5 ms·

Yes, my point exactly. Disk encryption wasn't even part of the default install flow before. You had to go out of your way to find documentation, understand how

by aspyct 4y ago

Yes, my point exactly. Disk encryption wasn't even part of the default install flow before. You had to go out of your way to find documentation, understand how to run it, find some more documentation, get "RTFM" replies on their IRC channel. Doesn't seem very secure by default to me.

prmoustache 4y ago
At least they gave you a refund.
- aspyct 4y ago
  Lol, that's the default response when people complain about other people being rude and not having paid something. Look, I was just trying OpenBSD with an open mind, and I met people who were unhelpful. Even in the street if I asked someone for the time and he said "get a watch", it would be rude. I understand that they don't want to help. But do they need to be rude about it?
nix23 4y ago
>Doesn't seem very secure by default to me. If you don't understand a system it's by definition not secure, keep your hands away or start learning your stuff, or at least don't call it secure (the big word that includes many different meanings)
Zurrrrr 4y ago
"secure by default" by OBSD basically just means everything disabled by default. Can't hack anything if nothing is running, right? Only issue is it's not that useable either.
- camgunz 4y ago
  You've made a few comments implying that if OpenBSD ran some common services by default attackers would get remote root and nothing would stop them. But their services have a pretty good track record: - OpenSMTPd: 2 remote holes in 10 years - OpenSSH: 1 remote hole in 10 years - httpd: No remote vulns - relayd: No remote vulns What are you looking at that makes you confident that if OpenBSD ran these by default (which I think is a bad idea in general) they'd have a significantly worse security history?
  - Zurrrrr 4y ago
    I don't mean to imply that if OpenBSD ran those specific services by default that it would be much worse. My point is that: a) Generally for a server people are running some kind of services, and that's going to include third party software. Not always, but often, and that software is not audited by OBSD team. Even say adding a module to httpd may allow for remote compromise and b) That the tools OpenBSD provides for dealing with an attacker who has managed to gain remote access are insufficient compared to what is available, and especially insufficient for an OS that claims to be focused on security.
    - camgunz 4y ago
      > Generally for a server people are running some kind of services, and that's going to include third party software. Oh so you're saying that things like ASLR, chrooting, and safe programming practices aren't useful in things like httpd, because you might run an insecure PHP app, and the only thing that helps you then is something like SELinux? I think that's pretty wrong. Running services in a chroot with pledge gives you a lot of security. And the other security features [0] (empirically) help reduce the occurrence of remote vulns overall with far less complexity than SELinux (which also totally weirds your system). [0]: https://www.openbsd.org/innovations.html https://www.openbsd.org/innovations.html
      - Zurrrrr 4y ago
        > Oh so you're saying that things like ASLR, chrooting, and safe programming practices aren't useful in things like httpd, because you might run an insecure PHP app, and the only thing that helps you then is something like SELinux? You sure put in a lot of effort to misconstruing me there. So many people in this thread who are responding emotionally and without the knowledge to really have a proper discussion. Instead of trying to defend pledge, maybe do some more reading on SELinux and understand just how fundamentally different the approaches are, and why pledge just can't compare.
        camgunz 4y ago
yjftsjthsd-h 4y ago
I don't know man, if you weren't going to read the documentation then what are the odds that the system was ever going to be secure for you?
2b3a51 4y ago
Has been in the 'disk setup' part of the FAQ for quite a long time I think. Do you have special requirements e.g. external key disk or something unusual?

by aspyct 4y ago

prmoustache 4y ago

At least they gave you a refund.

aspyct 4y ago
Lol, that's the default response when people complain about other people being rude and not having paid something. Look, I was just trying OpenBSD with an open mind, and I met people who were unhelpful. Even in the street if I asked someone for the time and he said "get a watch", it would be rude. I understand that they don't want to help. But do they need to be rude about it?

nix23 4y ago

>Doesn't seem very secure by default to me. If you don't understand a system it's by definition not secure, keep your hands away or start learning your stuff, or at least don't call it secure (the big word that includes many different meanings)

Zurrrrr 4y ago

"secure by default" by OBSD basically just means everything disabled by default. Can't hack anything if nothing is running, right? Only issue is it's not that useable either.

camgunz 4y ago
You've made a few comments implying that if OpenBSD ran some common services by default attackers would get remote root and nothing would stop them. But their services have a pretty good track record: - OpenSMTPd: 2 remote holes in 10 years - OpenSSH: 1 remote hole in 10 years - httpd: No remote vulns - relayd: No remote vulns What are you looking at that makes you confident that if OpenBSD ran these by default (which I think is a bad idea in general) they'd have a significantly worse security history?
- Zurrrrr 4y ago
  I don't mean to imply that if OpenBSD ran those specific services by default that it would be much worse. My point is that: a) Generally for a server people are running some kind of services, and that's going to include third party software. Not always, but often, and that software is not audited by OBSD team. Even say adding a module to httpd may allow for remote compromise and b) That the tools OpenBSD provides for dealing with an attacker who has managed to gain remote access are insufficient compared to what is available, and especially insufficient for an OS that claims to be focused on security.
  - camgunz 4y ago
    > Generally for a server people are running some kind of services, and that's going to include third party software. Oh so you're saying that things like ASLR, chrooting, and safe programming practices aren't useful in things like httpd, because you might run an insecure PHP app, and the only thing that helps you then is something like SELinux? I think that's pretty wrong. Running services in a chroot with pledge gives you a lot of security. And the other security features [0] (empirically) help reduce the occurrence of remote vulns overall with far less complexity than SELinux (which also totally weirds your system). [0]: https://www.openbsd.org/innovations.html https://www.openbsd.org/innovations.html
    - Zurrrrr 4y ago
      > Oh so you're saying that things like ASLR, chrooting, and safe programming practices aren't useful in things like httpd, because you might run an insecure PHP app, and the only thing that helps you then is something like SELinux? You sure put in a lot of effort to misconstruing me there. So many people in this thread who are responding emotionally and without the knowledge to really have a proper discussion. Instead of trying to defend pledge, maybe do some more reading on SELinux and understand just how fundamentally different the approaches are, and why pledge just can't compare.
      - camgunz 4y ago

yjftsjthsd-h 4y ago

I don't know man, if you weren't going to read the documentation then what are the odds that the system was ever going to be secure for you?

2b3a51 4y ago

Has been in the 'disk setup' part of the FAQ for quite a long time I think. Do you have special requirements e.g. external key disk or something unusual?