isopenbsdsecu.re

isopenbsdsecu.re is a single-purpose reference page that hosts the slides and video of a 2019 conference talk, "A systematic evaluation of OpenBSD's mitigations," presented at 36c3 on December 29, 2019. It is useful as a pointer to a structured third-party evaluation of OpenBSD's exploit mitigations, but it is not an official OpenBSD statement, not a current audit, and not a general verdict on whether OpenBSD is "secure." Treat it as one dated input among several, and read the slides and video together rather than relying on the page's title question.

What the site actually contains

The page's own text is minimal: a heading asking "Is OpenBSD secure?" and a note that the slides and video from the 36c3 talk are available, with a fallback message that the site works even with JavaScript disabled. There is no summary of findings, no methodology write-up, and no update log on the page itself.

That means the site functions as an index, not an analysis. The substance lives in the linked slides and recording. If you cite "isopenbsdsecu.re says OpenBSD is/isn't secure," you are citing a title, not a conclusion.

Check the date before you rely on it

The talk was given on December 29, 2019. OpenBSD, like any operating system, changes its mitigation set over time: features get added, defaults change, and older protections get reworked or replaced. A 2019 evaluation describes the state of the code and the threat model as the speaker assessed them then.

Practical implications:

• For historical or methodological questions — how someone systematically evaluated OpenBSD mitigations, what categories they used, what they found at the time — the material is appropriate and citable with the date attached.
• For current claims — "OpenBSD does/doesn't have mitigation X today" — verify against current OpenBSD documentation, release notes, and source. Do not carry a 2019 finding forward as a present-tense fact.
• When writing, always attach the year: "a 2019 systematic evaluation of OpenBSD's mitigations (36c3)" rather than "an evaluation shows."

Understand the scope: mitigations, not "security"

The talk's subject is OpenBSD's mitigations — the hardening techniques intended to make exploitation harder. That is a narrower question than "is OpenBSD secure," which also depends on code quality, default configuration, privilege separation, patch cadence, and how the system is deployed.

Two consequences:

1. A finding that a particular mitigation is weak, incomplete, or bypassable does not by itself establish that the system is insecure in practice.
2. A finding that mitigations are strong does not cover configuration, administration, or non-mitigation bugs.

When you use the material, state the scope explicitly: "this evaluates mitigation measures," not "this evaluates OpenBSD's overall security."

It is a third-party evaluation, not project documentation

The site is independent of the OpenBSD project. That is not a reason to dismiss it — external evaluation is valuable precisely because it is independent — but it changes how you weigh it:

• Use it for: an outside perspective, a structured checklist of what to examine, and specific technical claims you can then verify in the source tree or official docs.
• Don't use it for: authoritative statements of what OpenBSD supports, recommends, or guarantees. For those, go to the OpenBSD project's own documentation and release materials.
• Watch for: claims that are presented as general conclusions but rest on specific test conditions. Check the slides for the assumptions behind each result.

How to read the slides and video together

The page points to both formats, and they carry different information. The slides hold the structured claims, tables, and terminology; the video carries the speaker's caveats, qualifications, and answers that often do not appear on slides.

A workable approach:

1. Open the slides first and note each claim and the condition it depends on.
2. Watch the corresponding segment of the video for the speaker's stated limits and any audience Q&A that qualifies a result.
3. For any claim you intend to repeat, check it against current OpenBSD source or documentation before publishing.
4. Record the source as: talk title, conference (36c3), date (December 29, 2019), and the specific slide or timestamp.

If JavaScript is disabled, the page states the slides and video remain accessible — so a script-blocked browser is not a barrier to the material itself.

A quick decision guide

The short version: use isopenbsdsecu.re to find and cite a specific, dated, third-party mitigation evaluation, keep its scope and year attached to every claim you draw from it, and confirm anything present-tense against current OpenBSD sources.

isopenbsdsecu.re is a small single-purpose site that hosts the slides from a 2019 conference talk titled "A systematic evaluation of OpenBSD's mitigations," presented at 36c3 on December 29, 2019. It is not an official OpenBSD project site and does not publish its own security research; it serves as an access point to that talk's materials, with links to the slides and the talk video.

