Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

One thing to know about openbsd is that the default OS install and built-in services are mostly secure, but any third-party stuff you install is not guaranteed to be, and can be a vector for compromise.

If you intend to use it as a desktop OS, the amount of things you have to add will likely greatly increase the surface area to secure.

We once had a breach where through an insecure third-party service (I forget but it may have been some PHP script), someone managed to execute a remote payload on an openbsd server.

Luckily, the payload assumed a Linux system with an available C compiler, and it failed to “explode” in the alien openbsd environment.

To sum up, openbsd is indeed more secure but it’s not a panacea. As long as you follow best personal computing security practices you should be ok with either Linux or Openbsd.



Firefox and chrome has been patched with pledge(2) and unveil(2). That means these items have very limited access to your system and disk. Those are usually applications people get compromised by.

For Firefox, the settings are in: /etc/firefox/policies/

IMO, pledge(2) and unveil(2) are better than anything Linux and other OSs have for sandboxing.


But they also have more kernel features to secure all software, such as pledge.

You will often see major software which runs fine on Linux segfault on openbsd.


On the Linux side, aren't Flatpak and Podman enough, and even more granular, to limit file system access in the absence of pledge?


It does a lot more than limit file access. Plus most applications don’t come in a flatpak, nor do I want them to.

You can read more about pledge and the bsd specific kernel features on their site.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: