OpenBSD (Product): news timeline & CVEs

OpenSSH Ships on Every Mac, Linux Server and Windows. Its Creator Trusts No One

Profile of OpenSSH creator Theo de Raadt, whose OpenBSD design stayed outside the 2024 xz backdoor.

A long profile of OpenSSH and OpenBSD founder Theo de Raadt uses the March 2024 XZ Utils (liblzma) supply-chain backdoor as its frame. Persona Jia Tan placed an obfuscated payload in release tarballs targeting OpenSSH through Linux systemd integration; Microsoft engineer Andres Freund noticed SSH logins burning about 500 milliseconds of extra CPU and disclosed it on 29 March 2024. OpenBSD was outside the blast radius because it never adopted systemd and confines processes with pledge and unveil. The article then recounts de Raadt's childhood move from South Africa to Calgary and his break with NetBSD.

Hacker News · securityOct 5, 19:25 UTC · 3d agoIndustry HN 20↑ · 8 comments1

OpenBSD Developers Reject Uutils Coreutils

OpenBSD developers, including Theo de Raadt, rejected a uutils coreutils port over licensing, Rust, and compatibility concerns.

OpenBSD developers rejected a proposed ports-tree package of the Rust-based uutils coreutils reimplementation. Founder Theo de Raadt and ports developer Stuart Henderson argued OpenBSD already ships permissively licensed base utilities, and a second set with subtly different output, exit codes, or edge cases would break pipelines. They also objected to the MIT-license rationale, Rust’s toolchain and dependency burden, and uutils’ single multicall binary, which clashes with OpenBSD packaging. The port remains a proposal; users who want GNU-compatible tools can keep the existing GNU coreutils port.

Hacker News · securityOct 4, 07:55 UTC · 4d agoIndustry HN 25↑ · 17 comments1

OpenBSD

Timeline2 articles

Appears with

OpenSSH Ships on Every Mac, Linux Server and Windows. Its Creator Trusts No One

OpenBSD Developers Reject Uutils Coreutils