I tend to look at OpenBSD as a sort of "security incubator" program, where good security ideas and practices have the chance to grow. I think that the biggest impact of OpenBSD tends to be felt in OTHER operating systems and on the internet at large.

One of the big areas where OpenBSD has pushed things forward, in my opinion, is defense-in-depth for software. They put a lot of effort into maintaining high coding standards and an emphasis on correctness. They've been active in the area of exploit prevention and detection-- they were the first to really do W^X, they've been using ProPolice by default since forever, they randomize memory addresses, etc. But they're also very active in exploit mitigation-- that is, if we start by assuming that a program IS going to have a security bug, how do we limit the damage? OpenBSD has invented or popularized techniques like privilege separation, their "pledge" and "reveal" systems, and various other forms of sandboxing.

There's also the crypt side-- their work on cleaning up OpenSSL to create LibreSSL has been an incredible service. OpenSSH has been adopted EVERYWHERE. Their work has done a LOT to reduce the amount of unencrypted traffic going across the internet generally.

I think it's comparable in terms of features, and many of those features even originated or have canonical implementations that started under the umbrella of OpenBSD. Also some of the most sane defaults, and simple install process, of any OS I've ever used.

I think where OpenBSD really shines though is the documentation. Most issues I run into can be solved by reading the man pages included with the default install.

Also the video linked by q3k elsewhere in this thread is a great watch.

For a long time OpenBSD was focussed on security through correctness and code review, so that portion is not necessarily reflected in any of the grsecurity/pax type hardened linuxes.

But OpenBSD does have things like ASLR and kernel address randomization, advanced memory protection (W^X etc) and while it doesn't have ACLs or PAM it has pledge which is a great way of restricting system call access at the program level.

Since they keep userspace stable, they generally have more stable programs running there as well.

For instance, systemd has has multiple remote exploits in a time window when the default OpenBSD base install has had zero.

Moving up the stack, OpenBSD often rewrites or simplifies important daemons (like httpd), and those tend to have closed or mitigated security holes before upstream exploits are discovered.

OpenBSD focuses on securing things at the source level. Hence all the compiler tricks to mitigate memory safety bugs, API for programmers to limit syscall exposure, privilege separation within individual programs, drive to avoid unnecessary complexity so the source is readable etc.