111–120 of 170 posts
One bug found is a testament to the great diligence and culture around security of OpenBSD. Especially if you take into account the amount of resources they have been able to achieve this with.
one bug is all it takes
There is no such thing as 0 bugs, and fewer is better than more.
Earlier quoted context omitted.
I'd say it's true. They chose to not implement SMP until consumer CPUs surprised them by going multi thread. And obsd has no Bluetooth, right? A pretty big subsystem to drop because security.
But Bluetooth is basically a giant blast of security vulnerabilities. On the consumer side, yes, it's a big subsystem to drop, but on the server side, it's a little bit different! I'm not an OpenBSD expert, but seems like you should be able to pass BT through USB and then do that in a subsystem or an isolated environment like a VM.
I use a Creative BT-W2 bluetooth usb dongle. Small and has a button on it for pairing. OpenBSD sees it as a normal audio device.
Earlier quoted context omitted.
When more code is written, more bugs are written. Or, if the act of debugging is removing the bugs from software, then the act of programming is to put the bugs in the software.
Not necessarily. Depends on the quality of the code being written. Quality*Quantity
Earlier quoted context omitted.
When more code is written, more bugs are written. Or, if the act of debugging is removing the bugs from software, then the act of programming is to put the bugs in the software.
Not necessarily. Depends on the quality of the code being written. Quality*Quantity
Earlier quoted context omitted.
It is quite possible that Linux is the bigger target so it gets more focus. Vulnerabilities there are generally considered more valuable and notable. It would be very difficult to use these numbers to get a meaningful "more secure" stance as there are tons of variables.
From a quick search, Linux kernel is ~40 million loc, freebsd ~9 million, openbsd ~3 million. Number of bugs compared to lines of code leaves FreeBSD looking worse than Linux.
As an FYI to everyone: The OpenBSD and FreeBSD teams both maintain entire distributions, similar to Linux + Debian or Linux + Redhat. The OpenBSD team also owns a number of other projects - everything from OpenSSH to PF, OpenBGPD, OpenNTPD, OpenSMTPD, OpenIKED, LibreSSL, pledge and unveil, their own set of perl patches, etc.
I'd say that less lines of code seems to correlate with less bugs in absolute numbers, which works out as more secure for those who don't need the extra code.
Earlier quoted context omitted.
Linux also has a ton of extra functionality so I think you’d also have to do some adjustment for “as a user would I be at risk?” versus “can I be a user because it supports my needs?” Some of that would be unfavorable for many users (e.g. a Linux user who is exposed due to a network protocol or file system they’ll never use) but that’s certainly not true of every feature.
That cuts both ways, though. If the functionality is present by default but I'm not using it, that's just extra vulnerability surface. (Of course, if I do want that feature, then its absence is kinda a problem)
I think it's important to point out that OpenBSD is not more secure than others, it's just that it's not widely adopted so no one really does audit it.
Isn't this article about an AI that just audited it?
> not more secure than others
Didnt the audit only found one bug, much less than other kernels from the same audit?
Earlier quoted context omitted.
Linux also has a ton of extra functionality so I think you’d also have to do some adjustment for “as a user would I be at risk?” versus “can I be a user because it supports my needs?” Some of that would be unfavorable for many users (e.g. a Linux user who is exposed due to a network protocol or file system they’ll never use) but that’s certainly not true of every feature.
Linux also has a ton of bloat. Configuring your own kernel has become an exercise in frustration because documentation is worse "There is no help for this kernel option" and a lot of things are enabled "by default".
Earlier quoted context omitted.
While I agree, OpenBSD also doesn't fully implement features/functionality. If your operating system only does 20% of what another operating system can do, it's easier for you to have 80% less bugs. That's not a knock, it's a design philosophy of OpenBSD (which is to do the minimal needed, and no more, in the most simplistic way).
My hobby horse is the lack of a “modern” filesystem on obsd. Without journaling I really don’t agree with the oft repeated claims it makes a good “router”. Any networking gear I’ve used is treated as an appliance and I don’t want an unfortunate power outage causing data loss.
Earlier quoted context omitted.
What else is out there that fits openWRT's use case? BIND seems like it would be a bit "heavy"
For caching recursive dns, unbound? I got the feeling that dnsmasq does more than just recursive dns though?