The number of OpenBSD's known vulnerabilities is tiny, but so it's the number of users. How significant is this scarceness of exploits found?

  • You use applications with OpenBSD. How many vulnerabilities do they have? How many features do they have (compared to other OSs)? Maybe you should look at the bigger picture. – A. Hersean Apr 3 '17 at 22:38
  • It's not so much the number of users that affects OpenBSD's security as a restricted set of base software and paranoid default configuration. – Xiong Chiamiov Apr 4 '17 at 5:34
  • People that use highly secure software don't often go blabbing about which software they use... – Neil McGuigan Apr 21 '17 at 18:14

Yes, it's relevant, but you have to understand the context.

There are several ways a platform can achieve a low rate of exploitation such as code quality, a hardened configuration, a limited feature set, and obscurity. There's no doubt that OpenBSD benefits from obscurity to some degree - if it were as popular as Linux or Windows, many more people would be scrutinizing it. However, it's had so few exploitable flaws over time that you can't simply write off it's track record as obscurity alone. Other platforms of a similar size usually contain many more exploitable bugs.

OpenBSD has consistently emphasized code quality over features, and has always minimized the number of services listening by default, so there just isn't much attack surface. It's a minimalist OS compared to Linux and Windows, so it's really a different animal.


OpenBSD has plenty of issues against the base system (see their patches section), past and present. It is not an obscure OS - it is exceedingly well documented, and very popular with people who build infrastructure. And others. But I suppose the text install program puts people off.

It is my understanding that its standard services (not ports) are particularly hardened against remote exploitation (now with pledge and nowxallowed, before that a number of other measures, not just privsep and chroot).

It doesn't include a ton of weird software into userland by default, and that is one reason there are so few exploits against it.

Also there is the perhaps unique feature of /etc/malloc.conf, which enabled an operator to preempt misbehaving programs.

OpenBSD isn't into 'rapid growth at any cost'. The core kernel developers are not quite as hopping mad as Linus Torvalds, who has himself admitted that things are being submitted to the Linux kernel, that even he does not understand - although he can veto submissions, what good is that if he blindly accepts contributions?

The code base of OpenBSD is not particularly small, but kept terse and readable, and often tedu'ed (trimmed). Anyone can read it and understand enough to make it worthwhile.

Your Answer

