36C3 - A systematic evaluation of OpenBSD's mitigations

What people said

jron · 2021-03 · Recommendation

Here is the presentation which provides more context than the slides alone: [VIDEO] I've watched it before and it is compelling; however, at the end of the day, an OS that tries to take security seriously is probably better than one that doesn't. The OpenBSD code is small and I suspect that the defects/KLOC is far less than other projects capable of routing. I'd love to hear more critiques for using it as a home router though.

Read the original HN comment ↗

DEADMINCE · 2024-06 · Reference

I wouldn't say it's missing. I deliberately generalized. I mentioned RBAC as an example. If people want to learn more there is no shortage of info. There was even a talk[0] at the 36th CCC. [0] - [VIDEO]

Read the original HN comment ↗

vngzs · 2023-12 · Criticism

Indeed, in CCC's "systematic evaluation of OpenBSD's mitigations"[0] the presenter explicitly calls out OpenBSD's tendency to present mitigations without specific examples of CVEs it defeats or exploit techniques the mitigations are known to defend against: > Proper mitigations I think stem from proper design and threat modeling. Strong, reality-based statements like "this kills these vulnerabilities," or "this kills this CVE; it delays production of an exploit by one week." And also thorough testing by seasoned exploit writers. Anything else is relying on pure luck, superstition, and wishful thinking. Some of OpenBSD's mitigations are excellent and robust in defensiveness; others are amorphous and not particularly useful. [0]: [VIDEO]

Read the original HN comment ↗