81–90 of 170 posts
Earlier quoted context omitted.
This is an external audit. Why would Linux activity make a difference here? Are you theorizing that the churn causes bugs?
When more code is written, more bugs are written. Or, if the act of debugging is removing the bugs from software, then the act of programming is to put the bugs in the software.
Earlier quoted context omitted.
What does openbsd marketing look like?
Pretty sure you're familiar with their claims.
One bug found is a testament to the great diligence and culture around security of OpenBSD. Especially if you take into account the amount of resources they have been able to achieve this with.
If your operating system only does 20% of what another operating system can do, it's easier for you to have 80% less bugs.
That's not a knock, it's a design philosophy of OpenBSD (which is to do the minimal needed, and no more, in the most simplistic way).
Earlier quoted context omitted.
Sidenote but... I read this on that link: dnsmasq: Codex Security independently identified vulnerable patterns corresponding to four of the six dnsmasq CVEs later fixed in 2.92rel2: CVE-2026-4890 (opens in a new window), CVE-2026-4891 (opens in a new window), CVE-2026-4892 (opens in a new window), and CVE-2026-517 dnsmasq has had so many freaking security holes in 2025 and 2026 that atm I decided to just remove that…
"dnsmasq has had so many freaking security holes in 2025 and 2026 that atm I decided to just remove that thing from all my machines." Would be nice if OpenWRT would stop including it by default
Earlier quoted context omitted.
OpenBSD has a reputation for being... selective about what they admit is a security-relevant bug.
They appreciate technical correctness and they do not exaggerate. Most 'security researchers' are not technically correct and they exaggerate a lot (seeking fame and all). Dismissing their claims is not being selective, it's just the right thing to do.
The main claim from OpenBSD is "Only two remote holes in the default install since forever".
It is technically true. But it's also selective because they deliberately disable every service by default and don't install any software beyond core.
Once the OS is configured to be useful, we're far from the default install and they would (and have!) refuse to update their motto when confronted with RCEs in those parts.
Which is fair enough! You gotta draw the line somewhere. But that's still being very selective.
One bug found is a testament to the great diligence and culture around security of OpenBSD. Especially if you take into account the amount of resources they have been able to achieve this with.
While I agree, OpenBSD also doesn't fully implement features/functionality. If your operating system only does 20% of what another operating system can do, it's easier for you to have 80% less bugs. That's not a knock, it's a design philosophy of OpenBSD (which is to do the minimal needed, and no more, in the most simplistic way).
For example you can imagine my disappointment when I discovered what a pain in the ass it is to get a pflow producer working on linux after doing the first one on openbsd.
Earlier quoted context omitted.
In theory. But real defenses are generally multi-layered. And in that context, a Swiss cheese slice with only one hole is still extremely valuable.
Well, that's where OpenBSD falls short, it lacks facilities to really enforce defense in depth - even NetBSD has some better features in this regard.
Earlier quoted context omitted.
Exactly, the entire AI industry has been trying to create an AI powered security arm race. I am not necessarily blaming them. Hard to know how much has been thrown into this but I would bet a lot. So far I have been very surprised we haven't been flooded by those type of announcements. If you look you will always find something and OpenBSD is the top price.
They are throwing tokens at codebases and finding mostly vulnerabilities in cases that have not been worth the limited time and effort of the chronically underfunded and understaffed professional groups. There’d be a lot more value in the companies giving the money they spend on their synthetic text extruders to the organizations doing quality security research work.
that's kinda the entire point
Earlier quoted context omitted.
While I agree, OpenBSD also doesn't fully implement features/functionality. If your operating system only does 20% of what another operating system can do, it's easier for you to have 80% less bugs. That's not a knock, it's a design philosophy of OpenBSD (which is to do the minimal needed, and no more, in the most simplistic way).
That does not match my experience with obsd. It is not so much minimalism as they are not afraid to reinvent the wheel. A obsd install is full of services, more than most linux installs I have seen. For example you can imagine my disappointment when I discovered what a pain in the ass it is to get a pflow producer working on linux after doing the first one on openbsd.
And obsd has no Bluetooth, right? A pretty big subsystem to drop because security.
Earlier quoted context omitted.
That does not match my experience with obsd. It is not so much minimalism as they are not afraid to reinvent the wheel. A obsd install is full of services, more than most linux installs I have seen. For example you can imagine my disappointment when I discovered what a pain in the ass it is to get a pflow producer working on linux after doing the first one on openbsd.
I'd say it's true. They chose to not implement SMP until consumer CPUs surprised them by going multi thread. And obsd has no Bluetooth, right? A pretty big subsystem to drop because security.
I am not complaining, I like the feeling that I could single handedly rebuild the internet using only what is found in an openbsd base install. But wow, considering the size there is a lot in there. They definitely punch above their weight.