3 ms·

> The reason why it's so controversial is because OpenBSD doesn't actually enable any services by default except for ssh Sounds reasonable. Why is it controve

• deepstack 6y ago
  exactly. SSH is the only thing needed. BTW, debian with only ssh enabled is also pretty good. Wonder how it stack against openbsd in that regard.
  • deleted 6y ago
    [deleted]
• spijdar 6y ago
  The fact they don't enable services isn't what is controversial, it's the claim that they have "no remote bugs in a heck of a long time" on an install that doesn't enable anything. OpenBSD has shipped several vulnerabilities in other network services included in base, including some which would be commonly enabled like FTP and HTTP daemons. Many Linux distros also don't enable services at boot, and use OpenBSD's SSH client/server. They would essentially be just "as secure" out of the box as OpenBSD is, with the exception of RCE vulnerabilities in the TCP/IP stack of Linux itself, which are about as uncommon as those in OpenBSD itself. Giving you a minimal install base is a nice touch, and I greatly prefer it myself. I do not see it as a great security feature, however, since almost (not all, but almost) everyone will immediately install or configure additional services. OS security should be about mitigating exploits and protecting that other software you're running. OpenBSD does do other things to increase security. I just think their tagline is a touch deceptive.