43 ms·
OpenBSD 5.9 released early
- robinhoodexe 11y ago"The less(1) we're all familiar with has been completely rewritten. After importing a fork from illumos' Garrett D'Amore, OpenBSD continued to make improvements to the code. A safer and more modern tool was the end result, even if it's just for viewing text. Hopefully there will be less bugs now." Impressive work.
- cajetanus 11y agoAnd less bugs. Beautiful pun there.
- duaneb 11y ago...until you realize that the proper word would be "fewer" because bugs are countable.
- stsp 11y agoBut there's an infinite number of bugs!
- dsr_ 11y agoHopefully fewer less bugs.
- phaemon 11y ago...or until you realise that the personal preferences of Robert Baker do not constitute what is "proper". It was a daft preference when expressed and it's no less a daft "rule" now.
- deleted 11y ago[deleted]
- chipaca 11y agoI think you meant ”fewer daft”.
- vacri 11y agoWordplay humour is not built for pedants.
- gosukiwi 11y agoenglish grammar strikes again
- silverforgotapw 11y agoYou found a bug!
- omginternets 11y agoLess was unsafe? How so?
- slrz 11y agoProbably by emitting control sequences from the input files unfiltered to your terminal. Just guessing, but it's the one big thing that occurs to me when thinking of an unsafe pager.
- omginternets 11y agoAh, okay that makes sense. Thanks!
- Someone 11y agoIt may be much, much worse. http://seclists.org/fulldisclosure/2014/Nov/74 http://seclists.org/fulldisclosure/2014/Nov/74: "Many Linux distributions ship with the 'less' command automagically interfaced to 'lesspipe'-type scripts, usually invoked via LESSOPEN. This is certainly the case for CentOS and Ubuntu. Unfortunately, many of these scripts appear to call a rather large number of third-party tools that likely have not been designed with malicious inputs in mind. On CentOS, lesspipe appears to include things such as groff + troff + grotty, man, and cpio. On Ubuntu, there's isoinfo (?!), ar from binutils, and so on. Ancient and obscure compression utilities and doc converters crop up, too." I vaguely remember a ?different? issue where less would load a shared library to list its symbols.
- soccerdave 11y agoThe release notes mention good support for running on AWS. I would love to see more distributions embrace building AMIs, or at the least provide good documentation to get it running. Ubuntu probably has the best support by building AMIs for all the regions, it would be awesome to see some others do the same thing. I think this is probably an overlooked area that could provide more growth for the BSDs.
- maxaf 11y agoWhen 5.9 was still -current, https://github.com/ajacoutot/aws-openbsd https://github.com/ajacoutot/aws-openbsd was a viable if clunky way of producing one's own AMIs. As you can see from the script, there's quite a bit of work that happens before a -current snapshot could be turned into a valid AMI. I think this will become really useful when attached EBS volumes are properly detected by an OpenBSD system running in EC2. Right now EBS attachments are silently ignored. (Someone please correct me!)
- devslashnull 11y agoAs far as I'm aware there isnt any blkfront support in the recent changes, which would be needed for EBS. Support for blkfront is not needed to get up and running with Xen though, so it makes sense to defer it until later and get the bootstrap going and then the devs can focus on the remaining pieces.
- gooseyard 11y agoI'm excited about this too- I almost always choose OpenBSD for small, single-role servers, because it runs so well on small hardware like Soekris single board machines, and the maintenance is so low with OpenBSD that I rarely have to touch a machine again after setting it up.
- Scarbutt 11y agoIt just says they will support Xen, I doubt they will provide an official AMI.
- 11y ago
- nickpsecurity 11y agoGood work to OpenBSD team. Especially on pledge. Widespread changes are risky and often fail. Just speaks even more about the quality of work they do.
- viraptor 11y agoYeah, that caught my attention. I envy OpenBSD's ability to do "apply this to everything" projects like this one. Linux had seccomp for ages now, but there's still barely any application using it. I even wrote patches to add supports in some projects and they were just ignored. :(
- absorber 11y agoYou might want to check out firejail - https://firejail.wordpress.com/ https://firejail.wordpress.com/ - it supports seccomp as well.
