Hacker News Reader

Comment by chungy | Hacker News Reader

The line has to be drawn somewhere. The default install with default settings is a reasonable enough one. Consider that Linux distros and Windows frequently have remote exploits in their default-install/default-state systems. One can enable services and misconfigure a base system to have remote exploits (is enabling telnet and not having a root password a fault of OpenBSD, or the admin?).

Once you start installing software from ports (as you're likely to do to use it as a desktop), are you going to blame the OpenBSD guys for the quality of software outside of their control? I hope not. :)

View on HN

>are you going to blame the OpenBSD guys for the quality of software outside of their control?

Of course not, that's my point. In order to make an OpenBSD system usable for more than a rudimentary firewall, you need to step beyond the security claims that OpenBSD makes.

So the "only two holes" track record doesn't really mean much if you're installing software from ports, which nearly everyone does.

I still don't get it.

The alternative would be for all OSes to run services X,Y and Z even if you install it in order to host service W. Also, you would then be "happy" to get remote rooted on your W service box, when attackers found an exploit in Y, just so that the box was not "empty" of services?

Even if you meant to run service X or Z, it would still be "better" to have the exploitable Y running by default, just so the system wasn't bare or so that they could not have that line on the webpage?

If you don't want to get exploited by default when you put your box on the internet, and these people have a method to get you there AND others tried running all fancy services exposed and did get hacked within minutes after putting such a box on the internet, would you still say "not exposing your box immediately" is a bad idea? Is it cheating somehow to not participate in the race to the bottom?

A simple, reliable, and secure "rudimentary" firewall in 2021 is very useful.

The security promise "best effort", they do not make guarantees, is very useful

I really do not see a problem

I would not conflate the tag line about remote holes in the default install with the security features OpenBSD provides [1]. Of which both base and ports benefit from, not to mention the patches for things like Chrome and Firefox to make use of pledge(2) and unveil(2).

[1] https://www.openbsd.org/innovations.html

Reply on news.ycombinator.com