7 ms·

There are kernels of truth in this document that circle around a politics/bureaucracy issue in FreeBSD that has existed forever. But the overall motif about se

by kev009 7y ago

There are kernels of truth in this document that circle around a politics/bureaucracy issue in FreeBSD that has existed forever. But the overall motif about security is laughable diatribes of a typical OpenBSD fan that understands little about kernel work while flailing around about how secure their pet uniprocessor operating system is.. yes, uniprocessor. It is trivial to DoS an OpenBSD machine accidentally on any kind of modern hardware because the locking model is state of the art circa 1980. Security! The only real facepalm this document describes accurately is that FreeBSD still bundles sendmail. The rest of this is basically a slanted view of things that don't matter when running a high scale internet service with FreeBSD -- I know because I did so.

SwellJoe 7y ago
It barely mentions OpenBSD, though?
- kev009 7y ago
  It does, the whole thing is a thinly veiled OpenBSD uber alles rant. The author's twitter bio states "i'm a weeb / dj / photographer that likes openbsd" -- The references in the doc to LibreSSL, OpenSSH purity, OpenSMTPD, pf "unmaintained", OpenNTPD are codewords for "OpenBSD is better than FreeBSD".
  - SwellJoe 7y ago
    The article mentions OpenBSD 4 times (vs Linux 2, Windows 2), in all cases directly comparing a default or feature in OpenBSD to the same default or feature in FreeBSD. Whether the author is an OpenBSD fan or not, I didn't come away with the feeling that OpenBSD was the suggested solution to the problem. I found it interesting, anyway, but didn't come away with any inclination to use OpenBSD on my next deployment.
  - verytrivial 7y ago
    It's the topic that matters, no? When talking about BSD security, comparisons to how a security-focused BSD does it seems fair to me. OpenBSD is indeed "better" than FreeBSD when discussing security defaults. Not features or performance, security. I felt the theme was also whether FreeBSD users were aware of the situation, and whether they were able to meaningfully consent to it because they're defaults after all.
    - kev009 7y ago
      I don't think I can agree scientifically. OpenBSD developers do subjectively seem to think more holistically about security, and having less features lowers the total number but not the ratio and in practice it doesn't seem to have what I would consider a statistical magnitude difference in the type and ratio of incidents that plague C Unix-likes. In the article the author links to one of Ilja van Sprundel's excellent talks; the takeaway is basically that more eyes actually work for security and you could therefore infer Linux is a magnitude more secure than BSD. I've been quite negative in this thread because the overall debate on these topics is pretty frivolous. We already have the tools at our disposal to do magnitude greater secure software and splitting hairs over which BSD has better defaults is missing the forest for the trees.
      - ksec 7y ago
        >incidents that plague C Unix-likes Do you have a specific language in mind that offers improvement? Or am I reading too much into the sentence? >We already have the tools at our disposal to do magnitude greater secure software Mind sharing more details on the tools? Specifically with respect to System / OS Level programming.
        tatersolid 7y ago
        >Do you have a specific language in mind that offers improvement? Any language with memory and type safety should comprise as much as possible of the whole system. See the Singularity OS from Microsoft Research, or whatever that Rust OS project is called. Almost all the major, nicknamed, headline-grabbing RCE bugs in the last two decades are memory or type safety issues in C or C++ code. Every C or C++ developer claims safe code is possible or even easy in their favorite language, but history has proven them very wrong.
        kev009 7y ago
        I'm not banking on any language shift at the moment but could see a plausible case in the past for Ada and maybe now Rust after some more years of maturity both down to the metal. But both of these suffer from some awkwardness around the toolchain for integration into a traditional BSD right now, at least Rust may overcome that in time. syskaller is in use by the major BSDs and stricter compilers and other static analysis tools have been a far bigger impact IMHO than the OpenBSD style mitigations. I would like to actually see some kind of case studies where OpenBSD mitigations have protected a user where they'd have been let down by say Linux or FreeBSD or OpenBSD without them. I think a less snake oil approach to security is done by the seL4 folks, the difference in approach makes the *nix security mitigation people somewhat cringe worthy.
  - andoriyu 7y ago
    pf is still single threaded in both OS, right?
  - c256 7y ago
    As someone who hasn’t cared especially much about any *BSD since moving on from NetBSD, I can’t help but notice that a) your bio here calls out FreeBSD, and b) your posts here seem way more rant-like than anything in the post or the comment thread. Maybe - and I'm only saying this because I care - there are a lot of decaffeinated brands on the market that are just as tasty as the real thing.
    - kev009 7y ago
