6 ms·

OpenBSD: a puffy in the aquarium

102 points by gbrindisi 16y ago

arespredator 16y ago
Neat and quite impressive, given how exotic OpenBSD seems to most people. One thing that bothers me though: why? I mean, why wouldn't they do it with any linux distribution? It would probably require less work, less custom tools (like these apps for automatic network configuration or scripts for automounting usb drives they mention), and with some security patches/kernel configurations it should give a similar security level OpenBSD does. Or am I missing something?
- shin_lao 16y ago
  OpenBSD security is more than few security patches and kernel configuration. Check out their web site for more information. Most Linux distributions I've played with (CentOS, Redhat, Ubuntu Server, Debian) are pretty mediocre when it comes to security. I've actually stopped using Debian since this incident : http://www.debian.org/security/2008/dsa-1571 http://www.debian.org/security/2008/dsa-1571 In addition, my own experience would point out that OpenBSD is more reliable than Linux, but I'm just a single data point. For development however, we use FreeBSD for a wide range of reasons including ports freshness.
  - danieldk 16y ago
    It's funny that you mention Red Hat (and CentOS), since they invest very heavily in attack mitigation and sandboxing through virtual machines: http://www.awe.com/mark/blog/20101130.html http://www.awe.com/mark/blog/20101130.html And as much as people dislike SELinux, it does help a lot in confining applications. OpenBSD does not provide comparable techniques.
    - 16s 16y ago
      They have clearly stated why they do not support those technologies multiple times, but it continually comes up. OpenBSD always goes with simple, easy to understand solutions that "just work out of the box" and can be easily configured and maintained. They build those simple solutions into the OS, they do not (and will not) bolt on complexity.
      - danieldk 16y ago
        OpenBSD always goes with simple, easy to understand solutions that "just work out of the box" and can be easily configured and maintained. Yes, we hear this every time. But this is the same project that advocated systrace, which provided access control with respect to syscalls. I do not see much of a difference between systrace and a mandatory access control framework, except that the implementation of systrace was flawed, it didn't support file labels, and SELinux has a more sophisticated policy language. The OpenBSD Project has a very narrow view of security, and do little to improve attack mitigation for software that is not in the base system (ports).
        tedunangst 16y ago
        Most of OpenBSD's attack mitigation is at the kernel or libc level. It applies equally to the base system and third party software.
      - runjake 16y ago
        This doesn't articulate your point at all. What simple solutions are you referring to? systrace? "Don't install ports"?
    - dj_axl 16y ago
      I don't know about now, but ~4 years ago installing from scratch I tried SELinux and after hours of configuring it still wasn't recognizing some hardware. Then I tried OpenBSD or FreeBSD, and it was up and running with minimal configuration. YMMV.
      - tedunangst 16y ago
        You discovered the difference between "works" and "can be made to work". There are many people who still believe they are synonymous.
      - evangineer 16y ago
        I've worked with SELinux in the past, it works but it can be a real pain to get up and running and there's a bit of a learning curve associated with it.
- jcr 16y ago
