4 ms·

I found this HN discussion from just under a year ago on pledge(): https://news.ycombinator.com/item?id=10537268 https://news.ycombinator.com/item?id=10537268 (

by i336_ 10y ago

I found this HN discussion from just under a year ago on pledge(): https://news.ycombinator.com/item?id=10537268 https://news.ycombinator.com/item?id=10537268 (which lists this presentation: http://www.openbsd.org/papers/hackfest2015-pledge/mgp00001.html http://www.openbsd.org/papers/hackfest2015-pledge/mgp00001.h...) I couldn't help wondering that the author had somehow been bitten by something OpenBSD-related, or that he had some kind of spat with some developer(s) somewhere. I wouldn't quite call this FUD, but I don't think it has enough bullet points for the amount of "this is the end of the world" it has in it. That said, the point about China settling for FreeBSD instead of OpenBSD for their secure computing environment is very interesting. I wonder that OpenBSD may possibly be being distracted by trying to hit some kind of academically "cute" model of functionality, instead of staying grounded and realistic. Or maybe OpenBSD is trying to stay out of the commercial limelight, so is deliberately sidestepping the mainstream enterprise ideas about MAC and so forth? In any case, I was mildly perturbed to realize that OpenBSD's author also maintains OpenSSH, which has only just now been shaken out of its disturbingly complacent development mindset (http://lwn.net/Articles/702751/ http://lwn.net/Articles/702751/ ); OpenBSD is likely to never experience something similar, which is sad - it would be truly interesting to see the level of scurrying and fixing that would happen (and just how much OpenBSD really deserves its security track record)... For a counterpoint, I also read this nice and positive argument recently: http://cfenollosa.com/blog/openbsd-from-a-veteran-linux-user-perspective.html http://cfenollosa.com/blog/openbsd-from-a-veteran-linux-user... And I found this page a while back, on OpenBSD as a router: http://www.skeptech.org/blog/2013/01/13/unscrewed-a-story-about-openbsd/ http://www.skeptech.org/blog/2013/01/13/unscrewed-a-story-ab...

brynet 10y ago
OpenSSH is not OpenSSL. OpenBSD had nothing to do with the trainwreck that is OpenSSL.
- i336_ 10y ago
  Unless I'm mistaken, Theo de Raadt was the author of both projects.
  - brynet 10y ago
    > Unless I'm mistaken Indeed.
    - i336_ 10y ago
      ...I am not having a good brain day today. 1. In my previous comment I meant OpenSSL, not OpenSSH. 2. So I just established that Theo is the author of OpenSSH, while OpenSSL is the large pile of fail. I certainly recognize the difference between the two, but failed at reading while researching about OpenBSD. Thanks. And now my view of OpenBSD is a bit more positive :)
Canada 10y ago
Kylin was the Chinese FreeBSD fork (if you can even call it that) started in 2001. This predates the privsep OpenSSH, W^X, chroot Apache, and all that. pf wasn't even released until the end of 2001. There was no support for SMP until 2004, and even now it's far behind everything else. It's not surprising. OpenBSD isn't suitable for a lot of server tasks now let alone back then.
- i336_ 10y ago
  > Kylin was the Chinese FreeBSD fork (if you can even call it that) started in 2001. Oh, wow, that was a while ago. I can see why they picked FreeBSD, Linux wasn't really all-around usable back then. Did it even have any security capabilities? > This predates the privsep OpenSSH, W^X, chroot Apache, and all that. pf wasn't even released until the end of 2001. Ha. > There was no support for SMP until 2004, and even now it's far behind everything else. The SMP thing confuses me to bits. I was talking to the author of MirBSD a little while ago, and couldn't fathom why "no SMP" was a feature (although since MirOS was decented from OpenBSD, maybe it's related to how OpenBSD's SMP is "far behind anything else" as you describe). In any case, SMP is kind of important, if you want to be commercially viable and considered real... Maybe these are toy UNIXen. Which is totally fine, our brains need a chance to zone out and have delineated spaces to play in that are free of responsibility so we can mess around and learn, but still. Maybe throw in some parodies or something, so that's clear. > It's not surprising. OpenBSD isn't suitable for a lot of server tasks now let alone back then. Hmm. I feel like I'm missing a lot of context here, I wish there was some way I could just go get all the history of it all... (I discovered Linux in 2006, started running it properly in 08, have felt out of place w/ UNIX ever since)
  - i336_ 10y ago
    descended*, woops And with "did it even have any security capabilities" I was referring to Linux (just to be clear).
  - Canada 10y ago
    SELinux was released in 1998. Linux was totally usable back then. I've been using it since 1995. I've never heard anyone claim lacking SMP support being a feature. In the case of OpenBSD it was just that nobody got around to it until much later. The project never had even close to the number of developers as Linux or FreeBSD. Back in the 90s OpenBSD focused on code audit and fixing bugs rather than adding features. I found it most useful as a firewall and nameserver because it came with ipf and they included BIND with chroot support built in. Installation was dead simple. As long as you stuck to well supported hardware, it just worked out of the box. Back then SMP meant you had multiple physical CPUs, and that wasn't generally necessary for systems dealing with 100mbit interfaces. If you needed to deal with a lot of traffic you had to get real routers because the PC wasn't great at handling tons of interrupts. In 2000 or 2001 the author of ipf decided to "clarify" his license, asserting that it could not be shipped with patches. OpenBSD deleted it from the tree and pf was born. They also forked SSH over licensing issues in 1999, but at the time there wasn't any great benefit to using it over the original version. Starting in the early 2000s OpenBSD added a lot of really useful networking tools. The carp and pfsync interfaces let you run redundant firewalls very easily. Support for syncing the dhcpd state was added. For managing wireless networks hostapd. For load balancing tasks relayd. VPN setup was simplified greatly with ipsecctl. They added privsep to OpenSSH. They created OpenNTPD in response to many ntpd vulnerabilities. They made buffer overflow protections the default. They reduced privileged programs left and right. And everything remained simple with accurate man pages. So SMP support was lacking? Not such a big deal in exchange for a system that just worked. The problem is when you need to run a big file server, database server, web server, etc. For such uses having good SMP helps. Having ZFS helps. Having packages for the boatload of dependencies your shiny new web framework requires is critical. And you want binary updates, which OpenBSD doesn't officially have.

