OpenBSD 7.8 Released: What’s New in the Security-Focused OS

34

OpenBSD 7.8 Released: A Fortress Forged in Code, What’s New in the Security-Focused OS

In the sprawling, often chaotic world of operating systems, there exists a project that stands apart. It doesn’t chase the latest desktop fads or compete on the sheer number of features. Instead, it pursues a singular, uncompromising goal: to be the most secure, stable, and correct operating system in existence. This project is OpenBSD. With the release of version 7.8, it reaffirms its commitment to this philosophy, delivering a meticulously crafted update that isn’t just a collection of new programs, but a profound statement on what software can and should be.

OpenBSD 7.8 is not for the faint of heart. It is not designed for those who want their OS to “just work” without a second thought. It is for the system administrators, security professionals, developers, and privacy-conscious individuals who understand that true security is not a feature you add on, but a foundation you build upon. It’s for those who read the source code, who value simplicity over complexity, and who believe in proactive defense over reactive patching.

This release, like its predecessors, is the product of thousands of hours of meticulous code auditing, proactive hardening, and a relentless drive for correctness. It is a testament to the power of a small, dedicated team of volunteers working under the leadership of Theo de Raadt, guided by a simple yet powerful mantra: “Secure by Default.”

In this deep dive, we will explore what makes OpenBSD 7.8 a significant release. We’ll go beyond the simple changelog to understand the why behind the changes. We will dissect the kernel hardening, the userland improvements, and the networking enhancements that make this OS a paragon of security. We will delve into the core philosophies that drive the project, from the radical simplicity of its design to the revolutionary security mechanisms like pledge() and unveil(). This is more than just a release announcement; it is an exploration of an enduring vision for a safer digital world.

The Enduring Philosophy: Why OpenBSD Matters

Before we even look at the specific features of 7.8, it is crucial to understand the bedrock upon which OpenBSD is built. The project’s priorities are starkly different from most other operating systems, and this informs every single line of code.

Secure by Default: The Proactive Stance

Most operating systems take a reactive approach to security. A vulnerability is discovered, a patch is written, and users are urged to update. OpenBSD flips this model on its head. Its primary goal is to prevent entire classes of vulnerabilities from ever being exploitable in the first place. This is the essence of “Secure by Default.”

What does this mean in practice? It means that when you install OpenBSD, the system is in its most secure state from the outset. All non-essential services are disabled. The firewall, pf (Packet Filter), is enabled with a “deny all” policy. Remote root login is disabled in sshd. This is the polar opposite of many consumer and server OSes, which enable a multitude of services and open ports to make the initial setup “easier,” inadvertently creating a larger attack surface.

This proactive stance extends to the code itself. The OpenBSD team doesn’t just wait for bug reports. They actively audit the source code, searching for potential flaws like buffer overflows, race conditions, and logic errors. They don’t just fix the bug; they refactor the code to make the entire subsystem simpler, clearer, and less prone to similar errors in the future.

Code Correctness and Simplicity

In the OpenBSD world, there is no tolerance for “good enough.” Code must not only be functional but also correct, readable, and simple. The developers believe that complex code is a breeding ground for bugs. When a piece of software is convoluted, it becomes difficult to understand, difficult to audit, and difficult to maintain.

This philosophy leads to some bold decisions. The OpenBSD team is not afraid to remove old, complex, or poorly written code, even if it means breaking backward compatibility. They would rather provide a clean, secure, and simple API than maintain a messy legacy one. This is why you see features like the removal of support for older, insecure protocols or the deprecation of complex hardware drivers in favor of simpler, more auditable alternatives.

This focus on simplicity also applies to the userland. The base system contains a curated set of tools that are essential for running the OS. There are no bloated office suites, no media players, no unnecessary graphical applications. This minimalism reduces the attack surface and makes the entire system easier to manage and understand.

Full Disclosure and Radical Transparency

OpenBSD has a long-standing policy of full disclosure. When a security vulnerability is fixed, the details are made public. This allows everyone—not just OpenBSD users—to learn from the mistake and to check their own systems for similar flaws. The team believes that security through obscurity is no security at all. By being transparent, they help raise the security bar for the entire software industry.

This transparency is also evident in their development process. The project’s mailing lists are open, and the discussions about potential changes, bugs, and design decisions are public for all to see. This open scrutiny is another layer of quality control, ensuring that code is reviewed by many eyes, not just the core developers.

