4 ms·

It's easy to claim "no remote holes in the default install" if said install has extremely limited functionality. By the time you've configured your M1 system w

by na85 6y ago

It's easy to claim "no remote holes in the default install" if said install has extremely limited functionality. By the time you've configured your M1 system with a desktop environment and everything that goes with, you're well past their security promises.

tobiasu 6y ago
Can you guys put a little effort into your trolling? At this point it's more stale than CVS.
midev 6y ago
You still have things like memory protection, and I think a hardened X11, and a bunch of other stuff that improve security.
chungy 6y ago
The line has to be drawn somewhere. The default install with default settings is a reasonable enough one. Consider that Linux distros and Windows frequently have remote exploits in their default-install/default-state systems. One can enable services and misconfigure a base system to have remote exploits (is enabling telnet and not having a root password a fault of OpenBSD, or the admin?). Once you start installing software from ports (as you're likely to do to use it as a desktop), are you going to blame the OpenBSD guys for the quality of software outside of their control? I hope not. :)
- na85 6y ago
  >are you going to blame the OpenBSD guys for the quality of software outside of their control? Of course not, that's my point. In order to make an OpenBSD system usable for more than a rudimentary firewall, you need to step beyond the security claims that OpenBSD makes. So the "only two holes" track record doesn't really mean much if you're installing software from ports, which nearly everyone does.
  - IcePic 6y ago
    I still don't get it. The alternative would be for all OSes to run services X,Y and Z even if you install it in order to host service W. Also, you would then be "happy" to get remote rooted on your W service box, when attackers found an exploit in Y, just so that the box was not "empty" of services? Even if you meant to run service X or Z, it would still be "better" to have the exploitable Y running by default, just so the system wasn't bare or so that they could not have that line on the webpage? If you don't want to get exploited by default when you put your box on the internet, and these people have a method to get you there AND others tried running all fancy services exposed and did get hacked within minutes after putting such a box on the internet, would you still say "not exposing your box immediately" is a bad idea? Is it cheating somehow to not participate in the race to the bottom?
  - worik 6y ago
    A simple, reliable, and secure "rudimentary" firewall in 2021 is very useful. The security promise "best effort", they do not make guarantees, is very useful I really do not see a problem
  - gbrown_ 6y ago
    I would not conflate the tag line about remote holes in the default install with the security features OpenBSD provides [1]. Of which both base and ports benefit from, not to mention the patches for things like Chrome and Firefox to make use of pledge(2) and unveil(2). [1] https://www.openbsd.org/innovations.html https://www.openbsd.org/innovations.html
mgreenleaf 6y ago
I run a lot of OpenBSD servers using either only base (httpd + pf + relayd) or base + software I write with minimal dependencies. The security in base is excellent for that. I don't have a desktop environment on my servers. It is easy to upgrade these, and I get very good security & configuration. So, for my use case, having "no remote holes in the default install" is exactly what I want and need. YMMV.
nix23 5y ago
It's faster then installing fedora, search for VirtualBox and have to manually sign the virtualbox modules (secureboot). Thanks Redhat for not including it.
egberts1 5y ago
There is currently no way to block systemd from using the network ports. Linux firewall can’t even block systemd from doing that but OpenBSD can. And CVEs continue to be racking up against systemd. Hence, it’s either Linux (and it’s unhardened kernel settings) with openrc or OpenBSD with systemd.

by na85 6y ago

tobiasu 6y ago

Can you guys put a little effort into your trolling? At this point it's more stale than CVS.

midev 6y ago

You still have things like memory protection, and I think a hardened X11, and a bunch of other stuff that improve security.

chungy 6y ago

The line has to be drawn somewhere. The default install with default settings is a reasonable enough one. Consider that Linux distros and Windows frequently have remote exploits in their default-install/default-state systems. One can enable services and misconfigure a base system to have remote exploits (is enabling telnet and not having a root password a fault of OpenBSD, or the admin?). Once you start installing software from ports (as you're likely to do to use it as a desktop), are you going to blame the OpenBSD guys for the quality of software outside of their control? I hope not. :)

na85 6y ago
>are you going to blame the OpenBSD guys for the quality of software outside of their control? Of course not, that's my point. In order to make an OpenBSD system usable for more than a rudimentary firewall, you need to step beyond the security claims that OpenBSD makes. So the "only two holes" track record doesn't really mean much if you're installing software from ports, which nearly everyone does.
- IcePic 6y ago
  I still don't get it. The alternative would be for all OSes to run services X,Y and Z even if you install it in order to host service W. Also, you would then be "happy" to get remote rooted on your W service box, when attackers found an exploit in Y, just so that the box was not "empty" of services? Even if you meant to run service X or Z, it would still be "better" to have the exploitable Y running by default, just so the system wasn't bare or so that they could not have that line on the webpage? If you don't want to get exploited by default when you put your box on the internet, and these people have a method to get you there AND others tried running all fancy services exposed and did get hacked within minutes after putting such a box on the internet, would you still say "not exposing your box immediately" is a bad idea? Is it cheating somehow to not participate in the race to the bottom?
- worik 6y ago
  A simple, reliable, and secure "rudimentary" firewall in 2021 is very useful. The security promise "best effort", they do not make guarantees, is very useful I really do not see a problem
- gbrown_ 6y ago
  I would not conflate the tag line about remote holes in the default install with the security features OpenBSD provides [1]. Of which both base and ports benefit from, not to mention the patches for things like Chrome and Firefox to make use of pledge(2) and unveil(2). [1] https://www.openbsd.org/innovations.html https://www.openbsd.org/innovations.html

mgreenleaf 6y ago

I run a lot of OpenBSD servers using either only base (httpd + pf + relayd) or base + software I write with minimal dependencies. The security in base is excellent for that. I don't have a desktop environment on my servers. It is easy to upgrade these, and I get very good security & configuration. So, for my use case, having "no remote holes in the default install" is exactly what I want and need. YMMV.

nix23 5y ago

It's faster then installing fedora, search for VirtualBox and have to manually sign the virtualbox modules (secureboot). Thanks Redhat for not including it.

egberts1 5y ago

There is currently no way to block systemd from using the network ports. Linux firewall can’t even block systemd from doing that but OpenBSD can. And CVEs continue to be racking up against systemd. Hence, it’s either Linux (and it’s unhardened kernel settings) with openrc or OpenBSD with systemd.