HardenedBSD: Feature comparison vs other BSD distros
hardenedbsd.org
HardenedBSD: Feature comparison vs other BSD distros
1–10 of 43 posts
Re: HardenedBSD: Feature comparison vs other BSD distros
#2That comparison doesn't seem to include OpenBSD's biggest security feature, their track record of robust code review, eliminating countless security bugs before they're ever exploited.
Re: HardenedBSD: Feature comparison vs other BSD distros
#3I've never heard of HardenedBSD before. I thought OpenBSD was generally considered the best choice for serious security, but I'd be interesting in reading up more on how they compare. As someone that's not an expert on the subject, it would help to get some extra info that explains why certain features are useful for improving security.
It's not clear that all these features impact real-world security, but maybe I'm just inexperienced and naive. For example, OpenBSD has "Most of base sandboxed", which seems like a huge deal to me. Knowing how many security issues we've seen in the last 10 to 20 years relating to each feature would help in understanding their impact a lot more.
Some immediate questions that popped up from clicking through their pages: Who uses this OS? There's a few company links, but I had a hard time figuring out what some of them even do. Maybe this is a really dumb question, but why FreeBSD over OpenBSD? Finally, are changes being upstreamed? Can we expect these improvements to eventually make it into FreeBSD?
Re: HardenedBSD: Feature comparison vs other BSD distros
#4I've never heard of HardenedBSD before. I thought OpenBSD was generally considered the best choice for serious security, but I'd be interesting in reading up more on how they compare. As someone that's not an expert on the subject, it would help to get some extra info that explains why certain features are useful for improving security. It's not clear that all these features impact real-world security, but maybe I'm…
Not only sandboxed, but many are pledge(2)'d now also.
One downside with OpenBSD is the result of lacking resources - they only support the latest 2 releases (one every 6mo) with only the most critical patches being back ported. I don't believe syspatch(8) changes this, although its certainly easier to apply kernel patches now (please correct me if I'm mistaken)
Same with packages - unless you use mTier to get binary updates, security fixes and updates for packages need to be compiled yourself. Not the worst, but depends how much free time you have to keep on it.
FreeBSD has a larger ecosystem, and seems to be more performance oriented
Re: HardenedBSD: Feature comparison vs other BSD distros
#5Hmm no DragonflyBSD
Re: HardenedBSD: Feature comparison vs other BSD distros
#6That comparison doesn't seem to include OpenBSD's biggest security feature, their track record of robust code review, eliminating countless security bugs before they're ever exploited.
Track record of robust code review doesn't make as much difference as people like to believe. There is a great talk on ccc about this: https://media.ccc.de/v/34c3-8968-are_all_bsds_created_equall...
Re: HardenedBSD: Feature comparison vs other BSD distros
#7Kudos on a list where features HardenedBSD doesn't have but others (OpenBSD) do are also listed.
Recently I've become accustomed to seeing overly tuned feature lists where the product in question has, apparently, all the things you could want.
Re: HardenedBSD: Feature comparison vs other BSD distros
#8I've never heard of HardenedBSD before. I thought OpenBSD was generally considered the best choice for serious security, but I'd be interesting in reading up more on how they compare. As someone that's not an expert on the subject, it would help to get some extra info that explains why certain features are useful for improving security. It's not clear that all these features impact real-world security, but maybe I'm…
Not only sandboxed, but many are pledge(2) 'd now also. One downside with OpenBSD is the result of lacking resources - they only support the latest 2 releases (one every 6mo) with only the most critical patches being back ported. I don't believe syspatch(8) changes this, although its certainly easier to apply kernel patches now (please correct me if I'm mistaken) Same with packages - unless you use mTier to get binar…
On the other hand, upgrading OpenBSD to a new version is just about as easy as updating the packages on any other OS. If not easier!
Also, yes, syspatch makes the paching between releases a five seconds task.
Re: HardenedBSD: Feature comparison vs other BSD distros
#9I have wanted for a long time to see some quantification of these security features, i.e. "What percentage of attacks does feature X prevent in the real world?" and "With all these features combined, how much longer can the OS survive attack vs without them?", but I don't think I've ever seen it.
Re: HardenedBSD: Feature comparison vs other BSD distros
#10Earlier quoted context omitted.
Not only sandboxed, but many are pledge(2) 'd now also. One downside with OpenBSD is the result of lacking resources - they only support the latest 2 releases (one every 6mo) with only the most critical patches being back ported. I don't believe syspatch(8) changes this, although its certainly easier to apply kernel patches now (please correct me if I'm mistaken) Same with packages - unless you use mTier to get binar…
On the other hand, upgrading OpenBSD to a new version is just about as easy as updating the packages on any other OS. If not easier! Also, yes, syspatch makes the paching between releases a five seconds task.
Unfortunately, OpenBSD normally requires booting into a special kernel for upgrading unless you do this: https://www.openbsd.org/faq/upgrade63.html#NoInstKern.
This really makes it hard to use on AWS.