  BIAS: I drank the OpenBSD kool-aid a dozen years ago and have no regrets. I run OpenBSD everywhere and I try to help out as time and health allow, including on undeadly, but I'm not a commiter, major contributor or anyone special. OpenBSD is a bit like Jazz music. When someone asked Louis Armstrong, "What is jazz?" his reply was, "If ya gots to ask, ya'll never know." Though it will most definitely seem elitist, there's some subtle wisdom there; You need to experience it for yourself to learn the what's and why's. Similar is true for all of the BSD's. If you're just looking for a fast bullet point list and "executive overview" (a.k.a. "buzzword bingo decision support"), you'll never find a reason to run any of the BSD's, and worse, you'll never learn on your own why zealots like me exist. The thing you're missing is the experience of learning it for yourself. You might come to a different conclusion than me, and that's fine, but you would still benefit from the experience.
  - arespredator 16y ago
    Thanks, I guess I'll just have to try it:)
  - apl 16y ago
    Well, I'm sure that from your perspective the subtleties can't possibly be boiled down without missing the essence of OpenBSD. But there's got to be a way of summarizing its appeal. We are talking about an operating system, and not Kafka short stories or Haydn string quartets, after all. Otherwise I'll have to go with elitism as the most likely explanation. A common sentiment among jazz enthusiasts, by the way.
    - vacri 16y ago
      Remember that with jazz, if you make a mistake, just play it again a couple of times and then it looks like you meant it :)
    - ghshephard 16y ago
      I'm a huge fan of OpenBSD, having tried freebsd and most of the major Linux distress before settling on it. If I had to identify the why, i'd have to agree with the jazz reference. I seriously started comparing the various distros around 2003, and OpenBSD just gave a more consistent, well documented and clean experience. It is a very conservative distro, and has a pristine configuration and network stack. It's reliable, and trustworthy. On the downside, it's not particularly performant, nor is it well supported by enterprise Applications - you won't be running oracle 10g on OpenBSD. Its upgrades are rolled out like clockwork, and are always evolutionary improvements on the previous version.
vacri 16y ago
All these locations are fully running under OpenBSD vs OpenNX for accessing Windows Remote Desktop or Terminal services (that is needed because companies use internally developed applications running on Windows only) If they're fully OpenBSD, why do they need Windows Remote Desktop for access to internally developed software? Why are internal devs making Windows software? It doesn't seem to be a typo given the way the comment is structured. I mean, good on 'em for reducing their OS management overhead, but this just seems weird. Separate to that, out of curiosity, which brand name laptop supports OpenBSD well enough to supply Fortune 500 companies?
- jcr 16y ago
  You essentially have two questions there. The answers are: #1 Legacy Software #2 Lenovo
  - vacri 16y ago
    gah, sorry, running on empty at the moment. I should have twigged to lenovo as I have a new laptop of theirs... but it's got a damn realtek wifi card that doesn't have stable linux drivers. that's my excuse and I'm sticking to it :)
- neworbit 16y ago
  Likely one of two (or two of two) reasons: 1) A particular location is running BSD - a branch office or the like. The whole company isn't migrated. 2) Migration doesn't extend to rebuilding the legacy internal software built over the last ten years, which is Windows based and still needs to be supported so that the current business processes run uninterrupted.
16s 16y ago
Buy a CD from them. They are the reason we all have OpenSSH. Without that, Unix/Linux/BSD (as we know it today) would be much less secure. 4.9 CDs may be pre-ordered now: http://openbsd.org/orders.html http://openbsd.org/orders.html You won't find a simpler, cleaner Unix anywhere.
- jkossen 16y ago
  Indeed. Even if you don't use OpenBSD, or dislike some of their team members, they do develop great software and documentation which is used in a lot more systems than just OpenBSD itself.
  - Tharkun 16y ago
