4 ms·

My main use for OpenBSD is as a firewall/router, and they frequently make breaking changes to the pf rule syntax so I had to abandon it. Last breaking change wh

My main use for OpenBSD is as a firewall/router, and they frequently make breaking changes to the pf rule syntax so I had to abandon it. Last breaking change when I checked was July, but it's been going on for many years. If you have one firewall no big deal, but if you set them up for customers all over the place it's a nightmare. They should take a page out of Microsoft's book here.

binkHN 5y ago
Frequently is very subjective. Sometimes you have to make way for progress. I’ve been using pf since 3.0 and the syntax changes have been minimal and, I’d say, always for the better and to make a drastic improvement.
nix23 5y ago
>They should take a page out of Microsoft's book here Yeah NO. OpenBSD is the opposite of backward compatibility by design. You should have known that before installing at your customers site en masse. That's probably one point why PFsense is based on freebsd and OPNsense on hardenedbsd.
- noja 5y ago
  ^^ The wording of this response represents exactly why many people don't choose OpenBSD.
  - blacktriangle 5y ago
    Honestly that is a compliment. When it comes to evaluating tech, the best statements are those where you can walk away knowing very clearly that yes, this meets my needs, or no this absolutely does not meet my needs.
  - nix23 5y ago
    Let that not hear Linus and his wording.
  - 0xdeadb00f 5y ago
    They make a good point though. OpenBSD is not known for it's stability.
    - noja 5y ago
      I was referring not to the content of the comment, but the wording of its delivery.
      - nix23 5y ago
        That one? >>They should take a page out of Microsoft's book here. or mine? >You should have known that before installing at your customers site en masse. Sorry for stating a fact that you should know your OS before sprinkle it all over your customers.
        deleted 5y ago
        [deleted]
        deleted 5y ago
        [deleted]
  - ninjin 5y ago
    Yes, but you say that as if it was a universally bad thing. OpenBSD is largely made by its developers, for its developers. It has its own unique culture and does not seek mass appeal. To many – such as myself – this is refreshing, in particular when you contrast it to how poor open source developers are scolded on GitHub by entitled users for not putting in more of their free labour to satisfy their requirements. Is it for everyone? No and that is fine. You are always free to fork it or enjoy the fruits of their labour from a distance, such as with OpenSSH, tmux, etc. that work just as well for OSs which may have a culture closer to your taste (and that is also equally fine).
    - deleted 5y ago
      [deleted]
    - ayushnix 5y ago
      > OpenBSD is largely made by its developers, for its developers. It has its own unique culture and does not seek mass appeal. I wish these kind of caveats were highlighted more often, not only when it comes to OpenBSD but also when it comes to anything regarding Linux. Instead, you have people defending why the way how OpenBSD works is the "right" way. I'm honestly somewhat surpised at seeing how much people are attached and married to their tools.
  - znpy 5y ago
    Indeed. Last time I gave a look at OpenBSD I immediately noticed a huge courtain of gatekeeping around pretty much anything. Meh.
deleted 5y ago
[deleted]
protomyth 5y ago
"My main use for OpenBSD is as a firewall/router, and they frequently make breaking changes to the pf rule syntax so I had to abandon it." Uhm... well, I've been using it since 3.0 (when pf was introduced) and its been very stable. You have at least 6 months to convert your pf and its never taken me more than a day to get it changed. Its well documented and frankly, even with all the horror stories, I've found friendly help each time I had a question (do read the manual before asking a question). Looking at your firewall rules every 6 months isn't exactly stressful.
- lolpython 5y ago
  I don’t think most people would agree that breaking changes every 6 months fits the definition of “stable” for a firewall.
  - deleted 5y ago
    [deleted]
  - protomyth 5y ago
    They don't change it every six months. You look in the release notes and check if anything changed. Heck, there have been years where no changes were required.
  - jms703 5y ago
    Breaking changes do not occur every 6 months. The OS is upgraded every 6 months. Sometimes there are new features. Once in a while a line or two in your pf.conf may need to be changed as a new feature is added.
libx 5y ago
Why don't you check NetBSD's npf? It's not yet as featured as pf but will be. And NetBSD is a very stable system.

