7 ms·

Generally, I would trust the defaults of FreeBSD more than the defaults of Ubuntu, but FreeBSD may require more setup of any utilities you might be using. But,

Generally, I would trust the defaults of FreeBSD more than the defaults of Ubuntu, but FreeBSD may require more setup of any utilities you might be using. But, I don’t actually know for sure. I plan on using FreeBSD bastions.

bragr 4y ago
The "<x>BSD is more secure by default" argument always falls very flat to me. In addition to being completely unsourced and unsupported (who ever links to a study when they make this claim?), even if it is true, once you've configured your BSD box for use, you're pretty far from the default so I'm not really sure what the claim is even supposed to say. Its fine to like BSD, I just wish people were willing to be honest any say it's based on their personal and philosophical preferences, rather than based on any objective metric.
- rascul 4y ago
  I think the claim might be related to openbsd's claim on their website: > Only two remote holes in the default install, in a heck of a long time! https://www.openbsd.org/ https://www.openbsd.org/ I remember a time when it was zero, not two.
  - spijdar 4y ago
    This isn't really the right place to launch into a full diatribe on this, but for anyone who isn't familiar and may be confused by this claim, I want to point out this specifically refers to the default install with no extra services running. I love BSD based OSes, but I've always found this claim to be a little irritating, because it's far less impressive IMO than it sounds to the uninitiated. It's impressive from the perspective of Windows or Solaris which enable huge numbers of network daemons by default and have both suffered numerous high profile remote vulnerabilities on default installs, but OpenBSD isn't really much different from most Linux distros on this. I'm sure most distros have had more remote vulnerabilities, but not that many. Your average Joe out-of-the-box install of Fedora or Ubuntu doesn't really have any open services IIRC, so an exploit would need to directly target the Linux IP stack, or one of the network autoconfig services if that's in scope.
    - LargoLasskhyfv 4y ago
      This is all correct, but in my not so humble opinion all the BSDs profit from having a more compact and cohesive base, which leads to less cognitive load for the sysadmin. Which you can learn and understand without having to resort to searching crack overflow, or whatever else, if you're so inclined. Which in turn can lead to a better understanding of the 'big picture', and the additional services running atop of it, no matter if they are coming from the base, or have been added afterwards. Not necessarily, but it eases the path to that sort of mindset. I don't see that in any mainstream Linux distribution. There are alternatives, but then you're more or less on your own, necessitating work which could be avoided if some BSD satisfies your needs regarding hardware driver support. At the end of the day it amounts to https://en.wikipedia.org/wiki/The_Cathedral_and_the_Bazaar https://en.wikipedia.org/wiki/The_Cathedral_and_the_Bazaar I'm a grumpy old fart and (usually) don't like chaos.
      - 5e92cb50239222b 4y ago
        A minimal Debian installation (which is easiest to do from the netinstall image, although it can be done from any other by selecting the appropriate option in the installation menu: https://unix.stackexchange.com/a/615465 https://unix.stackexchange.com/a/615465) gets you the most slimmed down system possible without going to something like Alpine. There's nothing to remove there if you want your system to boot at all. No idea why it's not more popular tbh (I setup most systems this way both for security and efficiency reasons). The default installation profiles for most distributions are incredibly bloated in comparison (especially Ubuntu and such).