    The fact that the project is more known for the abrasive nature of its team members than for its great software (like OpenSSH or OpenBGPD or PF) pretty much sums up the sad sad state of affairs. It's their project and they can do as they damn well please, but really, a little kindness would go a long way. The software may be open, but the project is not.
    - bioh42_2 16y ago
      You rarely get extreme excellence without things like mean leaders. Think of Apple and Steve Jobs.
- jz 16y ago
  I purchased my first CD set yesterday. They provide great tools (OpenSSH, tmux, and of course OpenBSD) which save me time and money and make my life easier.
  - evangineer 16y ago
    It's been a few years since I regularly purchased an OpenBSD CD set. Might be time to review that.
hrasm 16y ago
OpenBSD is an awesome piece of software. One OS that, to my limited understanding, clearly demarcates userland and kernel boundaries. And if I recall correctly, a critical X related bug was patched in OpenBSD during a regular code audit. Clearly, they have very good security and audit practices in places. However, there was this one incident when Theo trained all his salvos on this one kid who had the audacity to email the list about his pet project which was an extension of OpenBSD of some sort (open source of course). Technically, Theo was right. But his style rubbed me the wrong way. I have since then discontinued using OpenBSD.
- RexRollman 16y ago
  I agree almost always with Theo's view on things but what he says often transmits through a dick filter.
- danieldk 16y ago
  Please give me one example how OpenBSD 'demarcates userland and kernel boundaries' more clearly than any other modern Unix?
  - hrasm 16y ago
    Like I said, my understanding is very limited. I was parroting an informative comment I read sometime atleast two years ago.
RexRollman 16y ago
I have to say that OpenBSD is my favorite of the *BSDs. The only thing that it lacks, that I wish it had, is a journaling file system (fsck takes forever on today's large hard drives). EDIT: And whole disk encryption. I am really surprised, given OpenBSD's security goals, that no one has implemented this.
- protomyth 16y ago
  I think I would be in heaven if someone ported HAMMER to OpenBSD. I use OpenBSD for a lot of our servers. It is amazingly fast to setup a new machine.
  - RexRollman 16y ago
    I've read lots of good things about Hammer. I've been wanting to give DragonFly a try because of it but it doesn't like my computer (the install CD freezes at startup).
    - protomyth 16y ago
      I'm going to setup a new fileserver using it. I think it will perform quite nicely.
- there 16y ago
  openbsd has a software raid mechanism to encrypt partitions. it is not yet bootable, so there must still be a small boot partition, but everything else can live on an encrypted raid set. bootable support is coming very soon so the entire disk can be encrypted (or be on any other raid configuration). i've been using encrypted softraid for a long time on my laptops and on a central backup server (which has a raid 1 mirrored set across 2 disks, then an encrypted volume on top of that).
  - anonymous 16y ago
    > bootable support is coming very soon What's your source for this?
keyle 16y ago
I run openbsd on the servers, I run ubuntu on the desktops. Best of both worlds really. The rest is chasing hair out of the soup.
plainOldText 16y ago
speaking of openbsd. I didnt see any follow up on presumably fbi backdoor. Does anyone know whats going on?
- skymt 16y ago
  The OpenBSD IPsec stack was audited, a few notable bugs were fixed, but no evidence of a backdoor was found. http://arstechnica.com/open-source/news/2010/12/openbsd-code-audit-uncovers-bugs-but-no-evidence-of-backdoor.ars http://arstechnica.com/open-source/news/2010/12/openbsd-code...
  - plainOldText 16y ago
    Great! Thanks
hs 16y ago
Can OpenBSD use Android USB tether? (I use Android Wifi Tether but my milestone battery runs too hot)
- tedunangst 16y ago
  Depends on entirely the gadget. Some phones show up as one of a dozen different serial devices and work with ppp. Others will work as cdce, which is very nice.

