6 ms·
With all the security issues constantly being uncovered in other Operating Systems - which will only accelerate with Ai - it’s time everyone considers OpenBSD.
by nelsonic 4mo ago
With all the security issues constantly being uncovered in other Operating Systems - which will only accelerate with Ai - it’s time everyone considers OpenBSD. Their decades-long security-focus is second to none. We have fully converted from Ubuntu/Debian to OpenBSD. No looking back.
- ykurtov 4mo agoWhat? How long did it take?
- nelsonic 4mo agoHow long did what take? Learning the essentials of OpenBSD, budget 4-6hours. Switching over servers from Ubuntu, an hour for the first one then 10mins each after that. You can copy config with your favourite tools; most have ports for OpenBSD already. If you want to learn more in-depth, read: Michael W. Lucas Absolute OpenBSD, 2nd Edition: Unix for the Practical Paranoid. Highly recommend it as teaches many fundamentals most software engineers skip.
- reidrac 4mo agoHow many upgrades have you done so far? And how many kernel fixes? Long time ago I maintained a couple of obsd servers, and the cost in time of upgrades and the (occasional) security fixes was substantial. I still maintain a couple of servers, but if it wasn't because Debian makes it easier by automating most of it, I don't think I could do it. Yet I miss my time with obsd. I'm very interested in your experience. Edit: it was 3.6-STABLE. Things have changed since then.
- rs_rs_rs_rs_rs 4mo ago>it’s time everyone considers OpenBSD https://x.com/ortegaalfredo/status/2055362910415671459 https://x.com/ortegaalfredo/status/2055362910415671459 When your super secure feature gets defeated by a symlink maybe it's not really time to consider it... Sure, things are not better in the linux world but at least there's more eyes to fix issues there just because of the market share.
- ori_b 4mo agoNote that this specific symlink was special cased because sandboxed programs still need to access timezones. Also note that you would need to be root to create that special cased symlink. It's embarrassing, but less catastrophic than it looks at first glance. Running security-critical code as root is still a bad idea.
- 866-RON-0-FEZ 4mo agoYour "evidence" for him to reconsider is a sandbox "bypass" that requires you to be root to set up the environment? For my next trick I will demonstrate how to break into my own house to open the blinds by using my keys. Security researcher theatrics will never not be funny.
- rs_rs_rs_rs_rs 4mo ago>Your "evidence" for him to reconsider is a sandbox "bypass" that requires you to be root to set up the environment Can you help figure out where does it say unveil does not really work when root is involved?
- 866-RON-0-FEZ 4mo agoYou left a snarky comment, then paraded around a positively lame example as some sort of trophy. Here's what I can figure out: you need root to set up the environment just so. It's a don't-care. The end.
- rs_rs_rs_rs_rs 4mo ago
- fsflover 4mo agoIf you care about security, why not consider Qubes OS? Related discussion: https://forum.qubes-os.org/t/qubesos-vs-openbsd-security/7900 https://forum.qubes-os.org/t/qubesos-vs-openbsd-security/790...
- nelsonic 4mo agoQubes OS uses the Linux kernel. Without wanting to start a flame-war and with all respect to Linux, it’s not even close. See: https://en.wikipedia.org/wiki/OpenBSD_security_features https://en.wikipedia.org/wiki/OpenBSD_security_features
- tptacek 4mo agohttps://isopenbsdsecu.re/ https://isopenbsdsecu.re/ (This site is extremely good and has fairly recent coverage, point-by-point, of all OpenBSD's mitigations. An important subtext to take to this is that OpenBSD has a reputation for introducing mitigations that exploit developers make fun of. Some of them are great, some of them less so.)
- terry_hc 4mo agoThe slides are over 6 years old. The developers' attitudes haven't changed much, but are all of the arguments still valid? I've followed this discussion here and there over the years and it always goes like this: 1) everyone makes fun of the mitigations 2) many even outright assert they can easily defeat and exploit OpenBSD 3) nobody provides a working PoC when asked to demonstrate how insecure the OS is And somewhere in the mix there's also you and your usual blabber, also without any substantial examples of how insecure and exploitable the OS is. Always.
- tptacek 4mo agoThe site isn't the slide deck. Let's talk after you've read it?
- 4mo ago
- maxall4 4mo agoIs OpenBSD actually more secure than Linux? I have not been able to find any data to support this—only some vague opinions.
