# OpenBSD and the Culture of Security: the System Obsessed With Correct Code
- **Published on:** 2026-09-30
- **Category:** News
- **Original page:** https://linuxgratis.com/en/articles/openbsd-security-culture
How OpenBSD turned security into a philosophy: code audits, secure by default, OpenSSH, LibreSSL and mitigations like pledge and unveil that the whole internet now relies on.
---
Among free operating systems there are huge projects and there are influential ones, and the two rarely line up. [OpenBSD](/en/openbsd) is the clearest example: a small community, with no major corporate backing and no marketing machine, that has still reshaped how the entire internet thinks about security. If you connect to a server over SSH tonight, you are running code that was born in OpenBSD. Here is how such a famously austere project ended up setting the direction for the whole industry.
## A birth shaped by conflict
Theo de Raadt, founder of OpenBSD, who forked NetBSD in 1995 to impose his own standard of rigor. · Imagen: FAndrey / CC BY 2.0 · Wikimedia Commons
OpenBSD began in October 1995, when Theo de Raadt decided to fork [NetBSD](/en/netbsd). De Raadt had been a founding member of NetBSD, but in late 1994 he was asked to leave the core team after a series of clashes over tone and working style. Instead of walking away, he took the NetBSD code base and started a brand-new project with one fixed idea: if he controlled his own source tree, he could enforce a standard of quality and rigor that nobody would be able to overrule.
That origin explains a lot about OpenBSD's character. It is a demanding project, sometimes abrasive, but coherent to a fault. What drives it is not popularity or package count, but making sure every single line of code is correct.
## Code audits and "secure by default"
OpenBSD's hallmark is its systematic auditing of the code base. For years the team has combed through the source tree hunting for classic mistakes (buffer overflows, race conditions, careless memory handling) and fixing them ahead of time, without waiting for anyone to exploit them. The starting point is simple: a security flaw is, first and foremost, a programming bug.
To that the project adds the principle of "secure by default". A fresh OpenBSD install boots with almost every non-essential service switched off. There are no open ports waiting for a connection nobody asked for. The system is secure because, quite simply, it does nothing you did not explicitly tell it to do.
That gives us one of the project's most famous slogans: "Only two remote holes in the default install, in a heck of a long time!" The wording has shifted over the years. In 2002 it spoke of a single hole in nearly six years, and it was updated again in 2007 after a network-related vulnerability. The core claim still holds: in its base configuration, OpenBSD has been extraordinarily hard to compromise remotely.
## OpenSSH, LibreSSL and the tools you use without knowing it
OpenBSD starting its SSH server: OpenSSH was born here in 1999 and is now the standard for remote server administration. · Imagen: Hpott / CC BY-SA 4.0 · Wikimedia Commons
OpenBSD's influence is best measured by what it has given the rest of the world. In 1999 the team took the last freely licensed release of the SSH code and created OpenSSH, putting it through the same audit as everything else. Today OpenSSH is the undisputed standard for remote server administration: it ships on almost every [Linux](/en/linux-kernel) machine, on [Ubuntu](/en/ubuntu), on [Debian](/en/debian), on macOS and even on Windows.
In April 2014, after the Heartbleed disaster, OpenBSD developers forked OpenSSL to create LibreSSL. They stripped out obsolete APIs, cut more than a hundred thousand lines of code, and put readability and auditability first. De Raadt did not mince words when he called OpenSSL's design simply "broken". The project is also behind OpenBGPD, a clean implementation of the BGP routing protocol, among many other networking tools.
## Mitigations that protect even buggy code
OpenBSD is not content with writing correct code: it takes for granted that some bug will always slip through and designs the system to limit the damage. In 2003 version 3.4 introduced W^X, a scheme in which a page of memory may be writable or executable but never both at once. That makes buffer-overflow attacks dramatically harder.
Two especially elegant mitigations came later. Pledge, available since version 5.9 (2016), lets a program voluntarily declare which system calls it needs; if it tries anything else, the kernel kills it. Unveil, introduced in 6.4 (2018), restricts which parts of the filesystem a process can even see. Together they make a compromised program almost useless to an attacker: even if it manages to run code, it cannot touch anything it was not authorized to touch. And nearly every binary shipped with OpenBSD already arrives hardened with pledge.
## Why such a small distribution matters
OpenBSD will never compete on user numbers with [Fedora](/en/fedora), [Arch](/en/arch) or the big desktop distributions. That was never the goal. Its impact is indirect and deep: the ideas born here end up adopted by other systems, the tools written here end up everywhere, and the quality bar it sets pushes everyone else to take security more seriously.
In an industry that often rewards fast over correct, OpenBSD stubbornly defends the opposite with an almost artisanal pride. So even though few people install it on their laptop, its culture of security keeps protecting millions who do not even know it exists. If the BSD world intrigues you, take a look at [FreeBSD](/en/freebsd) and [NetBSD](/en/netbsd) too: three siblings with different philosophies and a shared origin.