        LargoLasskhyfv 4y ago
        Dude, I know that screen, I also did the textmode equivalents ;-) Nevertheless any Debian or derivative feels bizarre to me. Yes, I know apt-pinning, custom repos and whatnot. I'm writing this on a derivative booted into 'ramdisk' and running from there for 139 days now. (Oh my Gawd! How dare I?!) Because the good folks from AntiX and MX-Linux made it possible, and did the work for me. Making intelligent use of the facilities Linux can offer. apt-shred dist chainsaw!
tomxor 4y ago
This is untrue in my experience. I've used FreeBSD a fair bit in the past and Ubuntu and Debian more continuously. Unless something radically changed recently. My experience is about 6-8 years old now but FreeBSD requires a lot more configuration when setting up common services, whereas Ubuntu and even Debian have good defaults that you can usually bring up without having to first consume the entire manual for that service. There's probably a reasonable sounding argument buried behind this like "you cannot run a service securely if you do not fully understand the configuration first." but in practice this just results in poor initial configurations because it takes time to fully understand all of the knobs of configuration on a service. FreeBSD can be a solid system, but it's less practical in many ways for reasons like this.
- lstodd 4y ago
  This is untrue in my experience. I was using FreeBSD as my desktop for almost 15 years, since the 4.1 times, and the amount of work it took to make some sane vpn client out of an ubuntu is nowhere near what I had as my griefs with FreeBSD back then. Not even mentioning pf vs iptables and how 20(?) years passed before linux had something comparable like nftables. Nowadays it's mostly fine, but.. Case in point : I had to write and contribute wireguard support to the netplan to make it marginally sane.
  - tomxor 4y ago
    I sense that we might be basing our conclusion on qualitatively and temporally different things. My limited experience with FreeBSD was as a desktop and server for a few years around 2009ish to 2012, but also as a basic user of basic services. From memory a lot more hoops had to be jumped to get equivalent things working on FreeBSD, and I was always left with a nagging feeling after initial setup on FreeBSD that I didn't yet know enough to feel confident in the configurations I had produced, compared to Debian and et al at the time, where configuration felt like they left the bare minimum for you to customise, and working defaults for the rest that you could gradually learn to tweak without the pressure of getting every variable correct from the get go. However as a user who already thoroughly understands the service or it's domain I expect this kind of detail may be lost... instead you can compare based more on the flaws of the configurations and their implementations (which I suspect applies to your experience). But for the rest of us it results in flaky custom initial configuration. It's the same for me if I pick out a piece of software now that I have become very familiar with and already know how to configure inside out - i wouldn't experience the same kind of problem that someone unfamiliar would. To clarify, I guess I'm talking about sane defaults from the perspective of new users, poor defaults combined with new users can end up with insecure or problematic results - even if the default configuration alone is technically fine. I expect Linux and FreeBSD and other BSDs have likely improved a lot over the last decade from either perspective anyway.

