291–300 of 314 posts
Earlier quoted context omitted.
macOS is BSD roots on top of Darwin
That's not specifically OpenBSD , though. The BSD world is not the monolith that it was back in the 1980s.
With due mention to FreeBSD's jails, BSD's security image developed mostly from OpenBSD which is said to have gained its security focus due to NetBSD being so insecure that the NetBSD folks were able to hack into DeRaadt's forked OpenBSD.
Android's Bionic was based on or heavily influenced by OpenBSD's libc iirc, though.
Earlier quoted context omitted.
> This was the most critical vulnerability we discovered in OpenBSD with Mythos Preview after a thousand runs through our scaffold. Across a thousand runs through our scaffold, the total cost was under $20,000 and found several dozen more findings. Anthropic did that for OpenBSD. https://red.anthropic.com/2026/mythos-preview/
I know. I'm saying you don't even need Mythos to find bugs in OpenBSD. GPT 5.5 is SO much better than humans at finding these things. The fact that we don't even need Mythos, or $20k (I just pay $24/month and this was one of my MANY uses), to find bugs in OpenBSD shatters the dream that there exists any human who can write C properly with enough expertise, dedication, and time.
Bugs, or exploitable security vulnerabilities?
If the latter, have you reported them all?
Earlier quoted context omitted.
Is OpenBSD actually more secure than Linux? I have not been able to find any data to support this—only some vague opinions.
"Is Secure" is subjective. I would be in favour to say that out of the box OpenBSD is more secure than Linux.
Also important to remember that diversity builds strength. Just as in biology, if all organisms are the same, they all succumb to the same virus.
I have a multi-layered firewall approach where some are Linux, some are OpenBSD, some are commercial. They'll all have bugs, but unlikely they all have the same bug.
Earlier quoted context omitted.
Unfortunately the hardware support isn't there for many systems. If I had to pick a BSD, it would be FreeBSD anyway.
Hey pjmlp (waves), I know you've been an advocate for OSes and languages that are outside of the mainstream. I finally got around to living in plan9... My experiment, a social network for plan9 written in rc and some awk. https://github.com/dharmatech/9social
The video is kind of interesting.
Earlier quoted context omitted.
Pretty much any OS would be just as stable if it's just serving DNS/DHCP.
As someone who has run DNS and DHCP servers... unfortunately, no. Shit happens, and choices still do matter. Even if it feels it should be simple, Linux has a way. My experience has been that Openbsd is rock solid, so are its implementations of the relevant server daemons.
Earlier quoted context omitted.
The Data: Compare the number of CVE vulnerability trends over time between Linux: https://www.cvedetails.com/vendor/33 and OpenBSD: https://www.cvedetails.com/vendor/97 It's not even close! It's nearly two orders of magnitude higher for Linux. This isn't anecdotal or “vague opinion” CVEs are facts. You can ask the follow-up question: Why is that? And there are many reasons. It could just be that Linux having more use…
US export restrictions? There are broad license exceptions since decades, so kernels like Linux are free distributable. Same would apply to OpenBSD.
Earlier quoted context omitted.
Power management, webcam, trackpad, accessories, etc tend not to be a good fit for niche BSD and Linux. Stick to desktop or server.
huh? I've been running Arch exclusively on my laptops for at least 7 years
How is the battery life?
Hey ... I had no idea OpenBSD had an official song. I think all distros (Unix and Linux) need an official song.
Agree. It's obvious some people are still having fun making operating systems!
Earlier quoted context omitted.
I know. I'm saying you don't even need Mythos to find bugs in OpenBSD. GPT 5.5 is SO much better than humans at finding these things. The fact that we don't even need Mythos, or $20k (I just pay $24/month and this was one of my MANY uses), to find bugs in OpenBSD shatters the dream that there exists any human who can write C properly with enough expertise, dedication, and time.
> (I just pay $24/month and this was one of my MANY uses), to find bugs in OpenBSD Bugs, or exploitable security vulnerabilities? If the latter, have you reported them all?
As I said in the out of bounds null termination write patch, I don't believe it's exploitable. I would have gotten a CVE, website, and logo then (kidding!). But it was UB. And one-byte overflows have in the past been exploitable by better sploit authors than me.
In any case, I reported that since I felt it was clear that OpenBSD folks would obviously care about it, exploitable or not.
Confirming these findings take time, even though I found GPT to almost always be correct. I will NOT report upstream until I understand the bug. I ain't no slop reporter. As I said in the post OpenBSD (and all other code bases) need a larger effort. The Mythos/Glasswing effort focusing on actually exploitable ones may be a good method for getting them fixed, without overwhelming projects with patches, even when the patches are correct.
I did confirm at least one more UB, and did consider whether to report that OpenBSD `find` reads `status` via `WIFEXITED(status)` without checking `waitpid()` for errors. This is UB since `status` is uninitialized. (https://github.com/openbsd/src/blob/ae684bfaed6cae797cd90e27...)
The reason is my previous experience with OpenBSD where the reply may be " is wrong in this regard", and because they control their whole system, they don't care. E.g. in this case they may go "we build with GCC x.y.z exactly, and we know what actually happens in this controlled domain". This may be a bit unfair to them, but not by much.
GPT also flagged the extremely surprising behavior of running `cat -n file1 file2` if file1 doesn't end with a newline. And that `find /etc/passwd -execdir[…]` doesn't run the command. But maybe that's how they want it? I don't want to go through the whole thing for them to go "yeah we won't do that" again. So I think this project is for them. GPT is as available to them as it is to me.
Tangent: in running GPT against `cat` I learned that not only is `cat -n` not standardized, but it also behaves COMPLETELY differently than on Linux, if you provide more than one file.