- viraptor 11y agoIt's a step in the right direction, but it misses one great feature of seccomp - you don't have to activate seccomp at startup. What it means in practice is (for example) a daemon running under firejail must be able to open log for writing and open sockets. An application which uses seccomp natively can first do those things and then block all further open/socket syscalls.
- netytan 11y agoAre you talking about pledge? Pledge works as you describe
- walterbell 11y ago> If running OpenBSD under Xen (such as on Amazon's cloud platform) sounds interesting to you, you'll be happy to know that 5.9 includes some pretty solid support for this. Exciting! Does the default build include Xen PV drivers for networking and storage, or is a custom build needed? How about SMP support? OpenBSD would make an excellent firewall VM for Qubes, XenServer, etc.
- maxaf 11y agoYesterday I discovered that OpenBSD runs well in EC2, but EBS attachments are silently ignored. :(
- nickpsecurity 11y ago" OpenBSD would make an excellent firewall VM for Qubes, XenServer, etc." That's a good idea.
- teamhappy 11y agoI'm hoping for a portable version of OpenBSD's less(1) fork (now rewrite) ever since Theo mentioned it in his pledge(2) talk at Hackfest.
- throwaway2048 11y agoIt is likely they released early because they want additional testing time for the SMP diffs they are about to merge. With 6.0 we may be seeing both fully SMP routing and PF support. As of now, routing and PF are fully giantlocked in the kernel, and can only run on one core. This should greatly speed up routing and filtering performance.
- krylon 11y agoAfter saving an old laptop at work from landing on the garbage pile, I took it home and, on a whim, decided to install OpenBSD on it. I expected problems of some kind or another and was mentally prepared to install Debian instead, but I was pleasantly surprised that all of the hardware worked out of the box. Since it is old an fragile, and the battery lasts about five minutes, I don't do much with it but keep it around for good luck. Guess I'll be upgrading this weekend. As luck will have it, I am also binge-watching Doctor Who currently, which fits in nicely with the cover art. ;-)
- eeks 11y agoI am using OpenBSD as my primary workstation on a 2015 Carbon X1, and it works like a charm.
- brynet 11y agoThe 5.9 release includes many pledge(2)'d programs in base, but some notable ports include decompressors like bzip2/unzip/p7zip/xz.. oh, and Chromium.
- technofiend 11y agoOpenBSD has been my go to firewall since my firewall was a Sparcstation IPC. There have been some major changes along the way, but most of the time rebuilding the system takes less than an hour and is a matter of porting a few config files to a fresh copy of the OS. Even the major changes are usually trivial since the documentation is kept up-to-date and there are plenty of examples in the docs and on the mailing lists. The last time I saw anyone test packet passing speeds against OpenBSD it was around the time of the pf/ipf split and rewrite and OpenBSD was the slowest of the lot. Although modern hardware can saturate a cable modem, the multithreading of their network stack is still a positive, as is the work to support modern wifi cards (N); hopefully AC will be next. Also definitely looking forward to pledge since it further reduces attack surfaces on an already hardened OS.
- stsp 11y agoThere's a lot more work to do for 802.11n in future releases (e.g. MIMO support). So putting 802.11ac on the roadmap doesn't make much sense at this stage.
- technofiend 11y agoFair enough - just wishful thinking, and as my friends in OpenBSD-land say "If you want it so bad, submit a patch."
- deepfriedtech 11y agoAnother great release from the OpenBSD team. Always looking forward to the great things Theo and team put out. Pleasantly surprised to see this release a month early. OpenBSD has been my favorite OS since 2000. Such an easy-to-use OS for any number of things. I've used it for firewalls, Web servers, and a nice simple desktop with a custom FVWM config. Fast and simple.
- cpeterso 11y agoConsidering how much the OpenBSD team cares about secure programming and the time they invest rewriting unsafe kernel and userland code, why do they still use C when they could use a safe language like Rust?
- deepfriedtech 11y agoC is a systems language from the ground up with decades of successful use and knowledge behind it. Rust is the new kid on the block with everything to prove. C is the best tool for the job. I think Theo de Raadt and his devs know exactly what they are doing. With only two holes in the default install in over a decade, why fix what isn't broken? I'm one of these guys that still clings to old tech because it works. If C works, use it. Rust is too new, too unproven. C has proven its worth with billions of lines of code, something Rust will likely never achieve as a niche language.
