6 ms·

OpenBSD 4.7 released

42 points by there 16y ago

jorgecastillo 16y ago
http://news.ycombinator.com/item?id=1361473 http://news.ycombinator.com/item?id=1361473
nailer 16y ago
Anyone on HN deploying on OpenBSD? Any thoughts?
- mstevens 16y ago
  I've got a home router running on OpenBSD, for a mix of practical and educational purposes. I've found pf to be particularly nice - it's much easier to work with than iptables for me. Like all the BSDs, it has man pages for everything, which is an extremely nice aspect. The main thing that I don't like about OpenBSD is the increased update hassle as compared to, for example, Debian. I'd probably use OpenBSD everywhere if there was some reasonable equivalent of what you'd do on Debian with "aptitude update && aptitude upgrade".
  - silentbicycle 16y ago
    The OpenBSD packaging system's update infrastructure has really improved within the last year. It might be worth another look. I do porting, and very frequently update to a recent snapshot, then update all ports. I haven't had problems with it for a while. And yeah, best router/firewall OS ever.
    - mstevens 16y ago
      How do you find running snapshots? I always figured just from the name you could expect them to have problems.
      - silentbicycle 16y ago
        The snapshot computer is my main desktop (amd64), and in general, I haven't had problems. (On second thought, updating "very frequently" is probably an exaggeration - more like monthly/biweekly.) One time I noticed that my CD burner had stopped working, but I hadn't used it for several months before that anyway, and it went away on a subsequent update. Other than that, no problems.
- protomyth 16y ago
  http://news.ycombinator.com/item?id=1364132 http://news.ycombinator.com/item?id=1364132
- spahl 16y ago
  I use on my router for WAN load balancing (2 outgoing links) because it is so much easier with pf than with iptables.
- thaumaturgy 16y ago
  I've used it for a number of different purposes. I prefer it over everything else for firewalls and servers of almost any kind.
- masomenos 16y ago
  Have been using it on firewalls for about 10 years. Wouldn't use anything else in that space, between the security, reliability, and usability of PF. A couple of the current firewalls are on Soekris hardware, cheap little boxes that only draw a couple watts -- more at http://slagwerks.com/blog/?s=soekris http://slagwerks.com/blog/?s=soekris
  - spahl 16y ago
    Speaking of hardware, I'm using it on an alix 2d3 (http://www.pcengines.ch/alix.htm http://www.pcengines.ch/alix.htm) with openbsd. I was impressed because it's more powerful but much cheaper than a soekris.
    - mstevens 16y ago
      I'm using an alix 2d3 as well, very impressed with it so far.
    - masomenos 16y ago
      interesting! Hadn't heard of them before, will check one out sometime.
- jrockway 16y ago
  I was an OpenBSD fanboi for a while. It was not a terrible desktop OS, but Linux is just so much easier to deal with. apt-get blows ports (and pkg-add, hahaha) out of the water. I also used it for my mail/web server, and it didn't seem to be the path of least resistance. With Debian, I spent about 10 minutes configuring Apache + fastcgi and exim + spamassassin + clamav. With OpenBSD, I spent days setting it up (I felt like the first person in the world to ever deploy a FastCGI app on OpenBSD), but the result was much more secure. Each web app ran as its own user in a chroot with no view of the shared filesystem beyond /tmp, and the webserver ran as its own user, also in a chroot. Very secure, but still felt flaky to me. My mailserver never worked right. (The "world's most secure operating system" uses sendmail!?) pf is just wonderful compared to iptables, though, so I would definitely use OpenBSD for anything routing-related. (But Linux has better hardware support, so I am stuck with that for now. Need to get a Soekris router!)
  - koenigdavidmj 16y ago
    >(The "world's most secure operating system" uses sendmail!?) Their FAQ addresses this and says that the Sendmail upstream has been a bit more receptive to security issues than Postfix or others. In addition, they claim that Postfix hasn't been the cleanest in recent years.
    - silentbicycle 16y ago
      They also have smtpd now. (http://www.openbsd.org/cgi-bin/man.cgi?query=smtpd http://www.openbsd.org/cgi-bin/man.cgi?query=smtpd)
- ivenkys 16y ago
  I use OpenBSD for Email, Music Daemon, FTP server, VPN, irc and of course as a firewall. The best thing about it other than its vaunted security is the absolutely fantastic documentation and predictability. Once you get something, anything working its quite easy to get other pieces to work as well. They all follow the same pattern.
- there 16y ago
  all of my public services (web/email/dns/database hosting, my SaSS - http://corduroysite.com/ http://corduroysite.com/) are hosted on openbsd servers, as well as my office firewall and workstations running openbsd. i'm also an openbsd developer (jcs@)
- JoachimSchipper 16y ago
  It's an excellent OS for (most C) development: it has fantastic documentation and is very good at crashing buggy programs (even better with some malloc options set). It also actually installs headers, unlike many Linux distributions. (It's also an excellent firewall, server, desktop, ...) [EDIT: ... for most stuff at least. Ubuntu is shinier, and Linux/Solaris/FreeBSD is better for multithreaded number crunching.]

