Hacker News Reader

Do they ?

I have watched very closely for 20 years now for any chatter or evidence of a FreeBSD/OpenBSD zero-day vuln that was weaponized or sold or used for state-sponsored covert action and I am not aware of any.

None of the leaked information from Snowden, et. al, gave any evidence of their existence either.

Technically speaking they should exist but I'm not seeing them ...

View on HN

Here you are: https://vuxml.freebsd.org/freebsd/6f4d96c0-4062-11e7-b291-b4... aka SambaCry

That's a samba vuln, not a FreeBSD vuln in particular ...

Further, if you were worried about attackers or hardening a system, etc., you wouldn't be running samba (or anything like it).

I'm talking about a remote-root vuln in the FreeBSD kernel or in any of the default system daemons that were bundled with an OS release (like openssh, crond, syslogd, etc.)

In all honesty, there are probably both zero days for both BSDs (the software was written by humans after all) and great reasons to prefer them that don't involve this argument. I'd finger the "security ethos" of OpenBSD in particular.

Because the NSA is keeping those secret so they can still use them. All these recent 'leaks' are just misdirection so when OpenBSD becomes the defacto standard PC OS they still have a way in ;)

Reply on news.ycombinator.com