2

I have been reading about OpenBSD and its more secure design. I was wondering therefore about the difference this makes to applications which can run on any number of OS.

Lets take the example of a web browser, which are known to have many vulnerabilities. The browsers code is likely to be similar across all OSs, with some differences, but for the most part the design will be comparable. What I want to know is, does the apparent extra security of OpenBSD mean that the present vulnerabilities (which are likely to be similar across each OS) are less of a worry in OpenBSD? Or is the extra security limited to a more general set of use cases?

|improve this question
  • Your question should be closed as it is both primary-based opinion and too broad. Every OS (including MS Windows) claims its security features, but none of them is 100% and you can not really compare them because everything depends on your needs. As for OpenBSD you will find a long list of security vulnerabilities here – user45139 Oct 20 '15 at 13:20
  • @Begueradj: Your link is not correct: it links to vulnerability affecting any software developed by the OpenBSD group on any platform. Here is the correct link about security issues affecting the OpenBSD OS product, the most recent is from 2014, the next older from 2011. – WhiteWinterWolf Oct 20 '15 at 14:20
  • @WhiteWinterWolf Yes, also about tools adapted for OpenBSD, sure. Good that you shared that link. Thanks – user45139 Oct 20 '15 at 14:23
2

As OpenBSD documentation clearly states it in bold red characters in their introduction about ports:

The packages and ports collection does NOT go through the same thorough security audit that is performed on the OpenBSD base system. Although we strive to keep the quality of the packages collection high, we just do not have enough human resources to ensure the same level of robustness and security. Of course security updates for various applications are committed to the ports tree as soon as possible, and corresponding package security updates are made available as snapshots for -current.

This means a few things:

  • OpenBSD security claims is only valid as long as the base system is concerned.
  • Security updates for the third-party packages will only be applied on the package source code from the ports tree and the -current branch. They will not be available for binary packages, even-though binary packages is the officially recommended way to go to install third-party software.
  • It also mentions a lack of resources which also explains why the software version available for OpenBSD may be outdated, which can have security impact for the end-user.

With all this in mind, the security posture of the OpenBSD OS regarding third-party software is quite bad. Hopefully, a third-party commercial company (M:Tier) provide its own update channel for OpenBSD users to make things a bit better.

OpenBSD goal is to promote clean and sane coding measure and a "Secure by default" OS. While installing third-party package remains possible, this may affect this goal and should be done with a clear understanding of the consequences on the overall system security.

|improve this answer
  • This is exactly the kind of information I was looking for. Thank you so much. Great response. – Ekrem Oct 20 '15 at 18:17
  • @Ekrem: I'm glad if I helped you. Do not forget to upvote and/or mark as accepted answer if this answer matches your needs :) ! – WhiteWinterWolf Oct 21 '15 at 9:23
0

Not an expert at all, but OpenBSD security is on "default installations". I don't know how it's right now, but last time I installed it came without browsers, so my assumption is that if it's a hole in the browser you would still be vulnerable to it, as long as that hole doesn't exploit any feature in the "default installation"

This is not taking in account 0-days

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.