Props for the OpenBSD Release -style graphics. Looking forward to the theme song.

NetBsd os the King. Most portable operating system (not just kernel) on the Planet.All back to 1978 VAX&#x2F;780 - still working from single base sources as x86 or ARM

Interestingly, looks like this was accidentally fixed in NetBSD during a rewrite of that code in August of 1999.

Every blog post on this site is AI generated and covers bugs and exploits that were uncovered also by AISo, sort of like fuzzing. There&#x27;s a scary amount of exploitable stuff like this sitting in every BSD and Linux system out there, including every embedded system running old kernels in routers, cars, plcs, on and on

It&#x27;s not as heavily audited as you think. They have like a dozen active developers.

Not that remarkable. Nobody in history has been able to write correct C code, and that includes OpenBSD developers.I pointed an AI at the smallest two tools in OpenBSD I could think of, cat and find, and found multiple bugs. One of which was a buffer overflow (albeit unlikely to be exploitable). IIRC these bugs had existed since at least the NetBSD&#x2F;OpenBSD split.Everything in C is UB: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=48203698">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=48203698</a>

&gt;in one of the most heavily audited codebasesThe idea of &quot;OpenBSD is super duper secure&quot; is mostly a fiction. Their prime claim to fame, &quot;only two remote holes in the default install in a squillion years&quot;, is pretty meaningless because the default install doesn&#x27;t really do anything, so as soon as you install packages to make the system useful you&#x27;re beyond their security claims.Classified workstations in National Security contexts? They run Windows.Red network routers? They&#x27;re Cisco, Juniper, PAN, etc. It&#x27;s all COTS stuff. OpenBSD is mostly a LARP.

Heavily audited might be a stretch. Who did the audit and what knew to look for is key. I wonder if they are using agentic tools to help improve the frequency and quality of their audits. Volunteer time is precious and getting robots to help might be useful, but I can also see it taking more of that same volunteer time to get good results from the robots. Either way, its their project and and they&#x27;ll do as they deem fit, which is totally fine.

It’s remarkable that a bug survived 37 years in one of the most heavily audited codebases, which shows how hard some kernel bugs are to catch by review alone. Do you think fuzzing or static analysis could realistically have found this class of bug, or did it need a human thinking about the exploit primitive?

&gt; Only two remote holes in the default install, in a heck of a long time!This isn&#x27;t remote (and I don&#x27;t think the only local in recent times) - so, no - they won&#x27;t have to update.

Poor OpenBSD guys. Now they have to acknowledge THREE exploits
(in total) on their homepage.

the ai-generated graphic before any content is presented is kind of a turnoff

Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD