Security Adviser | Roger A. Grimes » OpenBSD column corrections

January 01, 2007 | Comments: (0)

OpenBSD column corrections

TAGS: None

Here are some factual corrections to my OpenBSD column.

My recent OpenBSD column is generating lots of online press in some of the OpenBSD forums. As expected, I'm portrayed as an idiot who has never installed or used anything but Windows.

You can read one of the forum comments here.

Geez, I wonder why more people don't use OpenBSD? Could it be the overly friendly community?

[Actually, with that said, some of the comments were supportive. In any online community you get all kinds, helpful and not so helpful.]

With that said, I want to make sure that I correct anything I said incorrectly in the column. Here are some corrections/additions I agree with:

I said OpenBSD has only had one remote exploit in the kernel. That was incorrect. It has only had one remote exploit in the default install, which includes a lot more than the OpenBSD kernel (bsd). That's a big oversight and needs to be corrected.

\bin and \sbin should be /bin and /sbin, of course.

I said that OpenBSD is shipped with all non-essential services disabled by default. There are some services enabled by default (i.e. sendmail, cron, time, sshd (if you choose to accept the default)...but again these are essential or else the OpenBSD team would not turn them on.

I said that OpenBSD was harder to install and configure than most Linux distros. That's still true, but it isn't much harder, and there are many, many tools (pkg_add, ports, etc.) that make it a piece of cake compared to how tough it used to be years ago.

I said, "They worked hard to scrub every proprietary and non-open piece of source code out of the kernel." That should be applied to all of the default install.

I said FTP supports HTTPS. It should be clarified that OpenBSD's ftp command supports it, but not the FTP protocol. You should be using something else to transfer files anyway, like scp.

I'll print more clarifications in this space as I get them.

Notice that I didn't correct that I'm an idiot.

Posted by Roger Grimes on January 1, 2007 04:05 AM

RATE THIS ARTICLE: