4 ms·

Relevant article: https://isopenbsdsecu.re/about/ https://isopenbsdsecu.re/about/ I don't have a strong opinion about it myself, but the security aspect of Ope

Relevant article: https://isopenbsdsecu.re/about/ https://isopenbsdsecu.re/about/ I don't have a strong opinion about it myself, but the security aspect of OpenBSD is not as obvious as some people make it out to be.

zshrc 2y ago
So I can only give a recent example of pinsyscalls(2), which associate a system call to a specific memory address to prevent return-to-libc attacks. It's subtle system/OS stuff that make it secure. You throw that out the window installing third party apps though... OpenBSD is best served pure if security is your main angle.
wolverine876 2y ago
The purpose of that website is to take down OpenBSD's reputation for security.
- logicprog 2y ago
  Well obviously. The question is, are they wrong to do so?
  - whiterknight 2y ago
    Actually their stated reason for making the site is that they don’t like the politics of openbsd devs > Because the OpenBSD community is notorious for not being nice and welcoming:
    - logicprog 2y ago
      That's not their reason for believing that obsd isn't as secure as claimed or that their development practices are bad, however, that's just their reason for not directly coming to the obsd developers with the issues instead of just making the problems public for other people to make their own choice about. And it isn't about the politics of the obsd developers, as I would have thought that website would have made abundantly clear, it's about the fact that the obsd developers are extremely prideful and unwilling to listen to other people's input and have crank-like is used concerning security according to most security professionals, so it would simply be unproductive to come to them with these issues. So your attempt to insinuate that this website is purely dunking on obsd because their community is insufficiently inclusive or progressive or whatever and has no actual technical merit to it is simply wrong and misleading.
      - whiterknight 2y ago
        > however, that's just their reason for not directly coming to the obsd developers In other words they intend to hurt the reputation of people they don’t like rather than fix problems. They literally said, the website would not exist but for spite. > obsd developers are extremely prideful and unwilling to listen to other people's input That describes these sideline critics well. If you show the devs a vulnerability you don’t think they will fix it? > has no actual technical merit Well that’s ok because I’m talking about a social problem.
  - ranger_danger 2y ago
    I think it's impossible to tell because there's not enough people who are smart enough to prove that who care enough to do so AND who enough other people will believe. For example, half the people I ask consider Whonix dev Madaidan (and his thoughts on OpenBSD security: https://web.archive.org/web/20220227172102/https://madaidans-insecurities.github.io/openbsd.html https://web.archive.org/web/20220227172102/https://madaidans...) to be wrong, while the other half think he's right. There's no majority consensus because everyone thinks they know better.
    - logicprog 2y ago
      Madaidan is a bit of a mixed bag in my opinion — they are probably mostly factually correct in their statement about everything in my opinion, but it seems like they are deeply unfair to Linux (praising other OSes for things they've barely done and then criticizing Linux for barely doing those same things) and have fallen for the flatpak FUD. In the case of their opinion on obsd, I think they seem correct, and their opinion lines up with the other website criticizing obsd so there's that. But you're right, it's hard to know as a layperson.

zshrc 2y ago

So I can only give a recent example of pinsyscalls(2), which associate a system call to a specific memory address to prevent return-to-libc attacks. It's subtle system/OS stuff that make it secure. You throw that out the window installing third party apps though... OpenBSD is best served pure if security is your main angle.

wolverine876 2y ago

The purpose of that website is to take down OpenBSD's reputation for security.

logicprog 2y ago
Well obviously. The question is, are they wrong to do so?
- whiterknight 2y ago
  Actually their stated reason for making the site is that they don’t like the politics of openbsd devs > Because the OpenBSD community is notorious for not being nice and welcoming:
  - logicprog 2y ago
    That's not their reason for believing that obsd isn't as secure as claimed or that their development practices are bad, however, that's just their reason for not directly coming to the obsd developers with the issues instead of just making the problems public for other people to make their own choice about. And it isn't about the politics of the obsd developers, as I would have thought that website would have made abundantly clear, it's about the fact that the obsd developers are extremely prideful and unwilling to listen to other people's input and have crank-like is used concerning security according to most security professionals, so it would simply be unproductive to come to them with these issues. So your attempt to insinuate that this website is purely dunking on obsd because their community is insufficiently inclusive or progressive or whatever and has no actual technical merit to it is simply wrong and misleading.
    - whiterknight 2y ago
      > however, that's just their reason for not directly coming to the obsd developers In other words they intend to hurt the reputation of people they don’t like rather than fix problems. They literally said, the website would not exist but for spite. > obsd developers are extremely prideful and unwilling to listen to other people's input That describes these sideline critics well. If you show the devs a vulnerability you don’t think they will fix it? > has no actual technical merit Well that’s ok because I’m talking about a social problem.
- ranger_danger 2y ago
  I think it's impossible to tell because there's not enough people who are smart enough to prove that who care enough to do so AND who enough other people will believe. For example, half the people I ask consider Whonix dev Madaidan (and his thoughts on OpenBSD security: https://web.archive.org/web/20220227172102/https://madaidans-insecurities.github.io/openbsd.html https://web.archive.org/web/20220227172102/https://madaidans...) to be wrong, while the other half think he's right. There's no majority consensus because everyone thinks they know better.
  - logicprog 2y ago
    Madaidan is a bit of a mixed bag in my opinion — they are probably mostly factually correct in their statement about everything in my opinion, but it seems like they are deeply unfair to Linux (praising other OSes for things they've barely done and then criticizing Linux for barely doing those same things) and have fallen for the flatpak FUD. In the case of their opinion on obsd, I think they seem correct, and their opinion lines up with the other website criticizing obsd so there's that. But you're right, it's hard to know as a layperson.