edit graphics, play media files, etc. Basically anything that you would want a computer to do. Before that computer starts interacting with other computers over the network however, I generally have to ask it to. That's GOOD.

spijdar 6y ago
> Basically anything that you would want a computer to do. Some people will be okay playing uncompressed WAV and Sun AU files cat'ed to the audio device. Other people are going to want to play other audio formats. This kind of reasoning is a bit reductionist. Sure, as long as my computer has a compiler and basic interfaces, I can "do anything that you would want a computer to do", given <x> amount of work on my part to re-implement the functionality I want. Unless I want to write my own MP3 decoder, though, I'll need to install 3rd party software from ports. > Before that computer starts interacting with other computers over the network however, I generally have to ask it to. That's GOOD. Right, it is -- but most linux distributions also don't start a lot of network services. Linux has had a few more TCP/IP stack vulnerabilities than OpenBSD, but not many. And of course (mostly) Linux distros uses OpenBSD's SSH package. Your empty Linux install and empty OpenBSD install will, from the network, appear mostly identical. And the bug in Firefox that pops a shell on your system likely won't be either Linux or OpenBSD's fault, but Firefox's.
- dagw 6y ago
  but most linux distributions also don't start a lot of network services. While that is mostly true today, it certainly didn't used to be. Back when OpenBSD was really earning its security reputation, a default install of Red Hat would be rooted almost as soon as you connected it to the internet.
arp242 6y ago
> I can boot up my openBSD desktop machine and write computer software, edit graphics, play media files, etc. Basically anything that you would want a computer to do. But if mg has a bug allowing malicious files to run code, then this won't increment the"remote holes in the default install"-claim, just to name an example. If I go to the CVE database and search for "Windows 10" or "FreeBSD" then I might find 200 security holes of varying severity, and people will say "Windows 10 has had 200 security problems" Not all those problems will affect everyone, but this is the common-sense way most people would understand it. But OpenBSD has a subtly different definition, and I think this subtly distinction is lost on many. I have nothing against OpenBSD and generally like it, but I always found this claim to be a bit misleading (even though it's technically correct). It's not a meaningless metric though; I remember installing Windows 2000 back in the day and it had malware before I could install the updates. But it is a very incomplete one.

flomo 6y ago

OpenBSD's "secure by default" slogan dates back to the days when you could install Windows NT/2000 or RedHat Linux or whatever UNIX from the CD-ROM, and end up with several very optional "exploitable by default" services running in the background. It might not seem like a huge claim now, but it was actually extremely influential and operating systems now ship with inessential services turned off.

deleted 6y ago
[deleted]
pjmlp 6y ago
Platforms like Tru64 did it first.