- nickpsecurity 11y ago"C is a systems language from the ground up" It was actually an extension of BCPL, which wasn't designed: just what parts of a good language compiled on 1960's hardware. Proof below. http://pastebin.com/UAQaWuWG http://pastebin.com/UAQaWuWG "with decades of successful use" It actually had decades of failures with all sorts of bugs and hacks that safer, system languages dodged by design. Only the best coders got successful and secure use out of it. We praise OpenBSD quality for a reason: it's not easy. "Rust is the new kid on the block with everything to prove. " This is true. I have a rule against using anything new for security-critical coding if its in the TCB. Takes time to discover all the issues in things. "With only two holes in the default install in over a decade" Propaganda I've called out plenty. On the other systems, people finding bugs often weaponize them, declare a vulnerbaility, and add that to the count. OpenBSD treats bugs as just bugs then fixes them while assuming their mitigations stopped any attack attempts. It's easy to say you only had 2 vulnerabilities when you're not counting vulnerabilities. ;) "C has proven its worth with billions of lines of code, something Rust will likely never achieve as a niche language." It does have proven worth. After billions of lines, you can be sure you'll be fixing all sorts of things and doing breach notifications if you rely on it. Unless you pay extra money for top coders. Rust already beat it on app-level safety w/ effects of low-level interactions and compiler risk being next to assess or address. Ada and SPARK beat both for systematic safety with many empirical results from case studies and field use. Safe versions of C like Cyclone and Popcorn outdid C, too, in security but nobody invested more in them. TAL and CoqASM are even doing safety/security at assembler level. And so we have a language proven worthless for quality or security the mainstay of quality or security focused UNIXen even with decades of alternatives empirically shown to be better. Sounds like a cultural thing to me. Drawback too. Only advantages: lots of people know it and lots of existing code/tooling. Valid reasons to choose it for existing BSD code but allows it was inferior on other angles. And that rewrites to safer languages for it or new projects should be ongoing.
- obsdfnd 11y agoDon't forget to donate to the OpenBSD Foundation! PayPal/Check/Bank Transfer: http://www.openbsdfoundation.org/donations.html http://www.openbsdfoundation.org/donations.html
- hackuser 11y ago802.11n Another big one for laptop users: initial support for N wireless has landed in both the iwm(4) and iwn(4) drivers. Does that mean that 802.11n wasn't supported by OpenBSD until now? 802.11n was first available in (2010?) and is no longer the current version (802.11ac is).
- nayden 11y agoReversing firmware without documentation takes time. Especially when a single developer does it on their spare time as a hobby.
- ashitlerferad 11y agoDoes OpenBSD actually write open WiFi firmware?
- antoinealb 11y agoNo. But they still have to write drivers that will interact with those firmwares.
- brynet 11y ago802.11n is a lot more complicated than its predecessors, OpenBSD has it's own wireless stack and drivers. A lot of 11n hardware was supported in a/b/g modes only.
- cmurf 11y agoI've found the same on Linux with the Broadcom chips that at least Apple users in laptops. Maybe the proprietary driver supports it.
- sigzero 11y agoI imagine wireless is a "secondary" concern for the OpenBSD team given the focus on the server.
- tezza 11y agoSo it's now possible to have a -1 day exploit ?
- protomyth 11y agoIn that vein, do note the errata page[1] has patches that need to be applied. 1) http://www.openbsd.org/errata59.html http://www.openbsd.org/errata59.html
- chris_wot 11y agoCan anyone explain pledge?
- cypher543 11y agoIt tells the kernel which system calls and file paths your process intends to use. If it uses any others, because of malicious code injection or whatever, your process is killed immediately. http://man.openbsd.org/OpenBSD-current/man2/pledge.2 http://man.openbsd.org/OpenBSD-current/man2/pledge.2
- protomyth 11y agoTheo de Raadt explains it well in this video https://www.youtube.com/watch?v=F_7S1eqKsFk https://www.youtube.com/watch?v=F_7S1eqKsFk
- bodyfour 11y agoThe work originally started as tame(), here are some of the earlier HN discussions on that: * https://news.ycombinator.com/item?id=9928221 https://news.ycombinator.com/item?id=9928221 * https://news.ycombinator.com/item?id=10135901 https://news.ycombinator.com/item?id=10135901 During its development, the API was made more flexible and eventually got renamed pledge()