Hacker News new | past | comments | ask | show | jobs | submit
pianopatrick | on: A thousand fewer paths to root
Because the large corporations that fund Linux development and use Linux value speed over security.

Speed requires a lot of code in the kernel, where that code can run fast.

There are kernels that do not have a thousand privilege escalation exploits. These kernels are smaller and much easier to check for bugs. But those kernels are significantly slower.

For many use cases, slower is not a problem. But for the large corporations who fund a lot of Linux development and use Linux in large data centers, every 1% slower can literally be millions of dollars worth of additional servers that are required.

OpenBSD shows that you can have a Unix security model without a thousand privilege escalation exploits. But OpenBSD is like 10% slower. So corporations won't use it because it would cost millions of dollars more per year and some of their software requires access that OpenBSD does not grant precisely because that access leads to security exploits (i.e. io_uring, eBPF etc. etc.)

You could also use like seL4, but that's slow too

So that's why. It's a business tradeoff between cost of servers vs cost of getting hacked, and cost of servers wins.

thomashabets2 | parent | next
You're painting a picture that code written with love is perfectly safe. It's not.

Yes, openbsd has not had a torrent of bugs found, but I would say that the vastly bigger reasons for that are: 1) orders of magnitude people care about burning tokens and money to find the bugs in an OS almost nobody uses, and 2) it's simply much smaller. Can't have Bluetooth bugs if you don't have a Bluetooth stack.

I've pointed LLMs at obsd stuff, and even the simplest code, e.g. cat & find, had bugs and buffer overflows.

OpenBSD also has a poor patch tracking system, since they're still on CVS. A patch has an extremely good chance of just falling through the cracks. Security or not.

So no. Nobody can write safe C. Not hobbyists, and not "those evil corporations".

pelagicAustral | root | parent | next
> an OS almost nobody uses

Don't hold back...

za_creature | root | parent
> even the simplest code, e.g. cat & find, had bugs and buffer overflows.

Did you report these findings? Because I think those bugs are live Canada, with your girlfriend.

asdff | parent | next
Cost to getting hacked doesn’t even seem to be real so the incentive couldn’t be lower. How many times has sony or psn been hacked now? Just doesn’t matter at a certain scale of companies. Banks get hacked too. Huge companies of all sorts of industries. All my info is probably leaked on darkweb, same with yours. And to what end. What material end. I don’t face it. Sony doesn’t. Who does? Anyone? So many hacks you read stories about yet never a story about someone actually getting materially screwed in their real life. Somehow. I’m really not sure how. Seems like the wheels should have come off decades ago but we continue on like nothing. Another leak tomorrow and we will continue on like nothing. More exploits. More zero days. The sun will still rise.
wormius | parent | next
I'm pro OpenBSD, but the question to me seems: Has this been tested via the same means as these new Linux exploits?

I'm also pretty hostile to AI, but do recognize that these machines seem to be very good at finding exploits.

I'm sure there've been some some projects out there working to pentest/find cracks in OpenBSD via LLMs/agents/whatever-the-right-term-would-be...

But it is true the attack surface is much lower in OpenBSD on purpose, so hopefully it is overall more secure. But I'd like to see the numbers.

angry_octet | root | parent | next
BSD is used by very few computers. Important ones perhaps, but it isn't at the top of many target lists.
pianopatrick | root | parent
I think there was something found a while ago, but only one or two things not thousands.

I think the only OS that's truly survived the agents looking at it was sel4, but I could be wrong.

x-complexity | root | parent
> I think there was something found a while ago, but only one or two things not thousands.

Then they need to check again now. The frontier models 6 months ago have been leapt over by the current frontier models.

Gigachad | parent | next
It also used to just be fine patching the bugs as they were found. Its only recently where that model has fallen apart and we now need to prevent the bugs from existing in the first place.
| root | parent | next
{"deleted":true,"id":50374483,"parent":50374032,"time":1793846828,"type":"comment"}
| root | parent
{"deleted":true,"id":50375572,"parent":50374032,"time":1793856640,"type":"comment"}
anabis | parent | next
> Speed requires a lot of code in the kernel, where that code can run fast.

I did a double take when hearing about ksmbd. Brings back memory of khttpd and Tux.

They should build a monokernel implementation of CIFS and be done with it.

fguerraz | parent | next
OpenBSD shows nothing. It’s insignificant and nobody is actively looking for flaws in it.
loading story #50378071
Gud | root | parent
OpenBSD gave you OpenSSH and many interesting technologies. Hardly “insignificant “…
Geezus_42 | root | parent
It did, yet almost no one uses the OS itself.
Gud | root | parent
OpenBSD is a software distribution, that can be used as an operating system. To claim OpenBSD is “insignificant” is simply wrong.

OpenBSD components are widely used. OpenSSH is one example used by most of HN.

OpenBSDs libc is also used by Android as another example. Also widely used.

reassess_blind | parent | next
Even if they had prioritised security above all else, there would still be vulnerabilities to be found. Probably fewer, but definitely not zero.
7e | parent
OpenBSD has plenty of security vulnerabilities. It’s just that nobody cares, so OpenAI doesn’t dedicate resources to finding them.
asdff | root | parent
All the handwringing about what if digital security vulnerabilities when the real one has always been social engineering in the meatspace. Corporations would go a long way security wise employing eunuchs to c suite like in centuries past.