by i336_ 10y ago

brynet 10y ago

OpenSSH is not OpenSSL. OpenBSD had nothing to do with the trainwreck that is OpenSSL.

i336_ 10y ago
Unless I'm mistaken, Theo de Raadt was the author of both projects.
- brynet 10y ago
  > Unless I'm mistaken Indeed.
  - i336_ 10y ago
    ...I am not having a good brain day today. 1. In my previous comment I meant OpenSSL, not OpenSSH. 2. So I just established that Theo is the author of OpenSSH, while OpenSSL is the large pile of fail. I certainly recognize the difference between the two, but failed at reading while researching about OpenBSD. Thanks. And now my view of OpenBSD is a bit more positive :)

Canada 10y ago

Kylin was the Chinese FreeBSD fork (if you can even call it that) started in 2001. This predates the privsep OpenSSH, W^X, chroot Apache, and all that. pf wasn't even released until the end of 2001. There was no support for SMP until 2004, and even now it's far behind everything else. It's not surprising. OpenBSD isn't suitable for a lot of server tasks now let alone back then.

i336_ 10y ago
> Kylin was the Chinese FreeBSD fork (if you can even call it that) started in 2001. Oh, wow, that was a while ago. I can see why they picked FreeBSD, Linux wasn't really all-around usable back then. Did it even have any security capabilities? > This predates the privsep OpenSSH, W^X, chroot Apache, and all that. pf wasn't even released until the end of 2001. Ha. > There was no support for SMP until 2004, and even now it's far behind everything else. The SMP thing confuses me to bits. I was talking to the author of MirBSD a little while ago, and couldn't fathom why "no SMP" was a feature (although since MirOS was decented from OpenBSD, maybe it's related to how OpenBSD's SMP is "far behind anything else" as you describe). In any case, SMP is kind of important, if you want to be commercially viable and considered real... Maybe these are toy UNIXen. Which is totally fine, our brains need a chance to zone out and have delineated spaces to play in that are free of responsibility so we can mess around and learn, but still. Maybe throw in some parodies or something, so that's clear. > It's not surprising. OpenBSD isn't suitable for a lot of server tasks now let alone back then. Hmm. I feel like I'm missing a lot of context here, I wish there was some way I could just go get all the history of it all... (I discovered Linux in 2006, started running it properly in 08, have felt out of place w/ UNIX ever since)
- i336_ 10y ago
  descended*, woops And with "did it even have any security capabilities" I was referring to Linux (just to be clear).
- Canada 10y ago
  SELinux was released in 1998. Linux was totally usable back then. I've been using it since 1995. I've never heard anyone claim lacking SMP support being a feature. In the case of OpenBSD it was just that nobody got around to it until much later. The project never had even close to the number of developers as Linux or FreeBSD. Back in the 90s OpenBSD focused on code audit and fixing bugs rather than adding features. I found it most useful as a firewall and nameserver because it came with ipf and they included BIND with chroot support built in. Installation was dead simple. As long as you stuck to well supported hardware, it just worked out of the box. Back then SMP meant you had multiple physical CPUs, and that wasn't generally necessary for systems dealing with 100mbit interfaces. If you needed to deal with a lot of traffic you had to get real routers because the PC wasn't great at handling tons of interrupts. In 2000 or 2001 the author of ipf decided to "clarify" his license, asserting that it could not be shipped with patches. OpenBSD deleted it from the tree and pf was born. They also forked SSH over licensing issues in 1999, but at the time there wasn't any great benefit to using it over the original version. Starting in the early 2000s OpenBSD added a lot of really useful networking tools. The carp and pfsync interfaces let you run redundant firewalls very easily. Support for syncing the dhcpd state was added. For managing wireless networks hostapd. For load balancing tasks relayd. VPN setup was simplified greatly with ipsecctl. They added privsep to OpenSSH. They created OpenNTPD in response to many ntpd vulnerabilities. They made buffer overflow protections the default. They reduced privileged programs left and right. And everything remained simple with accurate man pages. So SMP support was lacking? Not such a big deal in exchange for a system that just worked. The problem is when you need to run a big file server, database server, web server, etc. For such uses having good SMP helps. Having ZFS helps. Having packages for the boatload of dependencies your shiny new web framework requires is critical. And you want binary updates, which OpenBSD doesn't officially have.