42 points by there 16y ago

jorgecastillo 16y ago

http://news.ycombinator.com/item?id=1361473 http://news.ycombinator.com/item?id=1361473

nailer 16y ago

Anyone on HN deploying on OpenBSD? Any thoughts?

mstevens 16y ago
I've got a home router running on OpenBSD, for a mix of practical and educational purposes. I've found pf to be particularly nice - it's much easier to work with than iptables for me. Like all the BSDs, it has man pages for everything, which is an extremely nice aspect. The main thing that I don't like about OpenBSD is the increased update hassle as compared to, for example, Debian. I'd probably use OpenBSD everywhere if there was some reasonable equivalent of what you'd do on Debian with "aptitude update && aptitude upgrade".
- silentbicycle 16y ago
  The OpenBSD packaging system's update infrastructure has really improved within the last year. It might be worth another look. I do porting, and very frequently update to a recent snapshot, then update all ports. I haven't had problems with it for a while. And yeah, best router/firewall OS ever.
  - mstevens 16y ago
    How do you find running snapshots? I always figured just from the name you could expect them to have problems.
    - silentbicycle 16y ago
      The snapshot computer is my main desktop (amd64), and in general, I haven't had problems. (On second thought, updating "very frequently" is probably an exaggeration - more like monthly/biweekly.) One time I noticed that my CD burner had stopped working, but I hadn't used it for several months before that anyway, and it went away on a subsequent update. Other than that, no problems.
protomyth 16y ago
http://news.ycombinator.com/item?id=1364132 http://news.ycombinator.com/item?id=1364132
spahl 16y ago
I use on my router for WAN load balancing (2 outgoing links) because it is so much easier with pf than with iptables.
thaumaturgy 16y ago
I've used it for a number of different purposes. I prefer it over everything else for firewalls and servers of almost any kind.
masomenos 16y ago
Have been using it on firewalls for about 10 years. Wouldn't use anything else in that space, between the security, reliability, and usability of PF. A couple of the current firewalls are on Soekris hardware, cheap little boxes that only draw a couple watts -- more at http://slagwerks.com/blog/?s=soekris http://slagwerks.com/blog/?s=soekris
- spahl 16y ago
  Speaking of hardware, I'm using it on an alix 2d3 (http://www.pcengines.ch/alix.htm http://www.pcengines.ch/alix.htm) with openbsd. I was impressed because it's more powerful but much cheaper than a soekris.
  - mstevens 16y ago
    I'm using an alix 2d3 as well, very impressed with it so far.
  - masomenos 16y ago
    interesting! Hadn't heard of them before, will check one out sometime.
jrockway 16y ago
I was an OpenBSD fanboi for a while. It was not a terrible desktop OS, but Linux is just so much easier to deal with. apt-get blows ports (and pkg-add, hahaha) out of the water. I also used it for my mail/web server, and it didn't seem to be the path of least resistance. With Debian, I spent about 10 minutes configuring Apache + fastcgi and exim + spamassassin + clamav. With OpenBSD, I spent days setting it up (I felt like the first person in the world to ever deploy a FastCGI app on OpenBSD), but the result was much more secure. Each web app ran as its own user in a chroot with no view of the shared filesystem beyond /tmp, and the webserver ran as its own user, also in a chroot. Very secure, but still felt flaky to me. My mailserver never worked right. (The "world's most secure operating system" uses sendmail!?) pf is just wonderful compared to iptables, though, so I would definitely use OpenBSD for anything routing-related. (But Linux has better hardware support, so I am stuck with that for now. Need to get a Soekris router!)
- koenigdavidmj 16y ago
  >(The "world's most secure operating system" uses sendmail!?) Their FAQ addresses this and says that the Sendmail upstream has been a bit more receptive to security issues than Postfix or others. In addition, they claim that Postfix hasn't been the cleanest in recent years.
  - silentbicycle 16y ago
    They also have smtpd now. (http://www.openbsd.org/cgi-bin/man.cgi?query=smtpd http://www.openbsd.org/cgi-bin/man.cgi?query=smtpd)
ivenkys 16y ago
I use OpenBSD for Email, Music Daemon, FTP server, VPN, irc and of course as a firewall. The best thing about it other than its vaunted security is the absolutely fantastic documentation and predictability. Once you get something, anything working its quite easy to get other pieces to work as well. They all follow the same pattern.
there 16y ago
all of my public services (web/email/dns/database hosting, my SaSS - http://corduroysite.com/ http://corduroysite.com/) are hosted on openbsd servers, as well as my office firewall and workstations running openbsd. i'm also an openbsd developer (jcs@)
JoachimSchipper 16y ago
It's an excellent OS for (most C) development: it has fantastic documentation and is very good at crashing buggy programs (even better with some malloc options set). It also actually installs headers, unlike many Linux distributions. (It's also an excellent firewall, server, desktop, ...) [EDIT: ... for most stuff at least. Ubuntu is shinier, and Linux/Solaris/FreeBSD is better for multithreaded number crunching.]