With this philosophical foundation in place, let’s turn our attention to the concrete advancements in OpenBSD 7.8.

Kernel and Low-Level Security Hardening in 7.8

The kernel is the heart of the operating system, and its security is paramount. A vulnerability in the kernel can lead to a complete system compromise. OpenBSD 7.8 introduces several significant changes to the kernel and low-level system calls, further hardening the system against attack.

Refinements to execve(): Tightening the Gates

The execve() system call is one of the most fundamental and security-sensitive functions in any Unix-like OS. It is responsible for executing a new program, replacing the current process image. A flaw in execve() could allow an attacker to execute arbitrary code with the privileges of an existing, vulnerable process.

In OpenBSD 7.8, the execve() implementation has been further hardened. Developers have focused on rejecting more malformed and dangerous inputs. For example, the handling of “shebang” lines (the #! at the beginning of a script file) has been made more strict. Previously, certain edge cases in how the interpreter and its arguments were parsed could potentially be manipulated. In 7.8, these cases are explicitly rejected, preventing a class of subtle vulnerabilities where an attacker could craft a malicious script to influence the behavior of a privileged process that executes it.

Furthermore, checks on the permissions and attributes of the executable file have been enhanced. The kernel is now more vigilant in verifying that the program being executed resides on a filesystem that is mounted with appropriate security options. For instance, attempting to execute a file from a filesystem mounted with the nosuid or noexec flags will now be handled more robustly, closing potential loopholes.

These changes may seem minor, but they are emblematic of the OpenBSD approach: find the smallest cracks in the system’s armor and meticulously seal them. By hardening a core function like execve(), the entire system becomes more resilient.

Memory Management Hardening: mmap() and mprotect()

Memory management is a perennial source of security vulnerabilities, particularly buffer overflows and other memory corruption bugs. OpenBSD has a long history of introducing mitigations for these issues, such as W^X (Write XOR Execute), which prevents a memory region from being both writable and executable at the same time.

In 7.8, the memory management subsystem has received further attention. The mmap() system call, used for mapping files or devices into memory, and the mprotect() system call, used to change the protection flags on a memory region, have been refined.

A key change is the more aggressive application of PROT_MPROTECT. This flag, when set during an mmap() call, prevents the protection on that memory region from ever being changed to be executable. This is a powerful mitigation. Even if an attacker manages to find a buffer overflow and inject their shellcode into a writable memory region, they will be unable to mark that region as executable and run their code.

OpenBSD 7.8 expands the use of this flag, applying it to more memory allocations by default, particularly those made by the dynamic linker and the runtime loader. This means that even complex, multi-threaded applications will have their memory layouts more strictly controlled, making it significantly harder for an attacker to achieve code execution through a memory corruption exploit.

This isn’t about stopping a single known vulnerability; it’s about proactively breaking the fundamental techniques that attackers rely on, making entire categories of exploits ineffective on a default OpenBSD system.

pledge() and unveil(): The Cornerstones of Proactive Security

Perhaps the most famous and innovative security features to come out of OpenBSD are pledge() and unveil(). These mechanisms, introduced in recent releases, have been further refined and expanded in 7.8, continuing their evolution as powerful tools for sandboxing applications.

pledge(): Voluntarily Restricting System Calls

pledge() is a system call that allows a program to voluntarily restrict the system calls it can make after it has completed its initialization. The concept is simple but brilliant: most programs only need a small subset of the full power of the kernel. A web browser needs to access the network, read files, and render graphics, but it doesn’t need to administer users or change the system’s hostname. A text editor needs to read and write files, but it has no business opening network sockets.

With pledge(), a developer can declare a “promise”—a list of the categories of system calls their program needs. For example, a simple file-copying utility might pledge(“stdio rpath wpath cpath”), promising to only use standard I/O, read file paths, write file paths, and create file paths. If, later in its execution, the program tries to make a system call outside of this promise (e.g., fork() or socket()), the kernel will terminate the program immediately.

In OpenBSD 7.8, the pledge() framework has been expanded with new promises. For example, new promises have been added to better support specific hardware interactions and fine-grained network operations. This allows more complex applications, like VPN clients or specialized hardware tools, to be effectively sandboxed without breaking their core functionality.

