OpenBSD
The history of OpenBSD is rooted in the epic of UNIX and the Internet. When IBM and Digital dominated enterprise computing in the 1970s, the US Department of Defense was funding research on distributed networks. At the University of Berkeley, a group of developers coordinated by researchers created BSD UNIX, which would become the reference implementation of the Internet’s TCP/IP protocols.
In the early 1990s, the Berkeley Computer Science Research Group, which coordinated BSD development, was about to be dissolved. BSD had started as a collection of software for AT&T’s UNIX and had evolved over the years into a complete operating system, and groups wanted to continue its development. Lynne and Bill Jolitz adapted the system to Intel x86 processors with 386BSD. Developers began sharing improvements in the form of “patchkits,” giving rise to two distinct projects: FreeBSD, focused on optimizing for PC hardware, and NetBSD, aiming for maximum portability.
In October 1995, Theo de Raadt forked NetBSD to create OpenBSD. The first version was released in July 1996. This new distribution distinguished itself through its radical commitment to security and elegant design. The team launched a comprehensive source code audit, systematically searching for and fixing security vulnerabilities. This approach produced a system renowned for its exceptional reliability, with only two remotely exploitable vulnerabilities in the default installation since its inception.
OpenBSD innovated by integrating preventive security mechanisms. The system adopted the W^X (Write XOR Execute) principle, where memory cannot be simultaneously writable and executable. It introduced address space layout randomization (ASLR) to vary jump targets and gaps between memory regions at each execution. Unreadable and non-writable guard pages were placed at the end of allocated memory blocks to detect overflows. The developers implemented privilege separation, where daemons run with minimal rights in a restricted environment.
The project distinguished itself by publishing its source code in real time via anonymous CVS, an innovative practice at a time when most projects worked behind closed doors. This transparency allowed the community to continuously verify and improve the system’s security. OpenBSD was a pioneer in the use of strong cryptography, becoming in 1997 the first free system to integrate IPSec by default. This decision led to complications with US restrictions on the export of cryptographic technologies, circumvented through project coordination from Canada.
Beyond its operating system, OpenBSD became the source of many widely used components. OpenSSH, created to replace proprietary secure connection solutions, established itself as the worldwide reference. The PF (Packet Filter) firewall, LibreSSL, the OpenSMTPd mail server, and other tools from the project were adopted by numerous systems. These software components are now found in most connected devices, from Cisco routers to Apple products, including Android systems.
OpenBSD’s philosophy prioritizes code correctness and security over immediate ease of use. The system activates only a minimum of services by default, requiring the administrator to explicitly configure desired functionalities. This approach, sometimes criticized for its rigidity, has proven effective in preventing numerous compromises. The developers strive to maintain compatibility with the original BSD model while strengthening security within the constraints of this framework.
The BSD license, more permissive than the GPL, allows the use of code in closed commercial products. This freedom has favored the adoption of OpenBSD as a foundation for various network security solutions. The system has established itself in critical infrastructures requiring maximum security: firewalls, edge-of-network servers, intrusion detection systems. While its use on workstations is limited by restricted support for consumer applications, OpenBSD continues to influence the entire industry through its security innovations.