- deleted 4mo ago[deleted]
- doublerabbit 4mo ago"Is Secure" is subjective. I would be in favour to say that out of the box OpenBSD is more secure than Linux.
- nelsonic 4mo agoYou are correct; OpenBSD is secure by default. And it's not subjective at all. The homepage of https://www.openbsd.org https://www.openbsd.org proudly states "Only two remote holes in the default install, in a heck of a long time!" if they didn't have the evidence to support the statement, the internet would have forced them to remove it by now. ;-) Remote (exploitable) holes are the ones we all care about.
- bombcar 4mo agoThe key (and not saying it's bad, mind you) is that the default install has very few services installed, let alone running or open. So even if Debian and OpenBSD ship the exact same web server, but Debian has it defaulted installed and on, but OpenBSD does not, then a remote exploit won't count against OpenBSD.
- binkHN 4mo agoThere was a time when Linux distributions shipped lots of things on by default; OpenBSD bucked the trend and did not. This is less of an issue nowadays.
- Melatonic 4mo agoIsn't that a good thing for certain use cases ? If you are building an appliance type thing (say a storage or networking device) then you would want something minimalist you can add only the necessary services on. And arent those the types of devices the BSD (in general) are used for ? Less attack surface always equals less potential for bugs/flaws/exploits regardless of how good red teaming tools and workflows get. Now obviously for other use cases Linux could be a much better option.
- infinet 4mo agoI tried OpenBSD recently and found it behaves very differently from other OS. The same code works on Linux/FreeBSD/Windows but has poor multi thread performance on OpenBSD, async socket stopped working after sending at high speed for few seconds. I am not saying there is anything wrong in OpenBSD, it is just different.
- skydhash 4mo agoOpenBSD uses a Giant Lock model (simpler code) instead of the fine grained locking mechanism in Linux. And Linux has a some quirks and hacks to improve performance (instead of doing the slow, but correct thing). One example is the USB Gadget thing.
- bw86 4mo agoThis is not wrong per se, but they also try to reduce/remove this giant lock as much as possible. If you see entries like "Unlocked socket splicing." in the changelog, then this is one more case where the giant lock is not needed and in which therefore all cores can be used. It just takes time.
- nelsonic 4mo agoIs the code you ran on your OpenBSD available (e.g. on GitHub) for others to test? Curious what async issue you faced, did you report it? Or ask for help addressing?
- infinet 4mo agoI just switched to single thread and didn't try to fix the issue. Single thread is fast enough to me, it has throughput ~ 730 Mbits/s in a OpenBSD 7.8 vm on a 7th gen i7 linux kvm host. https://github.com/infinet/rs-wgobfs/commit/c5e62796 https://github.com/infinet/rs-wgobfs/commit/c5e62796
- anthk 4mo agodoas sysctl hw.smt=1
- pjmlp 4mo agoUnfortunately the hardware support isn't there for many systems. If I had to pick a BSD, it would be FreeBSD anyway.
- dharmatech 4mo agoHey pjmlp (waves), I know you've been an advocate for OSes and languages that are outside of the mainstream. I finally got around to living in plan9... My experiment, a social network for plan9 written in rc and some awk. https://github.com/dharmatech/9social https://github.com/dharmatech/9social
- pjmlp 4mo agoCool! Trying out new ideas is very good way to open mindsets, even if those systems aren't used regularly, they serve as inspiration for future improvements. The video is kind of interesting.
- dharmatech 4mo agoThanks for checking it out, pjmlp!
- elcritch 4mo agoUgh FreeBSD is so much nicer than modern Linux. It's hard not to love.
- pjmlp 4mo agoIt has some pluses, I miss an updated version of "The Design and Implementation of the FreeBSD Operating System", but it is understable there are other priorities and putting such a book out is lots of work for very little money, given how much book authoring gives back.
- snvzz 4mo agoOpenbsd makes a good stopgap. The way forward is seL4[0][1]. 0. https://sel4.systems/ https://sel4.systems/ 1. https://microkerneldude.org/category/sel4/ https://microkerneldude.org/category/sel4/
- binkHN 4mo agoNeat stuff, but this is not going to easily run the vast majority of open source software out there.
- snvzz 4mo agoNot today, but it could tomorrow. e.g. Genode's Sculpt[0] already bridges the gap via running Linux in a VM. Even though they already have native webbrowser and can build software natively, it wasn't always the case. 0. https://genode.org/download/sculpt https://genode.org/download/sculpt