bragr 4y ago

The "<x>BSD is more secure by default" argument always falls very flat to me. In addition to being completely unsourced and unsupported (who ever links to a study when they make this claim?), even if it is true, once you've configured your BSD box for use, you're pretty far from the default so I'm not really sure what the claim is even supposed to say. Its fine to like BSD, I just wish people were willing to be honest any say it's based on their personal and philosophical preferences, rather than based on any objective metric.

rascul 4y ago
I think the claim might be related to openbsd's claim on their website: > Only two remote holes in the default install, in a heck of a long time! https://www.openbsd.org/ https://www.openbsd.org/ I remember a time when it was zero, not two.
- spijdar 4y ago
  This isn't really the right place to launch into a full diatribe on this, but for anyone who isn't familiar and may be confused by this claim, I want to point out this specifically refers to the default install with no extra services running. I love BSD based OSes, but I've always found this claim to be a little irritating, because it's far less impressive IMO than it sounds to the uninitiated. It's impressive from the perspective of Windows or Solaris which enable huge numbers of network daemons by default and have both suffered numerous high profile remote vulnerabilities on default installs, but OpenBSD isn't really much different from most Linux distros on this. I'm sure most distros have had more remote vulnerabilities, but not that many. Your average Joe out-of-the-box install of Fedora or Ubuntu doesn't really have any open services IIRC, so an exploit would need to directly target the Linux IP stack, or one of the network autoconfig services if that's in scope.
  - LargoLasskhyfv 4y ago
    This is all correct, but in my not so humble opinion all the BSDs profit from having a more compact and cohesive base, which leads to less cognitive load for the sysadmin. Which you can learn and understand without having to resort to searching crack overflow, or whatever else, if you're so inclined. Which in turn can lead to a better understanding of the 'big picture', and the additional services running atop of it, no matter if they are coming from the base, or have been added afterwards. Not necessarily, but it eases the path to that sort of mindset. I don't see that in any mainstream Linux distribution. There are alternatives, but then you're more or less on your own, necessitating work which could be avoided if some BSD satisfies your needs regarding hardware driver support. At the end of the day it amounts to https://en.wikipedia.org/wiki/The_Cathedral_and_the_Bazaar https://en.wikipedia.org/wiki/The_Cathedral_and_the_Bazaar I'm a grumpy old fart and (usually) don't like chaos.
    - 5e92cb50239222b 4y ago
      A minimal Debian installation (which is easiest to do from the netinstall image, although it can be done from any other by selecting the appropriate option in the installation menu: https://unix.stackexchange.com/a/615465 https://unix.stackexchange.com/a/615465) gets you the most slimmed down system possible without going to something like Alpine. There's nothing to remove there if you want your system to boot at all. No idea why it's not more popular tbh (I setup most systems this way both for security and efficiency reasons). The default installation profiles for most distributions are incredibly bloated in comparison (especially Ubuntu and such).
      - LargoLasskhyfv 4y ago
        Dude, I know that screen, I also did the textmode equivalents ;-) Nevertheless any Debian or derivative feels bizarre to me. Yes, I know apt-pinning, custom repos and whatnot. I'm writing this on a derivative booted into 'ramdisk' and running from there for 139 days now. (Oh my Gawd! How dare I?!) Because the good folks from AntiX and MX-Linux made it possible, and did the work for me. Making intelligent use of the facilities Linux can offer. apt-shred dist chainsaw!

tomxor 4y ago

This is untrue in my experience. I've used FreeBSD a fair bit in the past and Ubuntu and Debian more continuously. Unless something radically changed recently. My experience is about 6-8 years old now but FreeBSD requires a lot more configuration when setting up common services, whereas Ubuntu and even Debian have good defaults that you can usually bring up without having to first consume the entire manual for that service. There's probably a reasonable sounding argument buried behind this like "you cannot run a service securely if you do not fully understand the configuration first." but in practice this just results in poor initial configurations because it takes time to fully understand all of the knobs of configuration on a service. FreeBSD can be a solid system, but it's less practical in many ways for reasons like this.

lstodd 4y ago
This is untrue in my experience. I was using FreeBSD as my desktop for almost 15 years, since the 4.1 times, and the amount of work it took to make some sane vpn client out of an ubuntu is nowhere near what I had as my griefs with FreeBSD back then. Not even mentioning pf vs iptables and how 20(?) years passed before linux had something comparable like nftables. Nowadays it's mostly fine, but.. Case in point : I had to write and contribute wireguard support to the netplan to make it marginally sane.
- tomxor 4y ago
  I sense that we might be basing our conclusion on qualitatively and temporally different things. My limited experience with FreeBSD was as a desktop and server for a few years around 2009ish to 2012, but also as a basic user of basic services. From memory a lot more hoops had to be jumped to get equivalent things working on FreeBSD, and I was always left with a nagging feeling after initial setup on FreeBSD that I didn't yet know enough to feel confident in the configurations I had produced, compared to Debian and et al at the time, where configuration felt like they left the bare minimum for you to customise, and working defaults for the rest that you could gradually learn to tweak without the pressure of getting every variable correct from the get go. However as a user who already thoroughly understands the service or it's domain I expect this kind of detail may be lost... instead you can compare based more on the flaws of the configurations and their implementations (which I suspect applies to your experience). But for the rest of us it results in flaky custom initial configuration. It's the same for me if I pick out a piece of software now that I have become very familiar with and already know how to configure inside out - i wouldn't experience the same kind of problem that someone unfamiliar would. To clarify, I guess I'm talking about sane defaults from the perspective of new users, poor defaults combined with new users can end up with insecure or problematic results - even if the default configuration alone is technically fine. I expect Linux and FreeBSD and other BSDs have likely improved a lot over the last decade from either perspective anyway.