The idea of "OpenBSD is super duper secure" is mostly a fiction. Their prime claim to fame, "only two remote holes in the default install in a squillion years", is pretty meaningless because the default install doesn't really do anything, so as soon as you install packages to make the system useful you're beyond their security claims.
Classified workstations in National Security contexts? They run Windows.
Red network routers? They're Cisco, Juniper, PAN, etc. It's all COTS stuff. OpenBSD is mostly a LARP.
I'll never understand this point. It's not as though that slogan is the entirety of OpenBSDs security posture. It's just a damn slogan, but OpenBSD naysayers will never stop talking about it.
And no, OpenBSD is not the most secure OS out there, and very few serious people claim it is. What OpenBSD is, is the most secure option if you want a simple, no bullshit, well documented unix that can still run on obscure legacy hardware using a potato as your RAM. As such, when you actually compare it to other options in that space, I would say it is the most secure. They care about security very deeply, but they do it within that context. So yes, they still use C, because they need to compile on a bunch of dead platforms. And OpenBSD is never gonna be something like Qubes because Qubes needs things like VT-D and a boatload of memory/cores, it's never gonna be GrapheneOS because they can't rely on having MTE, TPM, etc. And that's fine.
They also deserve a lot of credit for contributions to the wider ecosystem as well. Just to give one example, making sure the OS can provide high quality entropy in all contexts with arc4random, which eventually percolated to FreeBSD, Linux, and even MacOS.
But sure, keep talking about the two holes if you want.
To the point someone has made a talk validating the marketing with the actual reality,
"A systematic evaluation of OpenBSD's mitigations"
> OpenBSD markets itself as a secure operating system, but doesn't provide much evidences to back this claim. The goal of this talk is to evaluate how effective OpenBSD's security mitigation are, in a systematic, rational and comprehensive way.
> is pretty meaningless because the default install doesn't really do anything
Which is a good thing. An important thing. The reason you're stuck in a perpetual update cycle for most Linux distros and for Windows is that they ship with an insane number of things that most users have no need for. Yeah, every laptop definitely needs NetBIOS and iSCSI and UPnP turned on by default.
It's true that everything you add on top of the OpenBSD baseline increases your attack surface, but it's a saner approach than shipping with a gigantic attack surface and then forcing you to know about and disable the things you don't need.
> Classified workstations in National Security contexts? They run Windows.
Which is almost certainly a combination of the complexities of govt IT procurement, the needs of non-technical users who may only be familiar with Windows & MS Office, and the enterprise management features of Windows that aren't as good in most other OSes.
It's a tricky balance. I certainly don't want my devices to have a ton of cruft installed which I would never need. But I also certainly don't want to have to spend a month after getting a new device just getting it into usable shape so I can use it for whatever I got it for. I used to think the second concern is very small since I do not get new devices that often, but turns out it's not true, it's often enough that I really want the OS to contain a lot of things from the start. OK, maybe not NetBIOS but wide enough device support and other capabilities so it would be useful for me. And if it's not, I - and most other technically competent, but busy people - would move on to something that provides that service. Goes double for people that are not technical, obviously.
Sure, I don't disagree in principle with the idea that a smaller attack surface is better than a larger one, nor with the idea that explicitly enabling things is better than having to locate and disable services you didn't even know were running.
But saying "only two remote holes" gives the impression that all of OpenBSD is secure and that it's the most heavily scrutinized codebase in the world, it's bulletproof, etc.
It's not.
My toaster hasn't had a remote hole in a heck of a long time either, but then again it doesn't do anything other than make toast.
The default install of OpenBSD doesn't do anything, so the fact that it hasn't had a remote hole in forever isn't saying much.
I think one has to keep in mind where that slogan came from. A time where every OS tried to start a million services listening on the network, when OpenBSD ended up minimizing that, because it was aware of attack surface.
Nowadays it does the same with being very defensive of complexity and adding features just for the sake of it. They actively remove features and technically break standards to reduce surface. So while the phrase might be dated the whole idea of doing the minimal thing to provide minimal attack surface is something that some other projects could very much benefit from. Especially in times where people use LLMs that happily write ten classes instead of a simple five line function everyone can easily understand and verify.
Also I think it simply became a bit of a meme and like with the art and music it became a bit of a project culture thing. Don't overanalyze it. It's a joke like "days since last accident" and how Shodan is a video game reference and firewall probably came from some fantasy nerd. Hey, the term sharding came from a video game as well!
> Which is almost certainly a combination of the complexities of govt IT procurement, the needs of non-technical users who may only be familiar with Windows & MS Office, and the enterprise management features of Windows that aren't as good in most other OSes.
... and if I were to guess, there's definitely backroom deals between the US government and Microsoft. There's no way all the phone home stuff is even included in "Windows for SCIF".
if you mean as in Windows phoning home in normal installations, a Windows Enterprise install stripped of most unneeded components with Group policy won't really "phone home"
The base install includes a firewall, http server, load-balancer/proxy, ldap server, caching DNS resolver, ssh server, nfs server, dhcp server, smtp server, bgp routing daemon, virtual machine subsystem, and a lot of other stuff I'm probably forgetting.
