Hacker News Reader

Comment by harporoeder | Hacker News Reader

It is hard to call OpenBSD an OS focused on security. Beyond pledge their primary focus seems to be "just implement everything correctly and don't run malware". If some utility has an implementation error or you do accidentally run something malicious you are hosed. Compare this to Linux with the extensive use of containerization and things like eBPF for dynamic security measures, or portals as part as flatpak for dynamic application permissions.

View on HN

> Compare this to Linux with the extensive use of containerization and things like eBPF for dynamic security measures

I think it's an interesting comparison study and I'm not convinced either way of The Right Approach. OpenBSD takes the approach "keep the attack surface as small as possible" while Linux takes the approach "let's bolt a bunch of layers together... good luck making your way through all of it"

So many misconceptions in the same answer. eBPF is for observability, and letting you run privileged programs inside the kernel space (even with protections) can actually increase the potential attack surface. Containerization is not and was never a security measure.

eBPF is used for substantially more than observability.

Most of your comment it's bullshit. Containers are not for security, but for convencience and task separation/isolation to avoid the overhead of a vm. eBPF will expose you further more, not less. Also, how can flatpak secure you against a ~/.profile script run at login or an ~/.xprofile one?

A malicious program is going to have a difficult time adding something to your ~/.profile script if it cannot access your home directory. Although I don't doubt that many flatpak programs have too lenient default permissions, and the various XOrg lack of isolation issues are unfortunate somewhat remedied in wayland.

OpenBSD is implementing Wayland if you like it instead of Xenocara.

Again, in which way it's any GNU/Linux distro better then?

See: https://www.openbsd.org/papers/eurobsdcon2023-matthieu-wayla...

Wayland does not stop a process from manipulating the home directory, doing various things on the network, using a ton of memory, recording what other processes exist etc. Once you add all that stuff you start to get something that looks a lot like containers.

OpenBSD has limits.conf and acct(8). Again, RTFM.

Obviously OpenBSD has some limited mechanisms for managing RAM usage and open file descriptors, just like every other system.

Reply on news.ycombinator.com