I have to laugh when I read blog posts about how people go to great strides to run a "minimal" and lean OS, to then only come to find out that 95% of what they do is in a web browser.
At that point, the OS doesn't even matter any more if it's all web/cloud-services.
I'd go exactly the opposite direction: If the browser is the only important thing, surely it's best to have as little overhead to running that browser - every byte of memory wasted on something else is a byte the browser could have used (and it needs enough of them!), every running process uses time and battery that the browser could have taken, every additional package/program/library is security risk on top of the secure(ish) sandbox where your real (web)apps are running.
One more reason to make it minimalist. The built in security already makes OpenBSD slow, so installing anything unnecessary will slow it down even more.
> The built in security already makes OpenBSD slow,
OpenBSD doesn't really have any security stuff that impacts performance. They're claims to security are primarily based on reasonable default configs and auditing older code.
I have to laugh when security conscious people think their browser is secure. I use TTY almost exclusively. But for a minimal desktop one should really look into stumpwm
Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
If 90% of your activity is in the browser, then even if your sandbox was 100% isolated from other processes, 90% of your activity is still exposed, no?
And why are you confident in sandboxing? Just like in real life, it is only a rudimentary defence.
Every browser tab has its own sandboxed process. And to top it off, at least in Chrome every site (second-level domain) and iframe has its own sandboxed process.
Nice list. Now you need a RCE exploit and a chained breakout exploit thought. That's a lot of cash.
Given this and that the process isolation also protects against meltdown/spectre type attacks, I think we can agree that this type of fine-grained sandboxing is a requirement for secure software, no?
However, next to no software is using fine-grained sandboxing. From the top of my head only qmail, djbdns and gatling come to mind, none of them are for end-users.
So what end-users software does actually approach or surpas browsers in this regard?
Then lets not pretend that a browser is sufficiently secure for people considering using OpenBSD. Given the fact that by its nature a browser runs untrusted unreviwed code on your device it does a pretty good job of making it difficult to exploit, but it is irresponsible to say that its sandboxing cant be bypassed when clearly it can.
I have to laugh when I read blog posts about how people go to great strides to run a "minimal" and lean OS, to then only come to find out that 95% of what they do is in a web browser.
At that point, the OS doesn't even matter any more if it's all web/cloud-services.