The beauty of pledge() is that it contains the damage. Even if a vulnerability is found in a pledge()d application (e.g., a malicious image file triggers a buffer overflow in an image viewer), the attacker’s ability to exploit it is severely limited. They can’t spawn a shell, they can’t access the network, and they can’t read sensitive files outside of what the application was already allowed to access. The exploit is confined to a very small, well-defined sandbox.

unveil(): Locking Down the Filesystem

While pledge() restricts what a program can do, unveil() restricts where it can do it. unveil() is a system call that allows a program to lock down its view of the filesystem. It works by explicitly “unveiling” the specific directories and files the program needs to access. After the unveil() “lockdown” phase is initiated, any attempt to access a file or directory outside of this pre-approved list will be denied.

Consider a web server. It needs to read its configuration files from /etc, serve web content from /var/www, and write log files to /var/log. Using unveil(), the server can restrict its entire filesystem access to just these three directories. If an attacker compromises the web server, they cannot read /etc/passwd, they cannot browse through users’ home directories in /home, and they cannot access sensitive system binaries in /usr/bin. The filesystem, from the perspective of the compromised process, has shrunk to only the essential parts.

In OpenBSD 7.8, more base system utilities and daemons have been converted to use unveil(). This is a continuous, painstaking process where developers analyze each program to determine its minimal filesystem requirements and then add the appropriate unveil() calls. The result is a system where, by default, a huge number of processes are running with a drastically reduced view of the filesystem, creating a formidable defense-in-depth posture.

The combination of pledge() and unveil() is a game-changer. It represents a shift from a world where we assume all software is potentially malicious and must be firewalled and isolated at the network level, to a world where the OS itself provides fine-grained, application-level sandboxing. OpenBSD 7.8 continues to lead the way in making this vision a practical reality.

Networking: The Unassailable Fortress

OpenBSD has always been renowned for its world-class networking stack. Its firewall, Packet Filter (pf), is widely considered the gold standard and has been ported to many other systems. OpenBSD 7.8 brings a host of improvements to its networking daemons and tools, further solidifying its reputation as the premier choice for secure networking appliances like firewalls, routers, and VPNs.

Packet Filter (pf): Evolving with Precision

pf is more than just a firewall; it is a powerful, flexible, and highly controllable tool for managing network traffic. Its rule-based language allows for the creation of incredibly sophisticated traffic shaping, normalization, and filtering policies.

In OpenBSD 7.8, pf has received several important updates. One of the most notable is the continued refinement of its traffic normalization features, controlled by the scrub keyword. Network traffic is often messy and can contain ambiguous or malformed packets that some systems interpret in ways that can be exploited. pf’s scrub rules clean up this traffic, standardizing it before it reaches the host or the network behind it.

In 7.8, the scrub implementation has been improved to better handle a wider range of edge cases, particularly related to TCP options and IP fragmentation. This makes the normalization process more robust and less likely to interfere with legitimate traffic while still providing strong protection against fragmentation-based attacks and other network-level evasion techniques.

Additionally, the pf state tracking logic has been optimized for performance and correctness. The state table, which tracks the progress of active connections, is the heart of pf’s stateful inspection capabilities. The changes in 7.8 make this tracking more efficient, particularly on systems with a very high number of concurrent connections, while also making it more resilient against attempts to bypass the firewall by crafting packets that manipulate the state table.

iked: The Modern VPN Daemon

The Internet Key Exchange version 2 (IKEv2) daemon, iked, is OpenBSD’s modern, high-performance solution for setting up IPsec VPNs. It is known for its clean, auditable codebase and its excellent integration with the OpenBSD kernel.

OpenBSD 7.8 enhances iked with support for more modern cryptographic algorithms and key exchange mechanisms. As older algorithms become deprecated or proven weak, it is vital that security-focused software move to stronger alternatives. The updates in 7.8 ensure that iked remains at the forefront of secure VPN technology, offering robust protection against eavesdropping and tampering.

The configuration syntax for iked has also been made more flexible, allowing for more granular control over policies and peer relationships. This makes it easier for administrators to set up complex VPN topologies, such as road warrior setups, site-to-site connections, and hub-and-spoke architectures, all while maintaining a high level of security.

ospfd and bgpd: Routing with Reliability

For those who use OpenBSD as a router, the Open Shortest Path First daemon (ospfd) and the Border Gateway Protocol daemon (bgpd) are essential components. These daemons handle dynamic routing, allowing a network to automatically adapt to changes in topology and find the most efficient paths for traffic.

In OpenBSD 7.8, both ospfd and bgpd have received stability and security fixes. The focus has been on hardening their parsing of routing updates from peers. Routing protocols are complex, and a malformed or malicious update from a compromised or misconfigured peer could potentially crash a routing daemon or, in a worst-case scenario, be used to hijack network traffic.

