Theme 1 – Skepticism about OpenBSD’s “heavily audited” security claims
Many commenters argue that the reputation of OpenBSD as exceptionally secure is overstated because the default install runs very little code and the auditing effort is limited.
- “It’s remarkable that a bug survived 37 years in one of the most heavily audited codebases…” – ozereray1
- “It's not as heavily audited as you think. They have like a dozen active developers.” – sippingabonedry
- “The idea of 'OpenBSD is super duper secure' is mostly a fiction… Their prime claim… is pretty meaningless because the default install doesn't really do anything.” – stackghost
Theme 2 – Human‑ vs AI‑generated technical writing
The discussion splits over whether exploit write‑ups should be produced by humans (valued for clarity and insight) or can be supplemented/ replaced by AI (seen as either a cure for terseness or a source of low‑quality “slop”).
- “Well, the key thing is that I don't want slop, period… if you expect a human audience to read about your findings, then is it not unreasonable to ask a human to write it?” – raddan
- “If, in this era of constantly dealing with overly verbose verbal diarrhea from LLMs, your complaint is that a human write up is too terse… you can ask an LLM to turn it into as many pages of slop as you like.” – socializer
- “…it appears that a human did write it, and then you complained that it wasn't good.” – john_strinlai
Theme 3 – The need for safer languages or verification to escape C’s pitfalls
Several participants point out that long‑lived bugs like this are symptomatic of using C, advocating for memory‑safe languages, formal verification, or augmenting C with safety features.
- “I feel like this is the elephant in the room… C isn't a safe language and moving to safe languages is going to be the only lasting solution.” – zoeysmithe
- “No language is safe… Alternatives are to formally verify the C code to be memory safe or to add some memory safety features to C.” – uecker
- “Nobody in history has been able to write correct C code, and that includes OpenBSD developers.” – thomashabets2