Hot answers tagged

25 votes

Is installing an old version of OpenBSD on an internet-facing server a security risk?

I have one specific package (moodle) which is not available on newer versions of aforementioned OS (last version of moodle was available on OpenBSD 5.3) which is more than 4 years old. In my opinion ...
Steffen Ullrich's user avatar
11 votes

Is BSD more secure than GNU/Linux?

A secure OS is an OS that is maintained by a sysadmin who knows his job. This trumps everything else. So, basically, when the sysadmin knows all the internal details of BSD, and not of Linux, then BSD ...
Thomas Pornin's user avatar
8 votes

Why do people use "burner phones" rather than Signal or similar solutions?

People do use Signal, and even less secure systems like Whatsapp, to do the kind of communication that has traditionally relied on burner phones. Let's dispense with the spy fantasies first, though: ...
Therac's user avatar
  • 2,650
6 votes

Is installing an old version of OpenBSD on an internet-facing server a security risk?

BSD has nothing to do with it (but it's a good choice). Running older software is quite possible if properly patched. Google and the CVE DB is your friend https://www.google.com/search?q=open+bsd+5....
123456789123456789123456789's user avatar
6 votes
Accepted

OpenBSD is implementing KARL. How does this improve security?

From what I understand, this is a step beyond KASLR. For memory location inferences at a finer granularity than what KASLR protects. With KASLR, you make it harder for ROP gadgets to overwrite (e.g., ...
Sas3's user avatar
  • 2,658
5 votes

Why do people use "burner phones" rather than Signal or similar solutions?

Best practice would be to use a burner android phone along with Signal or another encrypted communications app with an outgoing firewall blocking everything else. Remove all unneeded apps especially ...
8vtwo's user avatar
  • 410
5 votes

Is OpenBSD's low number of exploits really that relevant?

Yes, it's relevant, but you have to understand the context. There are several ways a platform can achieve a low rate of exploitation such as code quality, a hardened configuration, a limited feature ...
user143835's user avatar
5 votes
Accepted

Is there any safe OpenBSD desktop screenlocker?

Altough OpenBSD made some enhancement to improve the security of X11 the problem is the underlying architecture of the X11 system which has no real (i.e. secure) concept of screen locking. This means ...
Steffen Ullrich's user avatar
4 votes
Accepted

How does separating concerns into separate processes (without enforcement) help security?

(Note that I know nothing about the design of OpenBSD ntpd, I'm just answering the generic question about separating processes.) From your quote, I gather that the separation the UDP process from the ...
Gilles 'SO- stop being evil''s user avatar
3 votes

Would FreeBSD and OpenBSD have similar known-past-vulnerability stats if they were configured similarly?

The original question which is answered here was Can CVE stats be used to compare the security of OpenBSD and FreeBSD? Just comparing the CVE is not a reliably way to compare the security of systems....
Steffen Ullrich's user avatar
3 votes

Is there any safe OpenBSD desktop screenlocker?

Ideally, I'd like to be able to leave my laptop unattended, and know that after a few minutes, it'll screen lock itself, so it gets as safe as if the laptop had been powered off and full disk ...
Neil Smithline's user avatar
3 votes

How should I respond to an unrecognized client in my DHCP logs?

You can leverage arpwatch to notify you the second it broadcasts on your network again and also use a tool like Wireshark to capture traffic and see what the device is communicating to (logging DNS ...
Trey Blalock's user avatar
  • 14.2k
3 votes

Is OpenBSD's low number of exploits really that relevant?

OpenBSD has plenty of issues against the base system (see their patches section), past and present. It is not an obscure OS - it is exceedingly well documented, and very popular with people who build ...
user400344's user avatar
3 votes

How does separating concerns into separate processes (without enforcement) help security?

Let's assume that pledge doesn't exist (this design predates it, as I understand it). Obviously this design is pretty pointless on its own, as if the network-facing service is compromised the attacker ...
user7761803's user avatar
2 votes

Why do people use "burner phones" rather than Signal or similar solutions?

The main point of a burner phone is not the privacy of the communications, but to avoid to tie a phone number to an identity. So that when an accomplice is busted by the police and its phone contacts ...
A. Hersean's user avatar
  • 10.6k
2 votes

Is there something similar to Firejail for OpenBSD?

Some developers are working on a sandboxed version of Chromium. I don't know if there is a public diff or not. With pledge and unveil, they can limit the syscalls used and the directories viewed by ...
Rufo El Magufo's user avatar
2 votes

How should I respond to an unrecognized client in my DHCP logs?

I would recommend changing the password for the admin page for your router along with the wireless passwords. Might be a bit of a pain since you have to reconnect any wireless devices but depending on ...
Miguel's user avatar
  • 21
1 vote
Accepted

Would FreeBSD and OpenBSD have similar known-past-vulnerability stats if they were configured similarly?

I didn't stop trying to find answers to my question after posting it, and found a presentation called "Are all BSDs created equally?" by Ilja van Sprundel , who was interested in the same ...
MWB's user avatar
  • 333
1 vote

Would FreeBSD and OpenBSD have similar known-past-vulnerability stats if they were configured similarly?

CVEs are important but I think the question also refers to flaws, and project's ability to respond to them. Indeed, during any security assessment a company could encounter flaws. Later being ...
Ahervi's user avatar
  • 11
1 vote
Accepted

Why does paxtest show OpenBSD as vulnerable?

if anyone interested, correction for the pax topic Sent: Tuesday, October 11, 2016 at 3:57 PM From: "W. Dean Freeman" To: "'Peter Janos'" Subject: RE: RE: OpenBSD PaX Test question ...
Peter84753's user avatar
1 vote

cc-memtest for testing memory security for OpenBSD

From the blog you cite: ..Attempting to run my test application, cc-memtest, ... Which means its the authors own test application so please contact the author of the blog article. Apart from ...
Steffen Ullrich's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible