5 ms·

Didn't everyone recommend Linux and Mac OS back when vulnerabilities on these systems just hadn't been discovered (or possibly written) yet? Make OpenBSD popul

Didn't everyone recommend Linux and Mac OS back when vulnerabilities on these systems just hadn't been discovered (or possibly written) yet? Make OpenBSD popular, add a ton of devs, and attack value, and I'm pretty sure these problems will repeat themselves. I think the second study, which briefly names OpenBSD, does a good job of pointing out that technological changes alone are insufficient.

masklinn 12y ago
Well there's the difference that security is basically the core focus of OpenBSD's development, and the project actively researches and updates development practices with that in mind.
cbd1984 12y ago
Yes, and a Brinks armored truck is just as vulnerable to carjackings as a Ford Pinto, we just don't know about the vulnerability because nobody drives them. People were saying the same things about Linux. In the late 1990s and early 2000s. By which time Linux had already become the de-facto go-to OS for web servers around the world. It was, in short, already a high-value target, and yet the apocalypse didn't occur.
- andrewstuart2 12y ago
  Of course that's true. I'm just not convinced that OpenBSD : Linux :: Armored truck : Pinto. In fact, the point of a good portion of the second study [1], p.17-25 is pointing out the flaws that have occurred in the Linux operating system and other existing technologies. [1]http://www.europarl.europa.eu/RegData/etudes/STUD/2015/527409/EPRS_STU(2015)527409_REV1_EN.pdf http://www.europarl.europa.eu/RegData/etudes/STUD/2015/52740...
  - cbd1984 12y ago
    I never claimed Linux was a Pinto. My point is, some things are just built well, and even if they're not used very often we can expect a certain level of quality, as opposed to saying that the only reason we don't see them stolen is because so few people drive them. Especially if they're used all the damn time, just not in places people see a lot. So some bugs will be found in OpenBSD. That's a given. However, it isn't like OpenBSD is never used, or that the people who made it are bad programmers.
    - andrewstuart2 12y ago
      Yeah, I agree 100% :-) I guess what I'm saying is that it would make more sense to me if OpenBSD and Linux were both on the list. As you also mentioned, flaws existing in programs is inevitable, so unless the defect rate, normalized for usage, is significantly higher in one case, it's not good evidence for the quality or security of one over another.
      - yellowapple 12y ago
        In OpenBSD's case, the defect rate's pretty low, even when normalized for usage. It's had, what, 2 significant security bugs (that actually compromised the security of the base installation) over the last 2 decades or so? Pretty damn good if I may say so myself.
waxjar 12y ago
OpenBSD is already quite popular. It runs on plenty of routers. Routers have very high attack value.

masklinn 12y ago

Well there's the difference that security is basically the core focus of OpenBSD's development, and the project actively researches and updates development practices with that in mind.

cbd1984 12y ago

Yes, and a Brinks armored truck is just as vulnerable to carjackings as a Ford Pinto, we just don't know about the vulnerability because nobody drives them. People were saying the same things about Linux. In the late 1990s and early 2000s. By which time Linux had already become the de-facto go-to OS for web servers around the world. It was, in short, already a high-value target, and yet the apocalypse didn't occur.

andrewstuart2 12y ago
Of course that's true. I'm just not convinced that OpenBSD : Linux :: Armored truck : Pinto. In fact, the point of a good portion of the second study [1], p.17-25 is pointing out the flaws that have occurred in the Linux operating system and other existing technologies. [1]http://www.europarl.europa.eu/RegData/etudes/STUD/2015/527409/EPRS_STU(2015)527409_REV1_EN.pdf http://www.europarl.europa.eu/RegData/etudes/STUD/2015/52740...
- cbd1984 12y ago
  I never claimed Linux was a Pinto. My point is, some things are just built well, and even if they're not used very often we can expect a certain level of quality, as opposed to saying that the only reason we don't see them stolen is because so few people drive them. Especially if they're used all the damn time, just not in places people see a lot. So some bugs will be found in OpenBSD. That's a given. However, it isn't like OpenBSD is never used, or that the people who made it are bad programmers.
  - andrewstuart2 12y ago
    Yeah, I agree 100% :-) I guess what I'm saying is that it would make more sense to me if OpenBSD and Linux were both on the list. As you also mentioned, flaws existing in programs is inevitable, so unless the defect rate, normalized for usage, is significantly higher in one case, it's not good evidence for the quality or security of one over another.
    - yellowapple 12y ago
      In OpenBSD's case, the defect rate's pretty low, even when normalized for usage. It's had, what, 2 significant security bugs (that actually compromised the security of the base installation) over the last 2 decades or so? Pretty damn good if I may say so myself.

waxjar 12y ago

OpenBSD is already quite popular. It runs on plenty of routers. Routers have very high attack value.