Normal Vaporeon thoughts such as "maybe I should try OpenBSD for security-critical stuff that's exposed to the Internet"

Second box running a Fediverse instance and e-mails
Put them in OpenBSD jails

@vaporeon_ freebsd is the one with jails, openbsd’s hardening looks more like linux, in that you can drop somewhat fine grained purrivileges via system calls

@aescling Oops. I am not particularly smart.
If you use those systems, can you tell me more about both FreeBSD and OpenBSD?

@aescling I did read about pledge() in OpenBSD, where a program promises that it will only use specific system calls, and if it ever tries any other system calls, it gets killed by the operating system

Seems like a cool and useful feature; why do other operating systems not have it? Is it hard to implement? Does it affect performance a lot?

@vaporeon_ the reason is that other systems/kernels have diffurent ideas about how to design similar kinds of features; FreeBSD has capsicum, a security model based on really fine grained capabilities. linux from what i understand kinda does not really have a design when it comes to security and has multiple overlapping systems fur locking down a purrocess