      Heh except if you actually read the comments I present Linux as the high water mark twice for security and stability. Maybe - and I'm only saying this because I care - you should consider through hiking and come back to the discussion when you are less easily offended by the facts at hand into low grade trolling and have requisite attention span and reading comprehension to participate meaningfully in the conversation.
uponcoffee 7y ago
Can you detail how the views presented provided are 'slanted' and 'don't matter'?
- kev009 7y ago
  Sure, say you configure a Linux, OpenBSD, and FreeBSD machine to provide some useful service. A "stack" as they call it these days. None of these OSes are going to have a large attack surface outside that "stack", and that is the primary liability in running an internet service. There are relatively rare occurrences like the TCP SACK bug that affected Linux and Netflix' non-default FreeBSD RACK TCP stack. Every UNIX-like written in C without formal verification is subject to incidents like that from time to time. Every other security concern is addressed in an OS-agnostic fashion with failure domains, limits of scope/networking, access controls, monitoring, and operations procedures. Now what Linux, and to a lesser degree FreeBSD, can do is survive real world usage at scale. OpenBSD cannot. It would fall over or require magnitude more machine count to do the same workloads that people use Linux and FreeBSD to run. So all the exploit mitigation diatribe and "great defaults" and pet projects are cute but funny when you try and throw shade onto others with them. As I said, there are some kernels of truth that pertain less about security and more about overall health in FreeBSD this doc accidentally hits on, but running some hobby software like opensmtpd on openbsd isn't going to save the world from real cybersecurity issues.
  - Cyberdog 7y ago
    Among those "cute pet projects" are OpenSSH, LibreSSL, OpenNTPD, and PF. The internet at large, and even FreeBSD itself, would be all the poorer for not having these projects available. As someone who has run web servers with both FreeBSD and OpenBSD, I think some of your criticism in this thread is valid, but you really crossed the line into blatant fanboyism with that one at the least.
    - pushpop 7y ago
      Only really OpenSSH from your list applies though. LibreSSL isn’t really in widespread usage outside of OpenBSD and has still been vulnerable to some of recent the OpenSSL exploits. OpenNTPD is more widely used but lots of people still go for other alternatives and frankly I’m not convinced OpenNTPD offers anything significant over the competition anyway. pf is barely used outside of OpenBSD and frankly why should it be when Linux has iptables (which does the job well) and FreeBSD has ipfw (which also does the job well). pf is also a decent firewall but it’s also a crowded market with lots of really decent alternatives written by their respective platform hosts. I do actually quite like OpenBSD though. But outside of OpenSSH, OpenBSD is slowly becoming less relevant to the wider industry as other platforms catch up on security and even over take in terms of enterprise features.
howard941 7y ago
Yet he never gets around to ditching FreeBSD. The guy's a fan. I read it as a qualified endorsement.
snazz 7y ago
Could you elaborate on the issues with multiprocessing on OpenBSD? I haven’t had any difficulties running multiple Firefox processes across multiple cores on my machine. How have you DoS’ed it?
- kev009 7y ago
  Yes, run https://github.com/antonblanchard/will-it-scale https://github.com/antonblanchard/will-it-scale on operating systems with hilarious grandstanders like OpenBSD and Illumos, then run it on Linux and compare the results. Run a highly parallel make on a modern server and tell me which OS remains usable for other work. OpenBSD runs acceptably on 2-4 core laptops with HT disabled because a desktop workload doesn't typically invoke a lot of the kernel implementation during steady state, but you can do it there with a moderate disk and network load. That said, syscalls are more expensive in OpenBSD than contemporary operating systems so even as a uniprocessor OS it is funny.
  - snazz 7y ago
    Fair points. I’ll wager that most users are willing to accept the trade-offs in favor of security, given that it likely won’t affect most day-to-day usage. (Also, I’m missing what’s so “funny” and “hilarious” about it.)
    - kev009 7y ago
      I use OpenBSD for fun on a couple systems and it is a cute OS, there are things to love about it. But the grandstanding is funny.
  - davesmith1983 7y ago
    I don't think anyone that uses OpenBSD will claim that it is fast.
  - bitminer 7y ago
    Will-it-scale has a dependency on hwloc which is not supported on OpenBSD. Do you have a better synthetic benchmark to suggest? And "speed" does depend on expectations. Compute tasks should be approximately equivalent, right? And os-limited tasks with many syscalls less so. You don't specifically state your expectations. Just that you are disappointed.
smittywerben 7y ago
> The only real facepalm this document describes accurately is that FreeBSD still bundles sendmail. I installed FreeBSD last night, you can just tick/untick these options during the install which addresses most of the article. [ ] enable sendmail [ ] enable sshd [ ] enable ntp [x] encrypt swap

by kev009 7y ago

SwellJoe 7y ago

It barely mentions OpenBSD, though?

