Learn OpenBSD - History, Background & Security Philosophy

#Introduction

In episode 0 you prepared your skills and lab environment — your map and compass before setting sail. Now it's time to understand why OpenBSD exists and why it looks unlike any other system. Before installing anything, you need to know the problem OpenBSD solves and the principles that animate every line of its code. Without that understanding, you'll only be memorizing commands, not understanding the reasoning behind every decision.

The best way to understand it is through history. OpenBSD was born from a difference of opinion, then grew into the project best known for its obsession with security and clean code.

#The Birth of OpenBSD: A Fork of NetBSD

In 1995, a split occurred in the NetBSD community. Theo de Raadt, one of the founders of NetBSD, was removed from his position as a core developer. Instead of stopping, he took the NetBSD source tree and forked it, giving birth to OpenBSD. Interestingly, the name "OpenBSD" was chosen because he promised open access to the CVS source code for anyone — a level of transparency that was uncommon at the time.

From the start, OpenBSD's focus differed from its sibling. NetBSD pursued portability to as many platforms as possible; OpenBSD chose a different path: security and code correctness. That principle is even reflected on the front page of its official site, in a now-famous sentence:

• "Secure by Default" — secure out of the box.
• Only two remote bugs found in the default installation in more than two decades.
• Every release includes the results of a comprehensive code audit of the entire base system.
• The dumb devices principle: deny by default, services stay off unless requested.

#The "Secure by Default" Philosophy

What does secure by default actually mean? It means security is not a feature you enable later, but a fundamental assumption of every design. Some of its manifestations:

• Services in the base system are inactive by default unless needed.
• Every new daemon undergoes a code audit and must use mitigations such as pledge and unveil.
• The default installation already enables W^X (write XOR execute), address randomization, and stack protector.
• Every new feature is questioned first: does this make the system less secure?

This philosophy is discussed more technically in episode 2 (architecture) and episode 15 (pledge & unveil). For now, remember: OpenBSD chooses to reduce the attack surface rather than pile on as many features as possible.

#The Code Audit Culture

One of OpenBSD's greatest contributions is not a feature, but a method. Since 1996, the project has regularly held hackathons and systematic code audit sessions to hunt for security bugs — even in code that hasn't been touched for years. The results are often small bug fixes that sound trivial, but their cumulative impact is enormous: many vulnerability classes familiar in other systems are hard to find in OpenBSD.

#Release Cycle: Twice a Year

OpenBSD publishes a release every six months: one in April and one in October. Releases are labeled with a 2-digit version like 7.4 or 7.9. Between two releases, users who want to follow the latest development can use snapshots from the -current branch. This pattern makes OpenBSD predictable and easy to plan around for operations teams.

The evolution of its major releases can be summarized as follows:

The version at the time this series was written is OpenBSD 7.9, released in May 2026. Feature details will be covered in episode 21.

#Contributions That Changed the World

Although it's often considered a "small project", OpenBSD's impact on the software world is enormous. Some projects born from OpenBSD that are now used everywhere:

The interesting fact: OpenSSH and tmux aren't just works of OpenBSD — they're also part of its base system, meaning you're using world-proven software every time you open a terminal on OpenBSD.

#Why Choose OpenBSD

There are several strong reasons why you — especially as a sysadmin or security engineer — should consider OpenBSD:

#Proactive Security

OpenBSD doesn't wait for an attack and then patch. It uses mitigations proactively: address randomization (KARL), stack protector, W^X, syscall sandboxing, and a minimal privilege model. The result: even if a bug is found, exploiting it to gain control of the system is far more difficult.

#Outstanding Documentation

OpenBSD man pages are the gold standard. Every command, file format, and configuration has a complete, accurate, and living manual page. Much of the information in this series comes from the man pages. You'll often hear this advice: read the man page first. For example man rcctl, man pf.conf, and man doas.conf.

#A Complete Base System

A single OpenBSD installation already includes a web server (httpd), mail server (smtpd), firewall (pf), load balancer (relayd), SSH (OpenSSH), TLS (LibreSSL), terminal multiplexer (tmux), and virtualization (vmm). No need to install dozens of packages to build a basic server — which also reduces the attack surface.

#Platform Portability

Although its main focus is security, OpenBSD still supports many architectures: amd64, arm64, sparc64, even riscv64. You can use the same machine in a VM or on physical hardware. This means the skills you learn in this series apply across platforms — from an arm64 laptop to a large x86 server.

#Community and Mailing Lists

Behind the tidy releases is a lively community: active mailing lists, regular hackathons, and a culture of deep technical discussion. If you want to ask questions or contribute, openbsd.org/mail.html is the door in. Reading the mailing list archives can even feel like a free course — many of OpenBSD's design decisions are explained directly by its developers there.

Check the OpenBSD version running on your machine:

uname -a
sysctl kern.osrelease

#Closing

In episode 1 you understood OpenBSD's roots: born from a 1995 NetBSD fork because of a difference of opinion, built on the secure by default philosophy and a code audit culture, released twice a year, and grown into a system respected precisely because of its proactive security.

Key takeaways:

• OpenBSD is a 1995 NetBSD fork by Theo de Raadt, focused on security and code correctness.
• Secure by default means security is a fundamental assumption, not an add-on feature.
• The six-month release cycle (April and October) makes OpenBSD predictable.
• A complete base system reduces dependence on external packages.

In the next episode, episode 2, we'll break down the core concepts and main architecture of OpenBSD — the base system versus packages structure, the difference between release, snapshot, and -current, and the roles of the kernel, pf, OpenSSH, LibreSSL, and syscall sandboxing. This is the technical map you'll use in all the following episodes!