What does HackerNews think of src?

True. The author might enjoy studying something like OpenBSD (https://github.com/openbsd/src)

A belief you hold strongly because you have never enjoyed the beauty of an operating system code you can actually read I guess: https://github.com/openbsd/src

OpenBSD is a lot of code, sure, but far from insurmountable, the drivers are few and quite generalised.

I can’t really say how long it took me to read it because it was over a few years of getting curious and diving in, but it wasn’t much.

I’d say if you were to study the code for 8 hours a day it would probably take about 3-5 weeks.

That said: I’m not claiming that I did a full security audit and found all the bugs: I am stating outright that I have read every line of code in the source tree, and the majority of the code that I run from ports, it’s simple enough that you can do that.

And yes; I still get horrified at a lot of the ports; not everything is perfect.

Exceptions to my curious browsing include Chromium and firefox due to sheer complexity, (and I have had reason to dive into those: the tweaks file is fun); and I have read the majority of the GCC code too (which somehow is much less complex and is quite easy to wrap your head around once you’ve read the dragon book than the browsers).

But the OS. Like you claimed. Is not a binary blob, at least to me. I compile it myself, with a compiler I understand, and with code I have read and understand; this is not uncommon in OpenBSD users; the OS is literally designed in a way that is easy to read; because being easy to read means security bugs have less places to hide. (As per the OpenBSD philosophy).

All of the above notwithstanding, I’m writing this message from an iPhone so not everything in my life is so rigorously understood; I’m not a purist, just a curious tinkerer, like most Linux enthusiasts used to be before the ecosystem became a bit too complex to understand for any one person.

You could argue my phone can leak my chats, to which I say: your matter of “trust” comes back, and I don’t think I would trust my phone with my life to not leak my secrets (signal is asking people to trust them with their lives; journalists and dissidents). But I would trust my laptop.

There is official read-only git mirror at https://github.com/openbsd/src

CVS still works just fine for the devs ...