Hacker News Reader

Comment by tptacek | Hacker News Reader

A phenomenal resource on the same subject:

I like this -- despite the clown nose logo, it's actually fair to my eye and is respectful to parts of OpenBSD that are thoughtfully designed.

OpenBSD is thoughtfully designed because it is one of the best examples of "design by dictator" (Theo) - and a small core team - as opposed to design by committee like every other OS out there. Look me in the eye and tell me 90% of changes and unnecessary features in macOS aren't there because some team needs to justify their existence.

What features in macOS are you referring to?

I'm not OP but renaming IOMasterPort to IOMainPort for the sake of renaming alone drove home what a bunch of backwards-incompatible clowns Apple are

I assume you meant to write "disrespectful"?

While much of this document is openly disdainful, there are areas like the malloc implementation[1] and features like the atexit hardening[2] where OpenBSD is unambiguously excellent, and it says as much, noting that the latter is a "pretty cool mitigation".

I used to do some OpenBSD ports work, and even got a tiny patch into the base system. I love OpenBSD! I don't have an axe to grind here! But it is not above reproach, and I think this site is overall harsh but fair.

[1]: https://isopenbsdsecu.re/mitigations/malloc/

[2]: https://isopenbsdsecu.re/mitigations/atexit_hardening/

Besides the clown nose on puffy it's honestly just realistic and not all just talking bad like I've seen some people do:

https://isopenbsdsecu.re/mitigations/pledge/

They are very positive about some mitigations:

https://isopenbsdsecu.re/mitigations/pledge/

Sure. I like pledge --- though I think OpenBSD should just do eBPF too.

Maybe it's just limited resources? In a project that size, I can't imagine having to keep up with the resources of Linux (and to a degree with Apple, Google, and Microsoft) on one side and with all the attackers on the other side. And they want - their reason for being is - higher quality code and security than the rest.

Their 'unusual' approach to security might be a distraction they don't need. But maybe it's the only way to hope to pull it off? Maybe they can't do it the GLAM (Google, Linux, Apple, Microsoft) way with OBSD's resources.

This looks quite concerning: https://isopenbsdsecu.re/mitigations/packages/

Outdated FUD, OpenBSD's Mozilla port maintainer regularly updates and backports non-ESR Firefox to the -stable tree.

https://freshbsd.org/openbsd/ports?q=firefox

Tor browser bundle is also being updated consistently.

https://freshbsd.org/openbsd/ports?q=tor-browser

Reply on news.ycombinator.com