102 points by gbrindisi 16y ago

Neat and quite impressive, given how exotic OpenBSD seems to most people. One thing that bothers me though: why? I mean, why wouldn't they do it with any linux distribution? It would probably require less work, less custom tools (like these apps for automatic network configuration or scripts for automounting usb drives they mention), and with some security patches/kernel configurations it should give a similar security level OpenBSD does. Or am I missing something?

shin_lao 16y ago
OpenBSD security is more than few security patches and kernel configuration. Check out their web site for more information. Most Linux distributions I've played with (CentOS, Redhat, Ubuntu Server, Debian) are pretty mediocre when it comes to security. I've actually stopped using Debian since this incident : http://www.debian.org/security/2008/dsa-1571 http://www.debian.org/security/2008/dsa-1571 In addition, my own experience would point out that OpenBSD is more reliable than Linux, but I'm just a single data point. For development however, we use FreeBSD for a wide range of reasons including ports freshness.
- danieldk 16y ago
  It's funny that you mention Red Hat (and CentOS), since they invest very heavily in attack mitigation and sandboxing through virtual machines: http://www.awe.com/mark/blog/20101130.html http://www.awe.com/mark/blog/20101130.html And as much as people dislike SELinux, it does help a lot in confining applications. OpenBSD does not provide comparable techniques.
  - 16s 16y ago
    They have clearly stated why they do not support those technologies multiple times, but it continually comes up. OpenBSD always goes with simple, easy to understand solutions that "just work out of the box" and can be easily configured and maintained. They build those simple solutions into the OS, they do not (and will not) bolt on complexity.
    - danieldk 16y ago
      OpenBSD always goes with simple, easy to understand solutions that "just work out of the box" and can be easily configured and maintained. Yes, we hear this every time. But this is the same project that advocated systrace, which provided access control with respect to syscalls. I do not see much of a difference between systrace and a mandatory access control framework, except that the implementation of systrace was flawed, it didn't support file labels, and SELinux has a more sophisticated policy language. The OpenBSD Project has a very narrow view of security, and do little to improve attack mitigation for software that is not in the base system (ports).
      - tedunangst 16y ago
        Most of OpenBSD's attack mitigation is at the kernel or libc level. It applies equally to the base system and third party software.
    - runjake 16y ago
      This doesn't articulate your point at all. What simple solutions are you referring to? systrace? "Don't install ports"?
  - dj_axl 16y ago
    I don't know about now, but ~4 years ago installing from scratch I tried SELinux and after hours of configuring it still wasn't recognizing some hardware. Then I tried OpenBSD or FreeBSD, and it was up and running with minimal configuration. YMMV.
    - tedunangst 16y ago
      You discovered the difference between "works" and "can be made to work". There are many people who still believe they are synonymous.
    - evangineer 16y ago
      I've worked with SELinux in the past, it works but it can be a real pain to get up and running and there's a bit of a learning curve associated with it.
jcr 16y ago
BIAS: I drank the OpenBSD kool-aid a dozen years ago and have no regrets. I run OpenBSD everywhere and I try to help out as time and health allow, including on undeadly, but I'm not a commiter, major contributor or anyone special. OpenBSD is a bit like Jazz music. When someone asked Louis Armstrong, "What is jazz?" his reply was, "If ya gots to ask, ya'll never know." Though it will most definitely seem elitist, there's some subtle wisdom there; You need to experience it for yourself to learn the what's and why's. Similar is true for all of the BSD's. If you're just looking for a fast bullet point list and "executive overview" (a.k.a. "buzzword bingo decision support"), you'll never find a reason to run any of the BSD's, and worse, you'll never learn on your own why zealots like me exist. The thing you're missing is the experience of learning it for yourself. You might come to a different conclusion than me, and that's fine, but you would still benefit from the experience.
- arespredator 16y ago
  Thanks, I guess I'll just have to try it:)
- apl 16y ago
  Well, I'm sure that from your perspective the subtleties can't possibly be boiled down without missing the essence of OpenBSD. But there's got to be a way of summarizing its appeal. We are talking about an operating system, and not Kafka short stories or Haydn string quartets, after all. Otherwise I'll have to go with elitism as the most likely explanation. A common sentiment among jazz enthusiasts, by the way.
  - vacri 16y ago
    Remember that with jazz, if you make a mistake, just play it again a couple of times and then it looks like you meant it :)
  - ghshephard 16y ago
    I'm a huge fan of OpenBSD, having tried freebsd and most of the major Linux distress before settling on it. If I had to identify the why, i'd have to agree with the jazz reference. I seriously started comparing the various distros around 2003, and OpenBSD just gave a more consistent, well documented and clean experience. It is a very conservative distro, and has a pristine configuration and network stack. It's reliable, and trustworthy. On the downside, it's not particularly performant, nor is it well supported by enterprise Applications - you won't be running oracle 10g on OpenBSD. Its upgrades are rolled out like clockwork, and are always evolutionary improvements on the previous version.

vacri 16y ago

All these locations are fully running under OpenBSD vs OpenNX for accessing Windows Remote Desktop or Terminal services (that is needed because companies use internally developed applications running on Windows only) If they're fully OpenBSD, why do they need Windows Remote Desktop for access to internally developed software? Why are internal devs making Windows software? It doesn't seem to be a typo given the way the comment is structured. I mean, good on 'em for reducing their OS management overhead, but this just seems weird. Separate to that, out of curiosity, which brand name laptop supports OpenBSD well enough to supply Fortune 500 companies?

jcr 16y ago
You essentially have two questions there. The answers are: #1 Legacy Software #2 Lenovo
- vacri 16y ago
  gah, sorry, running on empty at the moment. I should have twigged to lenovo as I have a new laptop of theirs... but it's got a damn realtek wifi card that doesn't have stable linux drivers. that's my excuse and I'm sticking to it :)
neworbit 16y ago
Likely one of two (or two of two) reasons: 1) A particular location is running BSD - a branch office or the like. The whole company isn't migrated. 2) Migration doesn't extend to rebuilding the legacy internal software built over the last ten years, which is Windows based and still needs to be supported so that the current business processes run uninterrupted.

