Where the OpenBSD Security Evaluation on isopenbsdsecu.re Comes From

Updated

The evaluation on isopenbsdsecu.re comes from a talk titled "A systematic evaluation of OpenBSD's mitigations," delivered at 36c3 (the 36th Chaos Communication Congress) on December 29, 2019. The site hosts the talk's slides, with a link to the recorded video, so you can check any claim against the original presentation.

What the site actually is

isopenbsdsecu.re is a single-purpose page built around that one talk. Its heading poses the question "Is OpenBSD secure?" and the body points visitors to the slide deck and video rather than offering an independent write-up. In practice, it works as a pointer to primary material: if you want to know what the evaluation found, you go to the slides or the recording.

The page also notes that it remains readable with JavaScript disabled, with the slides and video available through direct links.

Why the source matters for the question

OpenBSD's security reputation rests largely on its long-standing focus on code auditing and exploit mitigation. A systematic evaluation is useful precisely because it tests those claims against implementation rather than reputation. Because the site defers to the 36c3 talk, the talk itself — not the landing page — is the authoritative source for:

  • which mitigations were examined and how each was assessed
  • what the evaluation concluded about their effectiveness
  • the caveats and scope limits the speaker stated

How to use it

  1. Open isopenbsdsecu.re and follow the slides link for the structured argument, or the video link for the spoken context and any Q&A.
  2. Treat the 2019 date as a boundary: findings describe OpenBSD as it stood at that time, and later releases may differ.
  3. Cite the talk (title, 36c3, December 29, 2019) rather than the landing page when referencing specific conclusions.

If your goal is a quick verdict on whether OpenBSD is "secure," the site won't give you one — it gives you the evidence and the reasoning behind one evaluation, which is the more defensible starting point.