kev009 7y ago
It does, the whole thing is a thinly veiled OpenBSD uber alles rant. The author's twitter bio states "i'm a weeb / dj / photographer that likes openbsd" -- The references in the doc to LibreSSL, OpenSSH purity, OpenSMTPD, pf "unmaintained", OpenNTPD are codewords for "OpenBSD is better than FreeBSD".
- SwellJoe 7y ago
  The article mentions OpenBSD 4 times (vs Linux 2, Windows 2), in all cases directly comparing a default or feature in OpenBSD to the same default or feature in FreeBSD. Whether the author is an OpenBSD fan or not, I didn't come away with the feeling that OpenBSD was the suggested solution to the problem. I found it interesting, anyway, but didn't come away with any inclination to use OpenBSD on my next deployment.
- verytrivial 7y ago
  It's the topic that matters, no? When talking about BSD security, comparisons to how a security-focused BSD does it seems fair to me. OpenBSD is indeed "better" than FreeBSD when discussing security defaults. Not features or performance, security. I felt the theme was also whether FreeBSD users were aware of the situation, and whether they were able to meaningfully consent to it because they're defaults after all.
  - kev009 7y ago
    I don't think I can agree scientifically. OpenBSD developers do subjectively seem to think more holistically about security, and having less features lowers the total number but not the ratio and in practice it doesn't seem to have what I would consider a statistical magnitude difference in the type and ratio of incidents that plague C Unix-likes. In the article the author links to one of Ilja van Sprundel's excellent talks; the takeaway is basically that more eyes actually work for security and you could therefore infer Linux is a magnitude more secure than BSD. I've been quite negative in this thread because the overall debate on these topics is pretty frivolous. We already have the tools at our disposal to do magnitude greater secure software and splitting hairs over which BSD has better defaults is missing the forest for the trees.
    - ksec 7y ago
      >incidents that plague C Unix-likes Do you have a specific language in mind that offers improvement? Or am I reading too much into the sentence? >We already have the tools at our disposal to do magnitude greater secure software Mind sharing more details on the tools? Specifically with respect to System / OS Level programming.
      - tatersolid 7y ago
        >Do you have a specific language in mind that offers improvement? Any language with memory and type safety should comprise as much as possible of the whole system. See the Singularity OS from Microsoft Research, or whatever that Rust OS project is called. Almost all the major, nicknamed, headline-grabbing RCE bugs in the last two decades are memory or type safety issues in C or C++ code. Every C or C++ developer claims safe code is possible or even easy in their favorite language, but history has proven them very wrong.
      - kev009 7y ago
        I'm not banking on any language shift at the moment but could see a plausible case in the past for Ada and maybe now Rust after some more years of maturity both down to the metal. But both of these suffer from some awkwardness around the toolchain for integration into a traditional BSD right now, at least Rust may overcome that in time. syskaller is in use by the major BSDs and stricter compilers and other static analysis tools have been a far bigger impact IMHO than the OpenBSD style mitigations. I would like to actually see some kind of case studies where OpenBSD mitigations have protected a user where they'd have been let down by say Linux or FreeBSD or OpenBSD without them. I think a less snake oil approach to security is done by the seL4 folks, the difference in approach makes the *nix security mitigation people somewhat cringe worthy.
- andoriyu 7y ago
  pf is still single threaded in both OS, right?
- c256 7y ago
  As someone who hasn’t cared especially much about any *BSD since moving on from NetBSD, I can’t help but notice that a) your bio here calls out FreeBSD, and b) your posts here seem way more rant-like than anything in the post or the comment thread. Maybe - and I'm only saying this because I care - there are a lot of decaffeinated brands on the market that are just as tasty as the real thing.
  - kev009 7y ago
    Heh except if you actually read the comments I present Linux as the high water mark twice for security and stability. Maybe - and I'm only saying this because I care - you should consider through hiking and come back to the discussion when you are less easily offended by the facts at hand into low grade trolling and have requisite attention span and reading comprehension to participate meaningfully in the conversation.

