Initial support for guided disk encryption in OpenBSD installer

Re:Initial support for guided disk encryption in OpenBSD ins... by quesera on Wednesday March 08, 2023 @04:20AM (#35066898)

It works both ways.

The OpenBSD developers know that their users take security seriously, over convenience and just-works installers.

So it's a safe bet that OpenBSD users will take the few extra (well-documented) manual steps to encrypt their storage devices, leaving the developers to focus on things that are not easy for users to do for themselves.

Adding the convenience to the interactive installer is clearly a good thing, but it would not be at the tippy-top of the priority list if you have limited funding and developer time.

[ Parent | on HN ]

Re:Initial support for guided disk encryption in OpenBSD ins... by YPPH on Wednesday March 08, 2023 @04:39AM (#35067018)

I mean, is that not like saying that a user will RTFM and disable all unnecessary services after their install?

The OpenBSD mentality is the opposite - they will sacrifice convenience and disable all unnecessary services by default, in order to make the system as secure as possible, and you can go RTFM and knowingly increase your risk if you choose to.

That mentality would suggest, I think, disk encryption should be opt-out on the install. Of course, the first step to getting there is an opt-in system.

[ Parent | on HN ]

Re:Initial support for guided disk encryption in OpenBSD ins... by quesera on Wednesday March 08, 2023 @02:14PM (#35073432)

It is, yes. It definitely works both ways.

In this case (disk encryption) the process is simple, but the data collection and then things like back/fwd, changes, accept etc.. makes it more complicated than a simple boolean/checkbox.

So the compromise was "bounce to the docs for this one", until this new improvement was added.

[ Parent | on HN ]