Yes, but with the exception of sshd (which you get asked about during install), none of these things (NONE!!!) is enabled by default.
I am probably misremembering, but the OpenBSD documentation used to even explain how to disable inetd if you were too paranoid to use that. It is now disabled by default, and--I just checked one of my running systems--my machine does not even have an /etc/inetd.conf file. Most of the things running on a default install are init, cron, slaacd, a handful of gettys, ntpd, syslogd, and sndoid. Arguably sndiod is the only thing you could really remove from that list.
But if you look at the security track record of opensmtpd, you'll quickly see that "Only two remote holes in the default install, in a heck of a long time!" Does not relate to the base system, but to the "default install" - that is; only sshd listening (and possibly pf).
IMNHO more interesting than bickering over the "secure" label, is all the work openbsd has done and is doing to develop stuff like pledge.
It doesn't matter as they are not enabled by default.
So even if they allow unauthenticated code execution as root or kernel by default when started, it would not count for the "remote hole in default install" claim.
You could as well just not enable network by default. Which makes Windows 95 safer than OpenBSD.
You're not being intellectually honest. Most of those things are disabled by default, so if the httpd had a remote hole, but was disabled by default, then that's not "pArT oF tHe DeFaUlT iNsTaLl" and thus not technically covered by their vaunted claims, and you know it.
OpenBSD was used under NDA's in some really sensitive corpos with Gnome2 setups and some RDP/Citrix clients and even Perl?+GTK2 wireless graphical assisatnt.
If OpenBSD had a stable GeFS setup as a filesystem -still WIP- (and toad/hotplugd for external FS' mounting) it could get customers in no time, because today except for CUDA the rest can virtually work 100% the same as any Linux distro.
I think there's this cultural bias about the 'boy genius open source coder' that of course isn't true at all. Open source code is at the same quality as corporate written closed source code, in general. There have been studies on this and open vs closed source code isn't very different in terms of defects and exploits.
The problem is the people most willing to buy into this cargo cult mentality are techies, so tech forums are the last place to really have this conversation based on facts. Hence why your comment is barely visible here due to its low karma.
>It's worse everywhere else. There are no specialists in all of the government-run systems I've dealt with and at some point, you really have no options left.
>Canada introduced MAID for this reason.
What is it with Americans being so confidently ignorant about everything?
Canada introduced MAID because someone who wanted MAID sued the government and asserted that banning MAID violated their constitutional rights. It went all the way to the supreme court, and the (federal) government fought tooth and nail AGAINST allowing MAID.
It should be noted that the Provinces are responsible for healthcare, but it was the federal government who banned MAID prior to the 2015 supreme court case via the criminal code.
So, in short, stay in your lane. You have no idea what you're talking about.
That study you linked does not establish a causal relationship. It may simply be that the sort of person who is able to extract well-being from church is the sort of person more likely to actually attend church with any regularity. It likewise does not address the possibility that depression itself might make one want to stop attending church.
>Millenial cynicism is so boring
Yeah, it's always Millennials who are in the wrong. Fuck us, right? It's all good, we're used to being the scapegoats for society's problems.
I'm a millennial and I feel like nearly all the discourse about who is (generationally) responsible for society's problems is aimed at the boomers. And the zoomers to a lesser extent, though that seems more of a prophecy about how they're going to ruin society. Jabs aimed at us millennials tend to be that we're cringe (or boring), which I can accept.
I recently switched from android back to iOS and tried to use mail.app for everything, as I rather like it.
Unfortunately it doesn’t sync properly with Gmail. I am in the process of de-googling my life so that’s okay with me. I use mail.app with my fastmail account and it’s perfect.
I'm sorry but fairemail has easily the most convoluted UI I have ever had the misfortune to gaze upon in my life. Like seriously what the hell is going on there.
It's quite cluttered UI for sure but it actually works and you actually get notifications when new mails come in, which is more than could be said about k9 the last two times I tried it.
I bounced off of k9 several times. I could never get it to actually work reliably. I would get an email and never get a notification unless I opened the app to manually check. It was like the bad old days of pop3.
Awful, awful app. Fairemail was much better for a power user.
The amusing aspect is that this is so easy that multiple good ways someone could hobby program this long before AI was a thing. The sound of a bunch of keypresses may just blur together to our human ears, but if you try, you can tell that different keys make different noises, which is really the key insight. Between the different noises, the possible directionality you can get from a stereo (or more) pickup, and characteristic delay patterns during typing various bi-grams, there's a ton of information leakage in a recording of a keyboard.
Oh, I thought we were talking about being able to distinguish which key was pressed using wifi-radar, like one can do with deanonymizing someone via wifi gait analysis.
They aren’t in NATO in large part because of the clause preventing participants in active conflict from joining, and because a few key politicians in NATO states are unduly influenced by Russia.
The idea of "OpenBSD is super duper secure" is mostly a fiction. Their prime claim to fame, "only two remote holes in the default install in a squillion years", is pretty meaningless because the default install doesn't really do anything, so as soon as you install packages to make the system useful you're beyond their security claims.
Classified workstations in National Security contexts? They run Windows.
Red network routers? They're Cisco, Juniper, PAN, etc. It's all COTS stuff. OpenBSD is mostly a LARP.
reply