>in one of the most heavily audited codebases

The idea of "OpenBSD is super duper secure" is mostly a fiction. Their prime claim to fame, "only two remote holes in the default install in a squillion years", is pretty meaningless because the default install doesn't really do anything, so as soon as you install packages to make the system useful you're beyond their security claims.

Classified workstations in National Security contexts? They run Windows.

Red network routers? They're Cisco, Juniper, PAN, etc. It's all COTS stuff. OpenBSD is mostly a LARP.

▲

socializer an hour ago | parent | next [-]

> is pretty meaningless because the default install doesn't really do anything

Which is a good thing. An important thing. The reason you're stuck in a perpetual update cycle for most Linux distros and for Windows is that they ship with an insane number of things that most users have no need for. Yeah, every laptop definitely needs NetBIOS and iSCSI and UPnP turned on by default.

It's true that everything you add on top of the OpenBSD baseline increases your attack surface, but it's a saner approach than shipping with a gigantic attack surface and then forcing you to know about and disable the things you don't need.

> Classified workstations in National Security contexts? They run Windows.

Which is almost certainly a combination of the complexities of govt IT procurement, the needs of non-technical users who may only be familiar with Windows & MS Office, and the enterprise management features of Windows that aren't as good in most other OSes.

	▲	mschuster91 2 minutes ago \| parent [-]
		> Which is almost certainly a combination of the complexities of govt IT procurement, the needs of non-technical users who may only be familiar with Windows & MS Office, and the enterprise management features of Windows that aren't as good in most other OSes. ... and if I were to guess, there's definitely backroom deals between the US government and Microsoft. There's no way all the phone home stuff is even included in "Windows for SCIF".

▲

SoftTalker an hour ago | parent | prev | next [-]

The base install includes a firewall, http server, load-balancer/proxy, ldap server, caching DNS resolver, ssh server, nfs server, dhcp server, smtp server, bgp routing daemon, virtual machine subsystem, and a lot of other stuff I'm probably forgetting.

▲

e12e 4 minutes ago | parent | next [-]

But if you look at the security track record of opensmtpd, you'll quickly see that "Only two remote holes in the default install, in a heck of a long time!" Does not relate to the base system, but to the "default install" - that is; only sshd listening (and possibly pf).

IMNHO more interesting than bickering over the "secure" label, is all the work openbsd has done and is doing to develop stuff like pledge.

▲

raddan 31 minutes ago | parent | prev | next [-]

Yes, but with the exception of sshd (which you get asked about during install), none of these things (NONE!!!) is enabled by default.

I am probably misremembering, but the OpenBSD documentation used to even explain how to disable inetd if you were too paranoid to use that. It is now disabled by default, and--I just checked one of my running systems--my machine does not even have an /etc/inetd.conf file. Most of the things running on a default install are init, cron, slaacd, a handful of gettys, ntpd, syslogd, and sndoid. Arguably sndiod is the only thing you could really remove from that list.

▲

SoftTalker 15 minutes ago | parent [-]

Why should any of that be enabled by default?

The claim was that you had to install packages to make the system useful, but it in fact has a lot of useful stuff included.

	▲	0l 7 minutes ago \| parent [-]
		The fact that vulnerabilities in the packages you mention wouldn't count towards the "2 remote holes" as they're not enabled in the default install?

▲

throwaway7356 an hour ago | parent | prev | next [-]

It doesn't matter as they are not enabled by default.

So even if they allow unauthenticated code execution as root or kernel by default when started, it would not count for the "remote hole in default install" claim.

You could as well just not enable network by default. Which makes Windows 95 safer than OpenBSD.

▲

sippingabonedry 35 minutes ago | parent | prev [-]

You're forgetting their SMTP server had a remote root RCE a few years ago, their IPSec server an authentication bypass, etc.

Both of these were logic bugs and not "insecure C code".

▲

Hikikomori 36 minutes ago | parent | prev | next [-]

Cisco runs mostly Linux. Juniper uses freebsd and Linux.

▲

anthk 35 minutes ago | parent | prev | next [-]

OpenBSD was used under NDA's in some really sensitive corpos with Gnome2 setups and some RDP/Citrix clients and even Perl?+GTK2 wireless graphical assisatnt.

https://www.mtier.org/solutions/consulting/

If OpenBSD had a stable GeFS setup as a filesystem -still WIP- (and toad/hotplugd for external FS' mounting) it could get customers in no time, because today except for CUDA the rest can virtually work 100% the same as any Linux distro.

▲

zoeysmithe 17 minutes ago | parent | prev [-]

I think there's this cultural bias about the 'boy genius open source coder' that of course isn't true at all. Open source code is at the same quality as corporate written closed source code, in general. There have been studies on this and open vs closed source code isn't very different in terms of defects and exploits.

The problem is the people most willing to buy into this cargo cult mentality are techies, so tech forums are the last place to really have this conversation based on facts. Hence why your comment is barely visible here due to its low karma.