cross-posted from: https://piefed.world/c/uncommon/p/1089778/linux-is-actually-very-vulnerable-to-exploits-and-it-s-showing-with-high-value-vulnerabi
I hate when people keep repeating the myth that Linux is more secure than X OS without any understanding of how much Linux gets exploited.
On the other hand, FreeBSD rarely suffers from wide security issues.
Overall, I don’t think anyone should repeat the myth that Linux is secure.
And at least if they gonna recommend Linux, they better recommend a good distro with SeLinux, hardened kernel and hardened OS.
deleted by creator
Lol.
Linux has vulnerabilities found because its a popular OS, so people actually vulnerability hunt on it. No one cares about freeBSD, so it doesn’t get the same scrutiny.
This is also the same reason Windows has so many reported vulnerabilities, it is a massive target worth exploiting.
FreeBSD has cleaner code and a far simpler kernel. More eyes on the code doesn’t make the code quality magically better, and vis versa. Linux has many security features not present in the *BSDs, but it also has a massive attack surface and has been historically hostile to security features (see: grsecurity isn’t upstreamed because it was rejected by the kernel maintainers).
Cleaner code according to who?
Please show us proof of code in the Linux kernel and in FreeBSD kernel that would suggest Linux is more susceptible to exploits. How about explaining SELinux to us and the equivalent in FreeBSD and how they compare. If you can’t, why make assertions of things you should have the self awareness to know you don’t know and understand?
FreeBSD is way better in security record
After accounting for the massive difference in number of eyeballs actually looking for vulns?
I loathe that stupid anti-linux attitude from FreeBSD/OpenBSD (and sometimes even Haiku). Most of the time it just make them seem like crybabies, from Theo de Raadt going down: imagine being such a d-bag that even freaking Linus Tolvards calls you “a difficult person” - he says Linux folks do what they do “because they hate Microsoft” but they do what they do “because they love UNIX” but at the end of the day it seems they do what they do because they hate Linux.
They want to be more popular than Linux and their strategy is… to bitch about it instead of letting their own work speak for itself.
No OS is perfect. Not even self-proclaimed ultra-secure OpenBSD has been 100% free of vulnerabilities.
FreeBSD has recently faced significant vulnerabilities, including a 17-year-old remote code execution flaw in its NFS service
Meanwhile I basically see BSD as “another Linux”.
Also 17 year old vulnerability:
FreeBSD has recently faced significant vulnerabilities, including a 17-year-old remote code execution flaw in its NFS service
I agree with most of your points. But the *BSDs are not somehow more secure as a desktop OS. The suffer the same fundamental flaw which are present on Linux: no sane/coherent threat model. Desktop apps run unsandboxed without any MAC policies. The *BSDs also lack many of the useful security features available on Linux (not that most Linux distros do anything with that stuff either, except AOSP and ChromeOS). Just cus a kernel is more “secure” does mean anything when the stuff implemented in userspace doesn’t make use of any of those features.
SELinux is very powerful, same with Seccomp and Landlock. But do any distros make extensive use of that and actually also sandbox applications.
FreeBSD has capsicum (and also an implementation of FLASK?, which is what SELinux is for Linux). OpenBSD has pledge. But are apps required to run in a isolated environment? Many of the *BSDs (and certainly .most of their users) still use X11 instead of modern alternatives like Wayland. The are still monolithic kernels which dont implement drivers in userspace, network, etc in userspace. Not secure at all.
MacOS is more secure, I agree. But it isn’t trying nearly hard enough IMO.
Even if this is true in every sense, I cannot switch to any BSD system for my daily desktop usage.
It sounds like you’re just interested in pointing this security difference out, though. I suppose it’s good for folks running servers to be aware of this, since they can decide whether to use it or not, but for desktop usage, it’s unfortunately missing far too much software and far from simple to setup for an everyday user.
Have you heard of the XZ backdoor attempt? I recommend to read it, to understand that its not easy to infiltrate Linux and why Linux is “not very vulnerable to exploits”. FreeBSD is much smaller in scope than Linux for its code base and for developers working on it, and most stuff in the internet runs Linux. If a lot people would try to hack FreeBSD, then you would see a lot exploits too.
And that’s why we should use hurd
deleted by creator