The changes in 7.8 add stricter validation to the parsing of these updates, ensuring that any anomalies are detected and handled gracefully without disrupting the routing process. This kind of defensive programming is crucial for infrastructure-critical software, where stability and predictability are paramount.

Userland and System Utilities: Security in Every Tool

In OpenBSD, the concept of a “base system” is sacrosanct. The collection of core utilities—from the shell and the text editors to the compiler and the system daemons—are all developed and maintained as part of the OS itself. This integrated approach allows for a holistic security posture, where every component is audited and hardened. OpenBSD 7.8 continues this tradition with significant updates to key parts of the userland.

OpenSSH: The Gold Standard Gets Better

It’s hard to overstate the importance of OpenSSH. It is the de facto tool for secure remote administration and file transfer across the globe. Developed by the OpenBSD team, it is a flagship project that embodies the project’s commitment to security, correctness, and simplicity. OpenBSD 7.8 ships with the latest version of OpenSSH, packed with new features and hardening improvements.

One of the key themes in recent OpenSSH development has been the deprecation of older, less secure algorithms and the promotion of modern, more robust ones. In 7.8, this trend continues. Support for some legacy key exchange and cipher algorithms has been removed from the default configuration, pushing users towards stronger options like Curve25519 for key exchange and AES-GCM for encryption.

A major new feature in this release is the addition of a mechanism to mitigate timing attacks on the authentication process. Previously, an attacker could potentially measure the time it took for the server to reject an incorrect password versus an incorrect username to infer valid usernames on the system. OpenSSH in 7.8 introduces artificial delays to ensure that all failed authentication attempts take approximately the same amount time, effectively blinding this side-channel attack.

Furthermore, the ssh-agent, the program that holds private keys for user authentication, has been further hardened. It now includes additional checks to prevent a compromised process from hijacking an agent socket and requesting signatures for operations it shouldn’t be allowed to perform. These fine-grained controls make the agent a more secure and trustworthy component of the SSH ecosystem.

doas: The Simple, Secure sudo Alternative

Many operating systems use sudo as a tool to allow authorized users to execute commands as another user (typically the root user). While powerful, sudo has a long history of security vulnerabilities and is notoriously complex, with a configuration file that can span hundreds of lines for a complex setup.

OpenBSD introduced doas as a simpler, more secure, and more auditable alternative. The philosophy behind doas is that it does 90% of what people use sudo for, but with a fraction of the code and a much simpler configuration syntax. A typical doas.conf file is only a few lines long.

In OpenBSD 7.8, doas has been refined with improved handling of user groups and environment variable persistence. The changes are subtle but focused on making its behavior more predictable and secure. For example, the rules for which environment variables are passed through to the target command have been tightened to prevent potential information leakage or command injection.

The continued development and preference for doas over sudo perfectly encapsulates the OpenBSD philosophy: choose the simpler, more auditable tool that gets the job done securely, even if it means sacrificing some of the esoteric features of a more complex alternative.

A More Secure Base System

Beyond these headline applications, OpenBSD 7.8 includes hundreds of smaller but equally important security fixes and hardening measures across the entire base system.

• Libraries: Core libraries like libc and libssl have been audited for potential vulnerabilities, and functions known to be unsafe (like strcpy()) have been replaced with safer alternatives (strlcpy()).
• System Daemons: Daemons like the system logger (syslogd), the time synchronizer (ntpd), and the dynamic host configuration protocol daemon (dhcpleased) have all been updated with stricter input validation and reduced privileges, often by being pledge()d and unveil()d.
• Compilers and Toolchain: The base compiler, clang, and its associated tools have been updated. This not only provides developers with a more modern toolchain but also enables the use of newer compiler-based security mitigations, such as Stack Clashing Protection and improved Control Flow Integrity, which are enabled by default on supported architectures.

This comprehensive, top-to-bottom approach is what makes OpenBSD unique. Security isn’t an add-on layer; it is woven into the fabric of every single component of the operating system.

Hardware and Architecture Support: Building on a Solid Foundation

An operating system is nothing without hardware to run on. OpenBSD 7.8 continues to expand its support for modern hardware, ensuring that users can run the OS on the latest and most secure platforms.

