You're painting a picture that code written with love is perfectly safe. It's not.

Yes, openbsd has not had a torrent of bugs found, but I would say that the vastly bigger reasons for that are: 1) orders of magnitude people care about burning tokens and money to find the bugs in an OS almost nobody uses, and 2) it's simply much smaller. Can't have Bluetooth bugs if you don't have a Bluetooth stack.

I've pointed LLMs at obsd stuff, and even the simplest code, e.g. cat & find, had bugs and buffer overflows.

OpenBSD also has a poor patch tracking system, since they're still on CVS. A patch has an extremely good chance of just falling through the cracks. Security or not.

So no. Nobody can write safe C. Not hobbyists, and not "those evil corporations".

Cost to getting hacked doesn’t even seem to be real so the incentive couldn’t be lower. How many times has sony or psn been hacked now? Just doesn’t matter at a certain scale of companies. Banks get hacked too. Huge companies of all sorts of industries. All my info is probably leaked on darkweb, same with yours. And to what end. What material end. I don’t face it. Sony doesn’t. Who does? Anyone? So many hacks you read stories about yet never a story about someone actually getting materially screwed in their real life. Somehow. I’m really not sure how. Seems like the wheels should have come off decades ago but we continue on like nothing. Another leak tomorrow and we will continue on like nothing. More exploits. More zero days. The sun will still rise.

I'm pro OpenBSD, but the question to me seems: Has this been tested via the same means as these new Linux exploits?

I'm also pretty hostile to AI, but do recognize that these machines seem to be very good at finding exploits.

I'm sure there've been some some projects out there working to pentest/find cracks in OpenBSD via LLMs/agents/whatever-the-right-term-would-be...

But it is true the attack surface is much lower in OpenBSD on purpose, so hopefully it is overall more secure. But I'd like to see the numbers.

It also used to just be fine patching the bugs as they were found. Its only recently where that model has fallen apart and we now need to prevent the bugs from existing in the first place.

> Speed requires a lot of code in the kernel, where that code can run fast.

I did a double take when hearing about ksmbd. Brings back memory of khttpd and Tux.

They should build a monokernel implementation of CIFS and be done with it.

OpenBSD shows nothing. It’s insignificant and nobody is actively looking for flaws in it.

Even if they had prioritised security above all else, there would still be vulnerabilities to be found. Probably fewer, but definitely not zero.

OpenBSD has plenty of security vulnerabilities. It’s just that nobody cares, so OpenAI doesn’t dedicate resources to finding them.