what is BSD? -- notes from my first SecTalks

First impressions:

• good to be in the company of Security people again
• made new connections
• BSD — admittedly never heard of it before

Given how much attention macOS and Linux tend to get, it was refreshing to dig into what sets BSD apart especially the security features it brings to the table.

a bit of history

BSD traces back to Berkeley in the 1970s, one of two branches that grew out of the original Unix from Bell Labs (the other being System V which fed into commercial Unix like Solaris and AIX). Unlike Linux which is just a kernel that different distros wrap userland tools around, BSD projects ship as one complete, tightly maintained operating system - kernel, tools, and documentation together.

why it matters for security

• OpenBSD's "secure by default" philosophy
• pf (Packet Filter) - OpenBSD's firewall now used across the BSD family, is widely regarded as one of the cleanest and most reliable firewall implementations around. It's the engine behind pfSense and OPNsense, two of the most popular open-source firewall/router platforms.
• Jails (FreeBSD) - provide strong process and filesystem isolation baked directly into the kernel, giving admins a lightweight way to contain and limit the blast radius of a compromised service.
• tightly audited codebase - because BSD projects are maintained as single, cohesive systems rather than a patchwork of distro choices, there's less surface area and more consistency in how security gets reviewed and shipped.

fun fact
PlayStation 4 and PS5 run on FreeBSD + Netflix streams video to hundreds of millions of devices on FreeBSD servers.