The problem is that less exploits reported doesn't mean less exploits at all 😢 I couldn't find any great journal in this case.

I suggest you ask in a dedicated security group. They'll have a better answer and knowledge to tell you

The problem is that less exploits reported doesn't mean less exploits at all 😢 I couldn't find any great journal in this case.

What's your project? The hacker is waiting for you? to hack you?

I need a secure OS for my project and security is critical in that case. And i just feared after i read few articles about exploits in Linux and OpenBSD.

my suggestion: read and learn security concepts and best practices if you don't know them either install a linux distro or any bsd depending on what you need customize the HELL out of the kernel, disable anything you won't need, especially linux binary compatibility layer, its a perfect hole to exploit on the userland side, remove any packages and don't install any packages you won't need. you can even go a step further by using freebsd ports to customize your packages, compiling them with features you don't want removed, obviously can't exploit code that doesn't exist

But if you are an expert, you can fix and prevent from these things.

its easier to build a structure from scratch than to maintain one that is falling apart

its easier to build a structure from scratch than to maintain one that is falling apart

True.

The problem is that less exploits reported doesn't mean less exploits at all 😢 I couldn't find any great journal in this case.

this is were carefully customizing your OS is important. can't exploit code that doesn't exist also most normal hackers just try to brute force, so picking a good password is already enough to keep them at bay also, who are you trying to secure your system against? this is an important question

So I'm here @n0madcoder

What's your project? The hacker is waiting for you? to hack you?

Yes , i have to install and configure an OS for a company that is secure and have good exploit mitigations. They usually use debian (they formerly used CentOS) for their servers, but they asked me a more secure option. I have tried freeBSD & OpenBSD , but i don't know which OS is better for this purpose.

openbsd and the whole of BSD also suffer from the lack of eyeballs on their code, but they also have the advantage in that since there are less people using them, not many exploits exist for them

Okay no this isn't quite right

See, when you find an exploit, it becomes a vulnerablity

Yes , i have to install and configure an OS for a company that is secure and have good exploit mitigations. They usually use debian (they formerly used CentOS) for their servers, but they asked me a more secure option. I have tried freeBSD & OpenBSD , but i don't know which OS is better for this purpose.

IDK. But many people says "OpenBSD is secure by default".

But

Exploits aren't schrodinger's cats

They don't stop existing if you haven't found them

They don't stop existing if you haven't found them

y'all people also forgot the hardware side stuff like intel management engine amd platform security processor god I fucking hate intel and amd

They don't stop existing if you haven't found them

yeah, someone can just find them and not tell others

y'all people also forgot the hardware side stuff like intel management engine amd platform security processor god I fucking hate intel and amd

You will always have something like the intel ME or the AMD PSP whether you like it or not

Even if you go fully free software

You'll have a foss implementation that works like the intel ME

You will always have something like the intel ME or the AMD PSP whether you like it or not

which is why you have to switch to either ARM, MIPS or POWERPC to be more secure

which is why you have to switch to either ARM, MIPS or POWERPC to be more secure

ARM has trustzone

PowerPC has openbmc

Both do similar stuff to the intel ME

If you want security, the intel ME has to exist

There is no other way to do this

I've also audited powerpc's openbmc

And it is far worse than the intel ME

I don't know about MIPS

If you want security, the intel ME has to exist

what? no you can disable, though its a little tricky also what do you mean an out of bounds processor that has proprietory firmware and has access to everything and is below the main OS in terms of access level is needed for security?

what? no you can disable, though its a little tricky also what do you mean an out of bounds processor that has proprietory firmware and has access to everything and is below the main OS in terms of access level is needed for security?

You cannot disable the intel ME

You cannot disable the intel ME

but you can cripple it to some extent

All you're doing is stripping out code from the ME

but you can cripple it to some extent

Nah you can't

Intel ME has to be the first thing that starts

All you're doing is stripping out code from the ME

well at least its better than nothing

It is responsible for initialising the cpu, protecting the bios from malware and implementing a secure enclave

The only proper way to do security on desktop is with the intel ME

It is responsible for initialising the cpu, protecting the bios from malware and implementing a secure enclave

and I guess that secure enclave gets used for DRM?

and I guess that secure enclave gets used for DRM?

No

There is no DRM here

The secure enclave emulates a TPM

It can do more depending on what the vendor lets it do

The only proper way to do security on desktop is with the intel ME

the "proper way to do it" also has these:

the "proper way to do it" also has these:

Unsurprised

Most of these aren't even ME bugs you realise that?

Most of these aren't even ME bugs you realise that?

well then where do they come from?

well then where do they come from?

Many of those bugs are just due to manufacturers not implementing uefi correctly

The only proper way to do security on desktop is with the intel ME

How can a closed source rootkit can be defined necessary for security?

Many of those bugs are just due to manufacturers not implementing uefi correctly

so it gives me even more reason to strip it down

How can a closed source rootkit can be defined necessary for security?

Open source or proprietary is irrelevant when it comes to security

How can a closed source rootkit can be defined necessary for security?

I was just gonna say this and I agree.

Open source or proprietary is irrelevant when it comes to security

I disagree

Yes , i have to install and configure an OS for a company that is secure and have good exploit mitigations. They usually use debian (they formerly used CentOS) for their servers, but they asked me a more secure option. I have tried freeBSD & OpenBSD , but i don't know which OS is better for this purpose.

MHO: security is a process, a daily process. Security involves the OS, the underlying HW, userspace and, most important, users ... You can have the most secure infrastructure in the World but if you have a user that clicks on everything, uses insecure passwords, ... You're doomed.

I disagree

Well then your opinion is wrong

So, my first question: do you trust your users? I don't

Suggest you pick up a book on software engineering and see what open source and proprietary mean

Well then your opinion is wrong

I think yours is tbh You can’t have security through obscurity

I think yours is tbh You can’t have security through obscurity

I am not giving opinions

I mean, I don't trust YOUR users and I don't trust MINE either 😅

Well then your opinion is wrong

This is literally an opinion

Open source or proprietary is irrelevant when it comes to security

yes it does, while open source doesn't give you a "backdoor-free guarantee", you can still audit it yourself, something you cant do with proprietory software

This is literally an opinion

By definition, open source does absolutely nothing to make software more secure, trustworthy, or stable

We are going by the SE definition of source models here, feel free to look it up

By definition, open source does absolutely nothing to make software more secure, trustworthy, or stable

It can be audited

It can be audited

It's useless

Its not lol

Its not lol

Bugs and vulnerablities are almost never found by reading the code

You're free to see the stats on how hundreds of linux kernel bugs are found every month

You think people sit and read code?

Open source or proprietary is irrelevant when it comes to security

How do you want to verify something is secure if you don't know what it is doing?

https://en.m.wikipedia.org/wiki/Underhanded_C_Contest

How do you want to verify something is secure if you don't know what it is doing?

We can verify the security properties of something without the source

You're free to see the stats on how hundreds of linux kernel bugs are found every month

Linux codebase is fucking huge and not always written by experts. OpenBSD codebase is smaller and constantly audited

This is how debian-hardening-check works

Linux codebase is fucking huge and not always written by experts. OpenBSD codebase is smaller and constantly audited

Not at all

You think people sit and read code?

they don't?

I just said reading code isn't how it works

they don't?

Nah, it's just a bot doing random stuff with the kernel until it crashes

You can’t check for backdoors on proprietary software

You can’t check for backdoors on proprietary software

You can