A 36C3 talk that systematically evaluates OpenBSD's exploit mitigations, asking how effective they really are and what they cost in performance, complexity and inspectability. It challenges the project's security marketing.
Why Hacker News points people here: Cited in OpenBSD threads as a skeptical, evidence-based counterpoint to claims about its security, though some dispute its objectivity.
“the presenter explicitly calls out OpenBSD's tendency to present mitigations without specific examples of CVEs it defeats”HN comment, 2023
Presentation with more context than the slides alone.
Full comment
Here is the presentation which provides more context than the slides alone: this video I've watched it before and it is compelling; however, at the end of the day, an OS that tries to take security seriously is probably better than one that doesn't. The OpenBSD code is small and I suspect that the defects/KLOC is far less than other projects capable of routing. I'd love to hear more critiques for using it as a home router though.
Cites itq3kMay 2020
“Here's a recent talk evaluating OpenBSD's security mitigations”
Talk evaluating OpenBSD security mitigations, with some objectivity disputes.
Full comment
Here's a recent talk evaluating OpenBSD's security mitigations: this video The objectivity of it is up to debate though, some argue that it is biased/unfair.
Cites itDEADMINCEJun 2024
“There was even a talk[0] at the 36th CCC.”
Talk on OpenBSD mitigations at CCC.
Full comment
I wouldn't say it's missing. I deliberately generalized. I mentioned RBAC as an example. If people want to learn more there is no shortage of info. There was even a talk[0] at the 36th CCC. [0] - this video
CriticalMonkeyClubOct 2022
“some people have argued that de Raadt (and the OpenBSD team) are not paranoid _enough_”
Full comment
Yeah he doesn't seem paranoid at all, just very aware of what holes the tech stack has. In fact, some people have argued that de Raadt (and the OpenBSD team) are not paranoid _enough_: this video "36C3 - A systematic evaluation of OpenBSD's mitigations"
CriticalpseudostemDec 2022
“there are a few video's [0] and blog posts dissing OpenBSDs security claims.”
Full comment
I use OpenBSD as a daily driver. To make GP's point though, there are a few video's [0] and blog posts dissing OpenBSDs security claims. [0] this video
CriticalvngzsDec 2023
“the presenter explicitly calls out OpenBSD's tendency to present mitigations without specific examples of CVEs it defeats”
Full comment
Indeed, in CCC's "systematic evaluation of OpenBSD's mitigations"[0] the presenter explicitly calls out OpenBSD's tendency to present mitigations without specific examples of CVEs it defeats or exploit techniques the mitigations are known to defend against: > Proper mitigations I think stem from proper design and threat modeling. Strong, reality-based statements like "this kills these vulnerabilities," or "this kills this CVE; it delays production of an exploit by one week." And also thorough testing by seasoned exploit writers. Anything else is relying on pure luck, superstition, and wishful thinking. Some of OpenBSD's mitigations are excellent and robust in defensiveness; others are amorphous and not particularly useful. [0]: this video
