Hacker News Reader

Comment by whitepoplar | Hacker News Reader

Maybe this isn't the best place to ask this, but how does OpenBSD handle "real world" security these days? Last time I checked, OpenBSD was heavily audited, with emphasis on shipping a secure base system. The problem, to me, is that every running system in the world has many packages installed to make it useful as an e.g. server. What use is a secure base system if installable packages aren't audited to the same degree? Debian handles this by putting all packages (apart from universe) under the maintenance of the Debian Security Team. I would love to use OpenBSD, but want to make sure that the extra effort isn't spent with no real security advantage.

View on HN

There is a lot of functionality in Base that some aren't aware of: ldapd, httpd, IPSec + iked (VPN), pf (firewall, NAT), dhcpd, ntpd, smtpd, snmpd, radiusd, relayd (load balancer), tftpd, sshd, nfs, nsd and unbound (DNS)

So, you could run an HTTPS site, with a Perl fastCGI site, sending emails, all out of Base

Plus you get privsep'd X (xenocara)

Yes, built in pf, dns and dhcp alone make for a nice little home router that I trust more than an off the shelf model. Pretty easy to set up too, config files in OpenBSD are generally straightforward and easy to get right the first time. I definitely found nsd easier to setup than bind.

Xenocara may not satisfy performance characteristics the way something like Wayland is. However, Xenocara is pretty awesome in (I believe) being the only X11 server to address the somewhat ugly security model of stuff running as root.

I think most of the popular Linux distributions have been shipping rootless x11 for a few years now, too. Kernel Mode Setting was the big watershed feature.

Interesting, I hadn't known that. Canonical's site indicates that there's some nuance there depending on the video card model though:

https://wiki.ubuntu.com/X/Rootless

Also interesting is that support for rootless (at least in Arch) depends on, or perhaps was facilitated by systemd:

https://wiki.archlinux.org/index.php/Xorg#Rootless_Xorg_.28v...

I don't pay as close attention to Linux developments as I should these days!

OpenBSD and performance are acquaintances, but not really close friends :)

Most (all?) ports than run servers get an unprivileged user all to their own (_dovecot, _nginx, etc). Many (including desktop packages like Chromium) also have pledge() support patched in.

Universe is an Ubuntu thing. Debian doesn't have that distinction. On Ubuntu, universe is basically packages straight from Debian not directly supported by Ubuntu.

Gotcha. My bad. Too much time spent with Ubuntu lately!

In addition to the other things people have mentioned, it also now has vmm/vmd. Also, much of the ported software has patches to make better use of OpenBSD mitigations, some make use of pledge(2).

Reply on news.ycombinator.com