Slashdot Mirror
OpenBSD Now Nine Years Old
NekkidBob writes "OpenBSD, my personal favorite *BSD, turns 9 years old today. And with only 1 remote hole in the default install, I'd say that is a pretty good acheivement. The first commit was at 16:36 MST on Saturday, October 14, 1995. Happy birthday OpenBSD!"
this doesn't mean your final system won't have holes, but it means you're not already starting "in the hole"; it doesn't sound like much, and yet how many other systems out there can make this claim? OpenBSD isn't the end-all, be-all, it's just a good tool for your toolbox
Fortunately, that's where you are wrong.
It's quite common to search through bugtraq or another security list, and find it in the list as the only OS "unaffected". Now, that's not always the case, but it's surprisingly common.
OpenBSD is more secure than other OSes, not just out of the box, but with major services enabled too... When you install Apache on Linux/FreeBSD, you just get the plain vanilla version. With OpenBSD, you get a version that has been audited by the team, and lots of changes have been made.
Plus, about a year ago, Propolice, W^X, and other protection measures have be included by OpenBSD, which does negate most bugs, and does protect your OTHER services against software bugs.
BTW, most of my machine have only SSHD enabled (which is one of a few services enabled by default), so the default install can be very useful for a great many things. SSH handles log-in, file transfer, plus port forwarding. So any other services can run on 127.0.0.1, and only be accesses remotely (via SSH) if you have an account.
Of course, but baring that, OpenBSD is a very good choice.
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
soon as you add in server applications, you decrease the security.
No shit?!
The point with OpenBSD, is that it has so many active security mechanisms, that a [insert network daemon] exploit might allow a remote root on your FreeBSD, Solaris and Linux machines, but only result in a DoS of that particular service on OpenBSD.
Already we are not only seeing open source OS' take leafs out of OpenBSD's book, but also Microsoft and Sun.
The multitude of active and passive security measures in OpenBSD is very impressive.
Plus the point is, that an OS should be locked down from the initial install and then built on from there as the admin requires, not as the OS maintainers think you will require.
Presumptuous people who build operating systems, do not make secure operating systems.
War crimes, torture, lies, illegal spying... Would someone give Bush a blowjob, already, so he can be impeached?
Given how little (that is, nothing) is turned on in the default install, one remote root hole is pretty damned bad. Remember that that's a remote root hole with *no* services running... Now, if they had only one remote root hole including sshd, a webserver, a mailserver and so on, that'd be something to brag about.
You speak with such authority, for someone who obviously knows nothing about the subject.
OpenSSH has been ON by default at some stage after or including OpenBSD 2.6 and only recently has the option to disable it within the install script, become an option for users. That's about 5.5 years out of that 8.
The foundation of your rant is completely non-existent.
Nowdays, even if you do enable popular daemons, your typical worst case is likely to be a DoS instead of a remote root, thanks to OpenBSD.
I take, "Only one remote hole in the default install, in more than 8 years!", as a fact that is representative of the mindset of the developers behind the project, not as an absolute gauge of overall project security. Anyone who does or thinks that is what it is supposed to represent, is stupid.
Take that statement for what it is. Reading more into it is your problem.
War crimes, torture, lies, illegal spying... Would someone give Bush a blowjob, already, so he can be impeached?