Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If i search for the two words: OpenBSD and NetBSD on:

http://www.exploit-db.com/

then i get 17 hits regarding security bugs on OpenBSD, and 8 hits regarding security bugs on NetBSD.

So what are the differences exactly in the REALITY?

Anybody has any links, that how does NetBSD and OpenBSD audit their code? :O

I'm not trolling, just want the real security! It's not a flame topic..

p.s: if i search for FreeBSD... :\ too many hits to count..

Thank you in anticipation.

share|improve this question

4 Answers 4

up vote 11 down vote accepted

@rook : you should run a diff on the two kernels, after all those years (17 since the split) of divergence there isn't that much that is still common, however there is still cross-breeding between projects and a really good idea will spread all around.

OpenBSD got way more in the way of security architecture, as in compiler support to prevent buffer overflows, address randomization all around so nothing is predictable by an attacker, strict memory protection so writable memory is not executable, that kind of stuff making any bug that would have passed its developers prying eyes way harder if not impossible to exploit. It also makes running insecure software a bit safer.

OpenBSD was also first to introduce many advances, especially in the field of practical cryptography, e.g. stronger password hashing (bcrypt), swap encryption... Stuff that won't affect any exploit count (which doesn't mean much as a security metric, if one didn't find a bug maybe he merely didn't look hard enough) but does a lot for practical security. Also in the practical security part you could see the widespread privilege separation, widespread chrooting as things that should bad stuff happen, will make it a lot less bad...

Disclaimer: I used to be an OpenBSD committer, but it was a long time ago.

share|improve this answer

Is not showing the reality! Is exactly like the bug difference between apache and nginx. apache have a lot more, but this is only because is much more used than nginx.

I don't know anything about NetBSD code audit, but OpenBSD is very serious about that. Read that (Audit Process): http://www.openbsd.org/security.html

If you need a trusted OS, then OpenBSD should be your choice.

Regards

share|improve this answer

NetBSD and OpenBSD are very similar kernels and share. The kernels have a virtually identical architecture and share many of the same features. The project goals between the two are different. NetBSD tries to be the most compatible of *BSD with different processor architectures. All of the *BSD's have the top goal of being very secure, which also means very little features. You should check out the new Debian BSD.

"Complexity is the worst enemy of secuirty" --Bruce Schneier

share|improve this answer
    
NetBSD's kernel: cvsweb.netbsd.org/bsdweb.cgi/src/sys/kern/?only_with_tag=MAIN and OpenBSD's kernel: openbsd.org/cgi-bin/cvsweb/src/sys/kern look rather different to me. –  user185 Apr 1 '11 at 10:57
1  
The kernel source is actually src/sys not src/sys/kern, but yes as I pointed unsurprisingly 17 years of separation took those siblings appart. –  Bruno Rohée Apr 2 '11 at 13:50

The first point I'd make is that the number of hits on a given vulnerability/exploit db is not a reliable indicator of overall security. This could largely be defined by other factors such as the focus of security researcher's efforts or disclosure policies.

Even a quick read over the project websites provides an indicator of the likely comparative security posture between the two. OpenBSD clearly states that one of its core aims "is to be NUMBER ONE in the industry for security". They provide a great deal of information and detail regarding their approach to accomplishing this task. I don't want to repeat @Bruno Rohée's answer but they have implemented a number of advanced security features, pioneered new (and admittedly controversial) versions of commonly used c functions (strlcpy and strlcat, which have since been adopted by NetBSD and FreeBSD), they provide a great deal of information pertaining to their rigorous source code auditing process and ship the operating system in what they call a ‘Secure by Default’ mode.

Although NetBSD is by no means lacking in security by any generalist comparison its core project goals do not make any explicit mention of security:

  • provides a well designed, stable, and fast BSD system,
  • avoids encumbering licenses,
  • provides a portable system, which runs on many hardware platforms,
  • interoperates well with other systems,
  • conforms to open systems standards as much as is practical.

...while OpenBSD’s do:

  • Pay attention to security problems and fix them before anyone else does. (Try to be the #1 most secure operating system.)
share|improve this answer
5  
+1 for making the point that the # of hits on a vuln db is not a reliable indicator of overall security... –  Josh Brower Apr 1 '11 at 2:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.