What the Site Provides

The page is essentially a landing page for one presentation. According to the site's own text, it contains the slides of the 36c3 talk and points visitors to two resources:

• The slides — available via a link on the page
• The video — available via a separate link on the page

The page also notes that it works even if JavaScript is disabled, so the links remain accessible without scripts.

What It Is Not

A few boundaries are worth keeping in mind:

• Not official. The site is not run by the OpenBSD project, so nothing on it should be read as an official statement from OpenBSD developers.
• Not a live assessment. The content dates from December 2019. It reflects the state of OpenBSD's mitigations as evaluated for that talk, not the current state of the project.
• Not a general security resource. There is no blog, no ongoing commentary, and no comparison of operating systems beyond what the talk itself covers.

When It Is Useful

The site is worth visiting if you want to watch or cite that specific 36c3 talk — for example, if you are researching how OpenBSD's exploit mitigations were systematically evaluated, or if you want the slide deck to follow along with the video. If you need current information about OpenBSD security, the project's own documentation and mailing lists are the appropriate sources; this site only preserves one 2019 presentation.

The evaluation on isopenbsdsecu.re comes from a talk titled "A systematic evaluation of OpenBSD's mitigations," delivered at 36c3 (the 36th Chaos Communication Congress) on December 29, 2019. The site hosts the talk's slides, with a link to the recorded video, so you can check any claim against the original presentation.

What the site actually is

isopenbsdsecu.re is a single-purpose page built around that one talk. Its heading poses the question "Is OpenBSD secure?" and the body points visitors to the slide deck and video rather than offering an independent write-up. In practice, it works as a pointer to primary material: if you want to know what the evaluation found, you go to the slides or the recording.

The page also notes that it remains readable with JavaScript disabled, with the slides and video available through direct links.

Why the source matters for the question

OpenBSD's security reputation rests largely on its long-standing focus on code auditing and exploit mitigation. A systematic evaluation is useful precisely because it tests those claims against implementation rather than reputation. Because the site defers to the 36c3 talk, the talk itself — not the landing page — is the authoritative source for:

• which mitigations were examined and how each was assessed
• what the evaluation concluded about their effectiveness
• the caveats and scope limits the speaker stated

How to use it

1. Open isopenbsdsecu.re and follow the slides link for the structured argument, or the video link for the spoken context and any Q&A.
2. Treat the 2019 date as a boundary: findings describe OpenBSD as it stood at that time, and later releases may differ.
3. Cite the talk (title, 36c3, December 29, 2019) rather than the landing page when referencing specific conclusions.

If your goal is a quick verdict on whether OpenBSD is "secure," the site won't give you one — it gives you the evidence and the reasoning behind one evaluation, which is the more defensible starting point.

The isopenbsdsecu.re page works without JavaScript. When scripting is disabled, it shows a short notice that this is fine and points you to two plain links: one for the slides and one for the video. Open either link directly to get the material; no script, account, or special viewer is needed.

What the page actually provides

The site is a single page presenting the slides from the talk A systematic evaluation of OpenBSD's mitigations, given at 36c3 on 29 December 2019. The page's own text describes it as the slide deck for that talk, with a link to the slides and a link to the video.

The page is built so that the core content does not depend on JavaScript. With scripting off, you see a fallback message instead of any script-driven embed, and that message contains the same two destinations.

Steps to get the slides and video

1. Open the site with JavaScript disabled. Load isopenbsdsecu.re in a browser where scripting is turned off (for example, a hardened profile or a browser set to block scripts by default).
2. Read the fallback notice. Instead of an embedded viewer, the page states that JavaScript is disabled and that this is acceptable, then offers the links.
3. Follow the slides link. This takes you to the slide deck for the 36c3 talk. You can read it in the browser or download it for offline use.
4. Follow the video link. This takes you to the recording of the talk. Watch it in the browser or open it in a separate media player if your setup prefers that.
5. Verify you have the right material. The slides and video should both refer to the 36c3 talk from 29 December 2019 on OpenBSD's mitigations. If either link leads somewhere unrelated, you are likely on a stale or mirrored copy.