binkHN 5y ago

Frequently is very subjective. Sometimes you have to make way for progress. I’ve been using pf since 3.0 and the syntax changes have been minimal and, I’d say, always for the better and to make a drastic improvement.

nix23 5y ago

>They should take a page out of Microsoft's book here Yeah NO. OpenBSD is the opposite of backward compatibility by design. You should have known that before installing at your customers site en masse. That's probably one point why PFsense is based on freebsd and OPNsense on hardenedbsd.

noja 5y ago
^^ The wording of this response represents exactly why many people don't choose OpenBSD.
- blacktriangle 5y ago
  Honestly that is a compliment. When it comes to evaluating tech, the best statements are those where you can walk away knowing very clearly that yes, this meets my needs, or no this absolutely does not meet my needs.
- nix23 5y ago
  Let that not hear Linus and his wording.
- 0xdeadb00f 5y ago
  They make a good point though. OpenBSD is not known for it's stability.
  - noja 5y ago
    I was referring not to the content of the comment, but the wording of its delivery.
    - nix23 5y ago
      That one? >>They should take a page out of Microsoft's book here. or mine? >You should have known that before installing at your customers site en masse. Sorry for stating a fact that you should know your OS before sprinkle it all over your customers.
      - deleted 5y ago
        [deleted]
      - deleted 5y ago
        [deleted]
- ninjin 5y ago
  Yes, but you say that as if it was a universally bad thing. OpenBSD is largely made by its developers, for its developers. It has its own unique culture and does not seek mass appeal. To many – such as myself – this is refreshing, in particular when you contrast it to how poor open source developers are scolded on GitHub by entitled users for not putting in more of their free labour to satisfy their requirements. Is it for everyone? No and that is fine. You are always free to fork it or enjoy the fruits of their labour from a distance, such as with OpenSSH, tmux, etc. that work just as well for OSs which may have a culture closer to your taste (and that is also equally fine).
  - deleted 5y ago
    [deleted]
  - ayushnix 5y ago
    > OpenBSD is largely made by its developers, for its developers. It has its own unique culture and does not seek mass appeal. I wish these kind of caveats were highlighted more often, not only when it comes to OpenBSD but also when it comes to anything regarding Linux. Instead, you have people defending why the way how OpenBSD works is the "right" way. I'm honestly somewhat surpised at seeing how much people are attached and married to their tools.
- znpy 5y ago
  Indeed. Last time I gave a look at OpenBSD I immediately noticed a huge courtain of gatekeeping around pretty much anything. Meh.

deleted 5y ago

[deleted]

protomyth 5y ago

"My main use for OpenBSD is as a firewall/router, and they frequently make breaking changes to the pf rule syntax so I had to abandon it." Uhm... well, I've been using it since 3.0 (when pf was introduced) and its been very stable. You have at least 6 months to convert your pf and its never taken me more than a day to get it changed. Its well documented and frankly, even with all the horror stories, I've found friendly help each time I had a question (do read the manual before asking a question). Looking at your firewall rules every 6 months isn't exactly stressful.

lolpython 5y ago
I don’t think most people would agree that breaking changes every 6 months fits the definition of “stable” for a firewall.
- deleted 5y ago
  [deleted]
- protomyth 5y ago
  They don't change it every six months. You look in the release notes and check if anything changed. Heck, there have been years where no changes were required.
- jms703 5y ago
  Breaking changes do not occur every 6 months. The OS is upgraded every 6 months. Sometimes there are new features. Once in a while a line or two in your pf.conf may need to be changed as a new feature is added.

libx 5y ago

Why don't you check NetBSD's npf? It's not yet as featured as pf but will be. And NetBSD is a very stable system.