Driver Updates and New Hardware Support

The release includes updated and new drivers for a wide range of hardware components. This includes support for newer Wi-Fi cards, Ethernet controllers, and graphics chipsets. Adding support for new hardware is not just a matter of convenience; it is a security issue. Older drivers may contain unpatched vulnerabilities or may not support the latest security features of the hardware itself. By providing modern, well-audited drivers, the OpenBSD team ensures that users can benefit from the security enhancements built into the hardware.

A significant area of improvement is in the support for ARM64 (aarch64) architecture. OpenBSD has been making a concerted effort to become a first-class citizen on ARM64, which is prevalent in modern data centers, embedded devices, and even high-performance laptops. OpenBSD 7.8 brings better support for a wider range of ARM64 boards and server platforms, improved performance, and enhanced power management.

The End of an Era: i386 is No More

In a move that signifies the project’s forward-looking stance, OpenBSD 7.8 is the last release to support the i386 (32-bit x86) architecture. Starting with the next release (7.9), i386 will be dropped entirely.

This decision was not made lightly. The i386 architecture is ancient by computing standards, and its limitations (such as a small address space and a lack of modern CPU features) make it increasingly difficult to implement modern security mitigations effectively. Maintaining support for it also diverts developer resources that could be better spent on more modern and secure architectures like amd64 and ARM64.

This is a classic example of the OpenBSD philosophy in action: choose simplicity and security over backward compatibility. By dropping i386, the developers can simplify the codebase, remove a large amount of legacy code, and focus their efforts on platforms where they can implement the strongest possible security features.

The Human Element: The Community and the OpenBSD Foundation

An operating system is more than just code; it’s a community of people. The success of OpenBSD is a direct result of the unique culture and the dedicated individuals who contribute to it.

The Development Process: Hackathons and Code Review

The OpenBSD development process is highly structured and disciplined. All changes to the source code must be reviewed and approved by a core developer before being committed. This rigorous review process is a critical quality control measure, ensuring that all code that enters the tree meets the project’s high standards for correctness and security.

A key part of this process is the series of hackathons that the team organizes several times a year. These are intensive, in-person gatherings where developers from around the world come together to work on specific projects. The focused, collaborative environment of a hackathon allows for rapid progress on complex tasks, such as porting to a new architecture, developing a major new feature, or conducting a large-scale code audit of a critical subsystem. The hackathons are funded by donations to the OpenBSD Foundation, and they are an essential engine of the project’s progress.

The OpenBSD Foundation: Supporting the Mission

The OpenBSD Foundation is a Canadian non-profit organization that was created to support the project. Its primary role is to handle the financial aspects of the project. It collects donations from individuals and corporations and uses these funds to pay for essential project expenses.

These expenses include:

• Hackathon Costs: Paying for travel, accommodation, and venues for the development hackathons.
• Hardware and Infrastructure: Purchasing new hardware for developers to test and port to, and paying for the servers and bandwidth that run the project’s websites, mailing lists, and code repositories.
• Legal Fees: Covering the costs of maintaining the Foundation’s non-profit status.

The Foundation is run by a small group of volunteers, and it operates with complete transparency, publishing its financial reports for all to see. Supporting the OpenBSD Foundation is one of the most direct ways for individuals and organizations to contribute to the project and ensure its long-term sustainability.

Is OpenBSD 7.8 For You?

With all its strengths, it’s important to have a clear understanding of who OpenBSD is designed for. It is not a one-size-fits-all operating system.

OpenBSD 7.8 is an excellent choice for:

• Security Professionals: For building firewalls, VPN gateways, intrusion detection systems, and other security appliances. Its minimal attack surface and robust networking stack are unmatched.
• Server Administrators: For running critical internet-facing services like DNS, email, and web servers. Its stability and proactive security features make it an ideal platform for services that need to be online and secure 24/7.
• Developers: For those who want to develop software in a clean, well-defined environment and who want to learn from a codebase that is a model of clarity and correctness.
• Privacy-Conscious Individuals: For users who prioritize security and control over convenience and are willing to invest the time to learn and configure their system.

OpenBSD 7.8 is likely not the best choice for:

• Desktop Beginners: Users who are new to Unix-like operating systems may find the learning curve steep. The desktop experience, while functional, is not the project’s primary focus and lacks the polish and ease-of-use of distributions like Ubuntu or Fedora.
• Gamers: There is virtually no support for modern gaming platforms, graphics drivers, or game titles on OpenBSD.
• Users Needing Commercial Software Support: Many commercial applications simply don’t have OpenBSD versions or support.

