Comment by asveikau | Hacker News Reader

Comment by asveikau | Hacker News Reader

Parent Full thread

I think the review on that website is actually more mixed than "axe to grind". I just spent some time reading the "mitigations" section. Some mitigations are criticized as questionable or easily defeated, but others are praised for a good implementation.

At any rate, I think some people may forget what stock Linux distros or even a commercial *nix install used to look like at the default install, before people like the OpenBSD folks raised awareness of some of these issues. In the late 90s I recall default installs elsewhere that had a bunch of ports open and no firewall right out of the box in a default install. In the same timeframe OpenBSD was making a bit of a PR-ish stink about a secure default install. In the same timeframe OpenSSH came on the scene.

But honestly, there are a few things that OpenBSD is only really just starting to get really right in the last few years. syspatch and pkg_add-able binary updates in the stable branch are two that come to mind. Also sysupgrade; I used to dread upgrading OpenBSD [xkcd had the joke about it leading to shark attacks], but now it's really simple.

If you look at some of the comments, sources, and just the attitude of the guy that put this together it seems he does have an axe to grind. It kinda says so in the about section. I think if you dive into the mitigations section without looking at that it seems less like that because he ends up having to admit some of them are decent ideas... try as he might to come up with ways in which they're not. There are plenty of OpenBSD users going around talking nonsense but this "systematic evaluation" is not an actual systematic evaluation.

I especially like the part where it lists people who helped but it's all redacted. All of this "research" came from google and twitter. I'd like to see some bypasses to OpenBSD's mitigations and perhaps some ideas and/or code to help improve them or implement ones that these folks say work better. If they're all so bad then it shouldn't be hard for someone like the author or so called security experts he quoted to do these things. Yeah, maybe no one is going to pay for that work to be done... that seems to always be the response when someone asks for proof, code, etc. No one has the time. They sure spend enough time making websites, blog posts, and tweeting about it though.

The guy who wrote this did a talk about it, this website was to list sources etc. I’m an OpenBSD user and I did not personally feel like he had an axe to grind, and overall thought he was fair and had well made points. I’ll be the first to admit a lot of what he said was rather too technical for me, but if I’m remembering correctly I never saw many counter points to his claims.

I personally feel that OpenBSD is more secure for my use case, but I’m happy that people bring up points like this as humans make mistakes and not even OpenBSD is perfect.

I watched the talk. The guy was wearing a t-shirt with the OpenBSD mascot with "got hacked" under it. Again if you read the about section it seems pretty clear. You're parroting the same language from the talk. Why should there be counter points to some random internet person's claims? Where are those bypasses at? Where are the patches to incorporate these better mitigations or to improve existing ones?

I don't think OpenBSD has perfect security and I'm not sure why that needs to be said. I don't see anyone involved in the project making that claim either. What I'm saying is this talk/website is just as dubious as some of y'all think OpenBSD mitigations are and if that's not obvious from looking at the sources I'm not sure what else to say here.

Reply on news.ycombinator.com