<story><title>OpenBSD is a cozy operating system</title><url>https://btxx.org/posts/OpenBSD_is_a_Cozy_Operating_System/</url></story><parent_chain><item><author>laweijfmvo</author><text>ELI5 why the “xz drama” couldn’t happen on openBSD? do they not use open source packages? are they assuming they would have caught it before adding the infected version to their repos?</text></item></parent_chain><comment><author>jcranmer</author><text>It depends on what is meant by &amp;quot;xz drama&amp;quot;.&lt;p&gt;If you consider it to refer to the supply chain attack, well, OpenBSD is too minor a platform for anyone to consider it worthwhile trying to invest in the long supply chain attack for the OS.&lt;p&gt;If you view it as the break-xz-to-attack-sshd, OpenBSD is designed as a single system with a single codebase, and has a general aversion to features such that it is difficult for an undersecured random library to become a vehicle to breaking a major, important component.&lt;p&gt;If you view it as the techniques used to publish an exploit in open source code, well, OpenBSD is filled with the kind of developers whose self-confidence is such that they believe that they are uniquely capable of writing code without those kinds of issues and will denigrate the use of newer technologies that mitigate that risk with the attitude that it coddles programmers and coddled programmers aren&amp;#x27;t good programmers. Or, in shorter terms, OpenBSD is actually one of the projects I&amp;#x27;d expect to have a relatively high chance of a clever contributor being able to smuggle in an exploit in plain sight.</text></comment>
<story><title>OpenBSD is a cozy operating system</title><url>https://btxx.org/posts/OpenBSD_is_a_Cozy_Operating_System/</url></story><parent_chain><item><author>laweijfmvo</author><text>ELI5 why the “xz drama” couldn’t happen on openBSD? do they not use open source packages? are they assuming they would have caught it before adding the infected version to their repos?</text></item></parent_chain><comment><author>shrubble</author><text>If you run the &amp;#x27;ldd&amp;#x27; tool against OpenBSD&amp;#x27;s ssh, you get 4 libraries. If you do the same on different Linux distros you get many more; this means the surface area is much larger.</text></comment>