OpenBSD 7.8: Top 20 Features and Security Enhancements

Here are the most significant changes and improvements in the OpenBSD 7.8 release, focusing on security, stability, and correctness.

Core Philosophy & Security Model

1. Unwavering “Secure by Default” Stance: The system installs with all non-essential services disabled, a “deny all” firewall rule, and remote root access disabled, minimizing the attack surface from the moment of installation.
2. Radical Focus on Code Simplicity: The project continues to prioritize simple, auditable, and correct code over complex, feature-rich implementations. This involves removing legacy code and refactoring subsystems to prevent entire classes of bugs.
3. Full Disclosure and Transparency: All security fixes are disclosed publicly with detailed information, allowing the wider community to learn from vulnerabilities and audit their own systems, reinforcing a “security through openness” policy.

Kernel and Low-Level Hardening

1. Hardened execve() System Call: The core function for executing programs has been made more strict, particularly in its handling of script “shebang” lines and file permissions, preventing potential script-based attacks.
2. Advanced Memory Protection (mmap/mprotect): The memory management subsystem now more aggressively uses flags like PROT_MPROTECT to prevent writable memory from ever being made executable, crippling common memory corruption exploit techniques.
3. Expanded pledge() and unveil() Sandboxing: More base system utilities and daemons have been converted to use these powerful sandboxing mechanisms, further restricting the system calls and filesystem access a process can use, thus containing potential breaches.
4. Updated Compiler Toolchain (clang): The base system compiler is updated, enabling the use of modern, compiler-based security mitigations like improved Control Flow Integrity and Stack Clashing Protection by default on supported architectures.

Networking and Firewall

1. Refined Packet Filter (pf): The world-class firewall receives improvements to its traffic normalization (scrub) features and state table logic, making it more robust against network evasion techniques and high-traffic loads.
2. Modernized IKEv2 Daemon (iked): The VPN client/server daemon adds support for stronger, modern cryptographic algorithms and more flexible configuration options, ensuring secure and high-performance IPsec connections.
3. Hardened Routing Daemons (ospfd/bgpd): Critical for routing infrastructure, these daemons now include stricter validation of routing updates from peers to prevent crashes or traffic hijacking from malformed or malicious data.

Userland and System Utilities

1. OpenSSH Enhancements: The latest version of the gold-standard secure shell tool includes mitigations for user enumeration timing attacks and further hardening of the ssh-agent to prevent unauthorized use of private keys.
2. doas as the sudo Alternative: The project continues to promote doas, a simpler, more secure, and easily auditable alternative to sudo for privilege escalation, with improved environment variable handling in this release.
3. Comprehensive Base System Auditing: Hundreds of smaller security fixes and hardening changes have been applied across the entire base system, from core libraries like libc to system daemons like ntpd and syslogd.
4. Deprecation of Unsafe Functions: The project continues its long-standing effort to replace unsafe C library functions (like strcpy) with their safer, bounded counterparts (strlcpy), eliminating a common source of buffer overflow vulnerabilities.

Hardware and Architecture Support

1. Improved ARM64 (aarch64) Support: Significant work has been done to make OpenBSD a first-class OS on modern ARM64 hardware, with better driver support, performance, and power management for servers and embedded devices.
2. Updated Hardware Drivers: The release includes a wide range of new and updated drivers for modern network interfaces, Wi-Fi cards, and graphics chipsets, ensuring users can benefit from the latest hardware features and security.
3. End of Life for i386: OpenBSD 7.8 is the final release to support the 32-bit i386 architecture. This decision allows developers to focus resources on modern architectures and implement security features that are not possible on the legacy platform.

Development and Community

1. Hackathon-Driven Development: The release’s progress is fueled by the project’s unique hackathons, where developers collaborate in person to tackle complex tasks, audit code, and drive major features forward.
2. Support via The OpenBSD Foundation: The non-profit Foundation continues to play a crucial role by managing donations to fund hackathons, purchase development hardware, and maintain project infrastructure, ensuring the project’s long-term health.
3. Proactive Removal of Legacy Code: In line with its philosophy, the project has removed support for deprecated and insecure protocols (e.g., older SSH ciphers) and drivers, simplifying the codebase and forcing users onto more secure paths.

OpenBSD 7.8 stands as a testament to what can be achieved when security is not an afterthought but the primary design goal. In a world where data breaches and cyber attacks are increasingly common, OpenBSD offers a beacon of hope—a system built not for convenience or market share, but for correctness, simplicity, and above all, security.