uponcoffee 7y ago

Can you detail how the views presented provided are 'slanted' and 'don't matter'?

kev009 7y ago
Sure, say you configure a Linux, OpenBSD, and FreeBSD machine to provide some useful service. A "stack" as they call it these days. None of these OSes are going to have a large attack surface outside that "stack", and that is the primary liability in running an internet service. There are relatively rare occurrences like the TCP SACK bug that affected Linux and Netflix' non-default FreeBSD RACK TCP stack. Every UNIX-like written in C without formal verification is subject to incidents like that from time to time. Every other security concern is addressed in an OS-agnostic fashion with failure domains, limits of scope/networking, access controls, monitoring, and operations procedures. Now what Linux, and to a lesser degree FreeBSD, can do is survive real world usage at scale. OpenBSD cannot. It would fall over or require magnitude more machine count to do the same workloads that people use Linux and FreeBSD to run. So all the exploit mitigation diatribe and "great defaults" and pet projects are cute but funny when you try and throw shade onto others with them. As I said, there are some kernels of truth that pertain less about security and more about overall health in FreeBSD this doc accidentally hits on, but running some hobby software like opensmtpd on openbsd isn't going to save the world from real cybersecurity issues.
- Cyberdog 7y ago
  Among those "cute pet projects" are OpenSSH, LibreSSL, OpenNTPD, and PF. The internet at large, and even FreeBSD itself, would be all the poorer for not having these projects available. As someone who has run web servers with both FreeBSD and OpenBSD, I think some of your criticism in this thread is valid, but you really crossed the line into blatant fanboyism with that one at the least.
  - pushpop 7y ago
    Only really OpenSSH from your list applies though. LibreSSL isn’t really in widespread usage outside of OpenBSD and has still been vulnerable to some of recent the OpenSSL exploits. OpenNTPD is more widely used but lots of people still go for other alternatives and frankly I’m not convinced OpenNTPD offers anything significant over the competition anyway. pf is barely used outside of OpenBSD and frankly why should it be when Linux has iptables (which does the job well) and FreeBSD has ipfw (which also does the job well). pf is also a decent firewall but it’s also a crowded market with lots of really decent alternatives written by their respective platform hosts. I do actually quite like OpenBSD though. But outside of OpenSSH, OpenBSD is slowly becoming less relevant to the wider industry as other platforms catch up on security and even over take in terms of enterprise features.

howard941 7y ago

Yet he never gets around to ditching FreeBSD. The guy's a fan. I read it as a qualified endorsement.

snazz 7y ago

Could you elaborate on the issues with multiprocessing on OpenBSD? I haven’t had any difficulties running multiple Firefox processes across multiple cores on my machine. How have you DoS’ed it?

kev009 7y ago
Yes, run https://github.com/antonblanchard/will-it-scale https://github.com/antonblanchard/will-it-scale on operating systems with hilarious grandstanders like OpenBSD and Illumos, then run it on Linux and compare the results. Run a highly parallel make on a modern server and tell me which OS remains usable for other work. OpenBSD runs acceptably on 2-4 core laptops with HT disabled because a desktop workload doesn't typically invoke a lot of the kernel implementation during steady state, but you can do it there with a moderate disk and network load. That said, syscalls are more expensive in OpenBSD than contemporary operating systems so even as a uniprocessor OS it is funny.
- snazz 7y ago
  Fair points. I’ll wager that most users are willing to accept the trade-offs in favor of security, given that it likely won’t affect most day-to-day usage. (Also, I’m missing what’s so “funny” and “hilarious” about it.)
  - kev009 7y ago
    I use OpenBSD for fun on a couple systems and it is a cute OS, there are things to love about it. But the grandstanding is funny.
- davesmith1983 7y ago
  I don't think anyone that uses OpenBSD will claim that it is fast.
- bitminer 7y ago
  Will-it-scale has a dependency on hwloc which is not supported on OpenBSD. Do you have a better synthetic benchmark to suggest? And "speed" does depend on expectations. Compute tasks should be approximately equivalent, right? And os-limited tasks with many syscalls less so. You don't specifically state your expectations. Just that you are disappointed.

smittywerben 7y ago

> The only real facepalm this document describes accurately is that FreeBSD still bundles sendmail. I installed FreeBSD last night, you can just tick/untick these options during the install which addresses most of the article. [ ] enable sendmail [ ] enable sshd [ ] enable ntp [x] encrypt swap