16s 16y ago

Buy a CD from them. They are the reason we all have OpenSSH. Without that, Unix/Linux/BSD (as we know it today) would be much less secure. 4.9 CDs may be pre-ordered now: http://openbsd.org/orders.html http://openbsd.org/orders.html You won't find a simpler, cleaner Unix anywhere.

jkossen 16y ago
Indeed. Even if you don't use OpenBSD, or dislike some of their team members, they do develop great software and documentation which is used in a lot more systems than just OpenBSD itself.
- Tharkun 16y ago
  The fact that the project is more known for the abrasive nature of its team members than for its great software (like OpenSSH or OpenBGPD or PF) pretty much sums up the sad sad state of affairs. It's their project and they can do as they damn well please, but really, a little kindness would go a long way. The software may be open, but the project is not.
  - bioh42_2 16y ago
    You rarely get extreme excellence without things like mean leaders. Think of Apple and Steve Jobs.
jz 16y ago
I purchased my first CD set yesterday. They provide great tools (OpenSSH, tmux, and of course OpenBSD) which save me time and money and make my life easier.
- evangineer 16y ago
  It's been a few years since I regularly purchased an OpenBSD CD set. Might be time to review that.

hrasm 16y ago

OpenBSD is an awesome piece of software. One OS that, to my limited understanding, clearly demarcates userland and kernel boundaries. And if I recall correctly, a critical X related bug was patched in OpenBSD during a regular code audit. Clearly, they have very good security and audit practices in places. However, there was this one incident when Theo trained all his salvos on this one kid who had the audacity to email the list about his pet project which was an extension of OpenBSD of some sort (open source of course). Technically, Theo was right. But his style rubbed me the wrong way. I have since then discontinued using OpenBSD.

RexRollman 16y ago
I agree almost always with Theo's view on things but what he says often transmits through a dick filter.
danieldk 16y ago
Please give me one example how OpenBSD 'demarcates userland and kernel boundaries' more clearly than any other modern Unix?
- hrasm 16y ago
  Like I said, my understanding is very limited. I was parroting an informative comment I read sometime atleast two years ago.

RexRollman 16y ago

I have to say that OpenBSD is my favorite of the *BSDs. The only thing that it lacks, that I wish it had, is a journaling file system (fsck takes forever on today's large hard drives). EDIT: And whole disk encryption. I am really surprised, given OpenBSD's security goals, that no one has implemented this.

protomyth 16y ago
I think I would be in heaven if someone ported HAMMER to OpenBSD. I use OpenBSD for a lot of our servers. It is amazingly fast to setup a new machine.
- RexRollman 16y ago
  I've read lots of good things about Hammer. I've been wanting to give DragonFly a try because of it but it doesn't like my computer (the install CD freezes at startup).
  - protomyth 16y ago
    I'm going to setup a new fileserver using it. I think it will perform quite nicely.
there 16y ago
openbsd has a software raid mechanism to encrypt partitions. it is not yet bootable, so there must still be a small boot partition, but everything else can live on an encrypted raid set. bootable support is coming very soon so the entire disk can be encrypted (or be on any other raid configuration). i've been using encrypted softraid for a long time on my laptops and on a central backup server (which has a raid 1 mirrored set across 2 disks, then an encrypted volume on top of that).
- anonymous 16y ago
  > bootable support is coming very soon What's your source for this?

keyle 16y ago

I run openbsd on the servers, I run ubuntu on the desktops. Best of both worlds really. The rest is chasing hair out of the soup.

plainOldText 16y ago

speaking of openbsd. I didnt see any follow up on presumably fbi backdoor. Does anyone know whats going on?

skymt 16y ago
The OpenBSD IPsec stack was audited, a few notable bugs were fixed, but no evidence of a backdoor was found. http://arstechnica.com/open-source/news/2010/12/openbsd-code-audit-uncovers-bugs-but-no-evidence-of-backdoor.ars http://arstechnica.com/open-source/news/2010/12/openbsd-code...
- plainOldText 16y ago
  Great! Thanks

hs 16y ago

Can OpenBSD use Android USB tether? (I use Android Wifi Tether but my milestone battery runs too hot)

tedunangst 16y ago
Depends on entirely the gadget. Some phones show up as one of a dozen different serial devices and work with ppp. Others will work as cdce, which is very nice.