Hacker News Reader

Comment by buescher | Hacker News Reader

Their development process. Like safety, security is the result of process, not a feature.

The binaries get signed with signify by god knows who. But other than that. Everything goes through unsigned patches via mail. Peers have to reply with "ok". Someone with write access to the CVS has to check it in. How is this process more safe against an xz style social engineering attack?

On top of that, would a direct attack on their CVS even be noticed? I hope so.

Relevant article: https://isopenbsdsecu.re/about/

I don't have a strong opinion about it myself, but the security aspect of OpenBSD is not as obvious as some people make it out to be.

So I can only give a recent example of pinsyscalls(2), which associate a system call to a specific memory address to prevent return-to-libc attacks. It's subtle system/OS stuff that make it secure. You throw that out the window installing third party apps though... OpenBSD is best served pure if security is your main angle.

The purpose of that website is to take down OpenBSD's reputation for security.

Well obviously. The question is, are they wrong to do so?

Actually their stated reason for making the site is that they don’t like the politics of openbsd devs

> Because the OpenBSD community is notorious for not being nice and welcoming:

That's not their reason for believing that obsd isn't as secure as claimed or that their development practices are bad, however, that's just their reason for not directly coming to the obsd developers with the issues instead of just making the problems public for other people to make their own choice about.

And it isn't about the politics of the obsd developers, as I would have thought that website would have made abundantly clear, it's about the fact that the obsd developers are extremely prideful and unwilling to listen to other people's input and have crank-like is used concerning security according to most security professionals, so it would simply be unproductive to come to them with these issues.

So your attempt to insinuate that this website is purely dunking on obsd because their community is insufficiently inclusive or progressive or whatever and has no actual technical merit to it is simply wrong and misleading.

> however, that's just their reason for not directly coming to the obsd developers

In other words they intend to hurt the reputation of people they don’t like rather than fix problems.

They literally said, the website would not exist but for spite.

> obsd developers are extremely prideful and unwilling to listen to other people's input

That describes these sideline critics well. If you show the devs a vulnerability you don’t think they will fix it?

> has no actual technical merit

Well that’s ok because I’m talking about a social problem.

I think it's impossible to tell because there's not enough people who are smart enough to prove that who care enough to do so AND who enough other people will believe. For example, half the people I ask consider Whonix dev Madaidan (and his thoughts on OpenBSD security: https://web.archive.org/web/20220227172102/https://madaidans...) to be wrong, while the other half think he's right. There's no majority consensus because everyone thinks they know better.

Madaidan is a bit of a mixed bag in my opinion — they are probably mostly factually correct in their statement about everything in my opinion, but it seems like they are deeply unfair to Linux (praising other OSes for things they've barely done and then criticizing Linux for barely doing those same things) and have fallen for the flatpak FUD. In the case of their opinion on obsd, I think they seem correct, and their opinion lines up with the other website criticizing obsd so there's that. But you're right, it's hard to know as a layperson.

Reply on news.ycombinator.com