3 ms·

Anything that you can buy off the shelf is compromised. I use OpenBSD on all my edge devices. It's not perfect but it is superior to 99% of everything else.

Anything that you can buy off the shelf is compromised. I use OpenBSD on all my edge devices. It's not perfect but it is superior to 99% of everything else. That combined with poisoning the replies to nmap scans (fingerprinting) puts me in the 'much harder' to compromise category. "Security through obscurity" isn't security. But "Don't be where your enemies expect you to be" is still good advice. Also, relying on 1 layer of security is insanity. You need multiple layers, you need isolation.

puffybuf 2y ago
I highly recommend OpenBSD for firewalls, vpn (wireguard), and other edge servers. It has served me well. I love how everything is organized.
- fmajid 2y ago
  The only caveat is limited WiFi support, essentially not 802.11ac or later, so you will need a separate AP.
  - Joel_Mckay 2y ago
    Most wifi driver firmware is full of remote exploits, and still should never be connected to secure LANs. =3
    - fmajid 2y ago
      Yes. I used a Huawei 5G router as cellular backup on my home network OpenBSD router/firewall but I ran Wireguard over it because I trust neither Huawei nor my cellular provider.
BLKNSLVR 2y ago
I'm not quite as hardcore in that I use OPNSense (FreeBSD-based), but I still rate that as a good level above consumer-level and ISP-provided modems / routers. I'm not sure what vulnerabilities I have from the Ali Express multi-LAN-port hardware that OPNSense runs on, but I don't have the motivation / money for nation-state level paranoia.
Joel_Mckay 2y ago
The myth BSD is more secure comes from the frequency of unreported zero day exploits. One of my former managers ran the platform for years... right up until the institutional router was compromised. The lesson here is that if the device was made by an external firm, than the responsibility wouldn't have fallen on him politically. One may assume it is operator/administrative error, but this guy wasn't YOLO'ing by any stretch of the imagination. He was replaced 3 months later for unspecified reasons. Critical systems are a different problem domain with different rules. =3

puffybuf 2y ago

I highly recommend OpenBSD for firewalls, vpn (wireguard), and other edge servers. It has served me well. I love how everything is organized.

fmajid 2y ago
The only caveat is limited WiFi support, essentially not 802.11ac or later, so you will need a separate AP.
- Joel_Mckay 2y ago
  Most wifi driver firmware is full of remote exploits, and still should never be connected to secure LANs. =3
  - fmajid 2y ago
    Yes. I used a Huawei 5G router as cellular backup on my home network OpenBSD router/firewall but I ran Wireguard over it because I trust neither Huawei nor my cellular provider.

BLKNSLVR 2y ago

I'm not quite as hardcore in that I use OPNSense (FreeBSD-based), but I still rate that as a good level above consumer-level and ISP-provided modems / routers. I'm not sure what vulnerabilities I have from the Ali Express multi-LAN-port hardware that OPNSense runs on, but I don't have the motivation / money for nation-state level paranoia.

Joel_Mckay 2y ago

The myth BSD is more secure comes from the frequency of unreported zero day exploits. One of my former managers ran the platform for years... right up until the institutional router was compromised. The lesson here is that if the device was made by an external firm, than the responsibility wouldn't have fallen on him politically. One may assume it is operator/administrative error, but this guy wasn't YOLO'ing by any stretch of the imagination. He was replaced 3 months later for unspecified reasons. Critical systems are a different problem domain with different rules. =3