First impressions:
- good to be in the company of Security people again
- made new connections
- BSD — admittedly never heard of it before
Given how much attention macOS and Linux tend to get, it was refreshing to dig into what sets BSD apart especially the security features it brings to the table.
a bit of history
BSD traces back to Berkeley in the 1970s, one of two branches that grew out of the original Unix from Bell Labs (the other being System V which fed into commercial Unix like Solaris and AIX). Unlike Linux which is just a kernel that different distros wrap userland tools around, BSD projects ship as one complete, tightly maintained operating system - kernel, tools, and documentation together.
why it matters for security
- OpenBSD's "secure by default" philosophy
- pf (Packet Filter) - OpenBSD's firewall now used across the BSD family, is widely regarded as one of the cleanest and most reliable firewall implementations around. It's the engine behind pfSense and OPNsense, two of the most popular open-source firewall/router platforms.
- Jails (FreeBSD) - provide strong process and filesystem isolation baked directly into the kernel, giving admins a lightweight way to contain and limit the blast radius of a compromised service.
- tightly audited codebase - because BSD projects are maintained as single, cohesive systems rather than a patchwork of distro choices, there's less surface area and more consistency in how security gets reviewed and shipped.
fun fact
PlayStation 4 and PS5 run on FreeBSD + Netflix streams video to hundreds of millions of devices on FreeBSD servers.
Top comments (1)
The author's mention of BSD's "secure by default" philosophy and the use of pf as a widely regarded firewall implementation resonated with me, as I've had experience with OpenBSD in the past and can attest to its robust security features. The fact that BSD projects ship as a complete, tightly maintained operating system is also a significant advantage from a security perspective, as it reduces the complexity and potential vulnerabilities that can arise from integrating multiple components. I'm curious to know more about how the author thinks the security benefits of BSD could be applied to other areas of system administration, such as containerization or cloud infrastructure, where security is often a top concern.