Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenBSD 7.9

openbsd.org

Post reply on HN
Print view View original

281–290 of 314 posts

Re: OpenBSD 7.9

#281

Post by JdeBP »

mxuribe wrote: post #76
SanjayMehta wrote: post #41

Earlier quoted context omitted.

OpenBSD is security focused while FreeBSD will remind you of older X-Windows workstations.

Thanks! And, wow, do i miss the old X-window workstations...well, i should clarify that i LOVED those (I think they were Sparc?) workstations that ran Solaris or SunOS back in the day! Man, that takes me back some years...but i really loved those machines! :-)

It's worth mentioning at this point that one can still get (Open)Solaris descendent operating systems: OmniOS, SmartOS, and Tribblix. The latter still has SPARC in its installation guide.

* https://tribblix.org/install-sparc.html

Re: OpenBSD 7.9

#283

Post by backscratches »

nelsonic wrote: post #145
doublerabbit wrote: post #114

Earlier quoted context omitted.

"Is Secure" is subjective. I would be in favour to say that out of the box OpenBSD is more secure than Linux.

You are correct; OpenBSD is secure by default. And it's not subjective at all. The homepage of https://www.openbsd.org proudly states "Only two remote holes in the default install, in a heck of a long time!" if they didn't have the evidence to support the statement, the internet would have forced them to remove it by now. ;-) Remote (exploitable) holes are the ones we all care about.

People would never lie on the internet.

Re: OpenBSD 7.9

#284

Post by binkHN »

snvzz wrote: post #274
nelsonic wrote: post #11

With all the security issues constantly being uncovered in other Operating Systems - which will only accelerate with Ai - it’s time everyone considers OpenBSD. Their decades-long security-focus is second to none. We have fully converted from Ubuntu/Debian to OpenBSD. No looking back.

Openbsd makes a good stopgap. The way forward is seL4[0][1]. 0. https://sel4.systems/ 1. https://microkerneldude.org/category/sel4/

Neat stuff, but this is not going to easily run the vast majority of open source software out there.

Re: OpenBSD 7.9

#285

Post by pjmlp »

elcritch wrote: post #270
pjmlp wrote: post #252

Earlier quoted context omitted.

Unfortunately the hardware support isn't there for many systems. If I had to pick a BSD, it would be FreeBSD anyway.

Ugh FreeBSD is so much nicer than modern Linux. It's hard not to love.

It has some pluses, I miss an updated version of "The Design and Implementation of the FreeBSD Operating System", but it is understable there are other priorities and putting such a book out is lots of work for very little money, given how much book authoring gives back.

Re: OpenBSD 7.9

#286

Post by thomashabets2 »

tiffanyh wrote: post #276
thomashabets2 wrote: post #268

Earlier quoted context omitted.

I pointed plain old gpt 5.5 at openbsd and found plenty of bugs. Sent patches for two just in "find". Openbsd, like all other projects, needs a large scale LLM powered bug squash effort. My recent experience: https://blog.habets.se/2026/05/Everything-in-C-is-undefined-...

> This was the most critical vulnerability we discovered in OpenBSD with Mythos Preview after a thousand runs through our scaffold. Across a thousand runs through our scaffold, the total cost was under $20,000 and found several dozen more findings. Anthropic did that for OpenBSD. https://red.anthropic.com/2026/mythos-preview/

I know.

I'm saying you don't even need Mythos to find bugs in OpenBSD. GPT 5.5 is SO much better than humans at finding these things.

The fact that we don't even need Mythos, or $20k (I just pay $24/month and this was one of my MANY uses), to find bugs in OpenBSD shatters the dream that there exists any human who can write C properly with enough expertise, dedication, and time.

Re: OpenBSD 7.9

#287

Post by 3form »

ori_b wrote: post #250
3form wrote: post #241

Earlier quoted context omitted.

But the issue of root and accessing outside of the sandbox is orthogonal, no? Even if you're logged in as XYZ, accessing XYZ's contents outside of the sandbox is still a breach and a problem. Or does this issue require actual root to manifest?

This path was special cased used to allow restricted applications to access time zone files, which are needed for time functions. Not any symlink will do, it has to be the specific one shown in the example exploit, or one of a small handful of others that were special cased for similar reasons. The place these symlinks live are owned by root. This is the same root user outside the sandbox as inside it. So, yes, you n…

I see, thank you for your time and patience spent to explain this. So there's no elevation, no general escape, and this got patched because it could possibly be used as a set-up-use-later backdoor style thing (such as dropping a setuid root binary somewhere in the OS). Yeah, not a thing I would use as an argument that it's a terribly insecure system.

Re: OpenBSD 7.9

#289

Post by fsflover »

FuriouslyAdrift wrote: post #80
fsflover wrote: post #58

Earlier quoted context omitted.

If you care about security, why not consider Qubes OS? Related discussion: https://forum.qubes-os.org/t/qubesos-vs-openbsd-security/790...

If you really really care about security, then consider CHERI and CheriBSD https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/

Capability approach is just not practical and relies too much on security through correctness, which is unrealistic.

Re: OpenBSD 7.9

#290

Post by gizzlon »

stackghost wrote: post #227
irusensei wrote: post #221

Earlier quoted context omitted.

> The default install isn't very useful, because it doesn't do a lot, and so "only two remote holes" or whatever isn't really saying much. Thats not really true. Comes with spamd, pf, httpd, OpenSMTPD and others. Its actually one of the open source unix-like systems that packs more functionality out of the box. Great firewall and VPN server. You can setup wireguard with just ifconfig.

Again: It comes with them on disk, but are they enabled by default ? If not, then they are not covered by their "default install" boast.

I get your point, but GP is right: You said "Default install", not enabled by default.

The default install is actually very useful, and includes a lot, like parent said. Having run OpenBSD in the past, I found the their versions of things were often superior, at least for small setups (and some of them for large installs as well.. probably : )

Post reply on HN