Common snags

• No links visible at all. If the page appears blank rather than showing the fallback text, the page may not have loaded fully. Reload it; the fallback is plain HTML and should render without scripts.
• A link opens an embedded player that stays empty. Some video hosts try to load a scripted player. If that happens, use the direct video URL from the link rather than any embedded frame, or open the link in a browser profile that permits the host's scripts only for that tab.
• Slides fail to display inline. Slide decks are often PDFs or hosted viewers. If inline display fails, download the file and open it in a local PDF reader.
• Confusing the talk with the site. The site is a presentation of one evaluation, not an ongoing security audit or a verdict service. Treat the slides and video as the primary sources and read them together.

Why the no-JavaScript path matters

The fallback is deliberate: the page's message treats disabled JavaScript as an acceptable way to reach the material. That makes the site usable in locked-down browsers, on text-only setups, and in environments where scripts are blocked for security reasons—fitting for a page about OpenBSD's own mitigations. The practical takeaway is simple: if scripts are off, look for the notice and use its two links; the slides and the 36c3 video are the content, and everything else on the page is just presentation.

The isopenbsdsecu.re site is a single-purpose page that hosts the slides and video of a 36c3 conference talk, "A systematic evaluation of OpenBSD's mitigations," presented on December 29, 2019. The site itself does not state a verdict; it points readers to the slides and the recording as the authoritative source for the talk's findings. So the honest answer to "what does it conclude" is: the conclusion lives in those materials, and the page's role is to make them accessible.

What the page actually provides

The page is minimal by design. Its heading poses the question "Is OpenBSD secure?" and the body explains that the slides and video of the 36c3 talk are available, with direct links to both. It also notes that the page works without JavaScript — if scripting is disabled, the slides and video links are still reachable.

That structure tells you something about the site's intent: it is a pointer, not an argument. Anyone citing isopenbsdsecu.re as if the domain itself delivers a conclusion is misreading it.

Why the talk matters for the question

OpenBSD has a long-standing reputation for security-first engineering, and the talk's framing — a systematic evaluation of its mitigations — is aimed at testing that reputation against what the mitigations actually cover. A systematic evaluation is different from a feature list: it asks which classes of attack each mitigation addresses, where coverage is partial, and where gaps remain. That is the kind of analysis that can either confirm a reputation or qualify it.

How to get the actual conclusion

1. Open isopenbsdsecu.re.
2. Follow the slides link for the structured argument — the evaluation's scope, the mitigations examined, and the findings are laid out there.
3. Use the video link for the presenter's narration, which typically adds context the slides compress, such as caveats and the reasoning behind each judgment.
4. Read the conclusion against the talk's stated scope. An evaluation of mitigations speaks to exploit-hardening coverage; it is not a blanket audit of code quality, configuration, or operational practice.

Expected result: you finish with the talk's own findings rather than a secondhand summary, and you can tell which claims the evaluation supports and which it does not address.

Common pitfall

Treating the domain name as the answer. "Is OpenBSD secure?" is the talk's question, not its verdict — the page repeats the question and hands you the evidence. Conclusions drawn from the URL alone, without the slides or video, are unsupported.

What to keep in mind when reading the findings

• Date matters. The talk is from December 2019. Mitigations and the codebase change; findings describe OpenBSD as evaluated then.
• Scope matters. A mitigation review measures hardening against specific attack classes. It does not settle questions about default configuration, third-party software, or how a system is operated.
• Source matters. The slides and video are the primary record. Summaries elsewhere, including this one, are secondary.

If your goal is to understand OpenBSD's security posture in a defensible way, watch the talk or read the slides, note the scope and date, and cite the 36c3 material directly rather than the landing page.