19 ms·

OpenBSD: How it all started

219 points by janvdberg 5y ago

at_a_remove 5y ago
I never could "bond" with OpenBSD, despite being a supporter and even still possessed of some of the distribution CDs circa 2002. It always felt just a little out of reach for me.
cestith 5y ago
https://bsdly.blogspot.com/2021/09/what-every-it-person-needs-to-know.html https://bsdly.blogspot.com/2021/09/what-every-it-person-need... is the original article mentioned at the very end of the submitted article.
usui 5y ago
Wow, this entire thread has made me appreciate OpenBSD a lot more compared to FreeBSD/NetBSD. I'm interested to hear about part 2 when it comes out and what he has to say about macOS/Apple.
adharmad 5y ago
Historical email archives from the NetBSD mailing list which show some of the early conversations around why Theo founded OpenBSD: https://www.theos.com/deraadt/coremail.html https://www.theos.com/deraadt/coremail.html
xvilka 5y ago
Just installed OpenBSD 7.0 on Raspberry Pi 3b+ for testing purposes. Latest version supports and work with all devices out of the box including WiFi. It required to install brcm firmware manually with pkg_add though. The rest was smooth.
knorker 5y ago
I like OpenBSD, but I wish all these OpenBSD articles stopped repeating the fake news that it invented W^X. Some of us were alive back then, and know that's not true. It invented the name W^X (a name that's technically incorrect because it's possible to have read-only pages that are not executable). But grsecurity patches had had it on Linux for, I believe, years. I'd been running it for a long time in any case. OpenBSD copied W^X, and copied it poorly. E.g. in the first version they said "this cannot be done on 32bit x86". That's funny, because grsec/pax patches did exactly that. OpenBSD eventually realized this, and copied that too. It was first in a mainstream OS to do it, yes. But that's not "inventing it". That said, OpenBSD is a nice system. It would not allow the wave of extreme instability that Linux has gotten lately in the form of systemd. OpenBSD folks would not accept init and other core services crashing regularly. I just need a bit more hardware support, and I'll switch. I'm fixing some of the blockers preventing me from switching as we speak. Biggest thing I'll miss from Linux is Wayland. I hope that comes to OpenBSD soon.
- wahern 5y ago
  Publishing kernel patches is one thing; publishing an entire operating system distribution where everything runs properly out-of-the-box with those patches enabled by default is quite another. Yes, PaX kernel patches were published in October 2000, 3 years before OpenBSD made an official release with W^X (OpenBSD 3.3, May 2003). But without extensive changes in user space to ensure that data and code were separated in object files, you ended up with alot of complexity, and that complexity ultimately turned out to make PaX significantly less effective: https://lwn.net/Articles/126986/ https://lwn.net/Articles/126986/ Indeed, that's always been the problem with grsecurity patches in general--poor system integration which they've often tried to overcome with sophisticated (arguably overly sophisticated) methods. Neither grsecurity nor OpenBSD "invented" PaX/W^X. They were using pre-existing hardware features designed precisely for this type of capability, it just was never comprehensively employed by a major operating system because it required extensive changes not only to kernels but also, as it turns out, to userland.
  - knorker 5y ago
    > Publishing kernel patches is one thing; publishing an entire operating system distribution where everything runs properly out-of-the-box with those patches enabled by default is quite another. That's exactly my point. That's why I find it so annoying that these articles say the wrong thing. > Neither grsecurity nor OpenBSD "invented" PaX/W^X. They were using pre-existing hardware features designed precisely for this type of capability, The first version of PaX predate the page table no-execute bit in x86 hardware, and I believe (eventually) W^X didn't require it either. So no it was not a matter of merely starting to use existing hardware capability. That's why it even was an invention in the first place. Everything got vastly easier once the page-level execute bit was launched in hardware. At the time, when OpenBSD was asked "why aren't you looking at what PaX did?", and they answered that "we don't care what others in the industry are doing". Which is a strange way to think you can create the best security. So Linux patches: 2000. OpenBSD: 2003. Windows: 2004. (not saying OpenBSD didn't do it better, because they don't care about binary compatability, making it easier) If OpenBSD had "invented" it, then how could microsoft possibly have launched it only one year later? Again, I do credit OpenBSD for being the first OS to do these things by default on an OS. But that is, as you said, is "quite another [thing]" from inventing it.
_wldu 5y ago
OpenBSD and Debian are really the only systems I use and trust today. I'm sure there are some other 'old-school' open source operating systems out there that are just as useful. But these two have been great over the last 25 years.
- copperx 5y ago
  One thing that is glossed over is how Linux won to OpenBSD. I remember back in the 90's, web hosting providers boasted they used OpenBSD instead of Linux for security.
  - masklinn 5y ago
    > One thing that is glossed over is how Linux won to OpenBSD. Isn’t https://en.m.wikipedia.org/wiki/UNIX_System_Laboratories,_Inc._v._Berkeley_Software_Design,_Inc https://en.m.wikipedia.org/wiki/UNIX_System_Laboratories,_In.... the answer? Linux was completely safe, BSDs were a risk, the choice was easy. USL / AT&T basically kneecapped the bsds.
- AndyMcConachie 5y ago
  I am completely in agreement with this comment.
- bsdooby 5y ago
  Slackware comes to mind.
  - phone8675309 5y ago
    It would be nice if Slackware released at least as often as Debian stable though
    - hulitu 5y ago
      It's in RC now. My computer is waiting.
    - 5y ago
willis936 5y ago
Secure, yet refuses to implement hardware root-of-trust standards? https://isopenbsdsecu.re/mitigations/secure_boot/ https://isopenbsdsecu.re/mitigations/secure_boot/
- anthk 5y ago
  Who cares. You can encrypt the whole disk with bioctl(4).
  - deleted 5y ago
    [deleted]
- tonoto 5y ago
  So you believe that the Microsoft-controlled solution is a viable option?
  - willis936 5y ago
    Not only viable, but the standard. "What is UEFI Secure Boot NOT? UEFI Secure Boot is not an attempt by Microsoft to lock Linux out of the PC market here; SB is a security measure to protect against malware during early system boot. Microsoft act as a Certification Authority (CA) for SB, and they will sign programs on behalf of other trusted organisations so that their programs will also run."[0] 0. https://wiki.debian.org/SecureBoot https://wiki.debian.org/SecureBoot
    - math-dev 5y ago
      Never trust microsoft or any other big tech firm
    - hulitu 5y ago
      > Microsoft act as a Certification Authority (CA) for SB, and they will sign programs on behalf of other trusted organisations so that their programs will also run. This means: 1. You trust Microsoft (you delegate the trust of your data to Microsoft). 2. You trust that Microsoft certificate will not be revoked. Sorry, for me, secure boot is when i have the keys. When someone else has them they also have my data.
maxclark 5y ago
It’s fun to see these posts but soo much backstory and history is glossed over and skipped. OpenBSD developers used to have development sprints and code check ins in Canada to work around US crypto laws. It’s hard to explain how big a deal OpenSSH was/is and how much we owe to the OpenBSD project for it. Also the fork from NetBSD is way more colorful.
- Zenst 5y ago
  > OpenBSD developers used to have development sprints and code check ins in Canada to work around US crypto laws. Yip, I brought OpenBSD CD set back in that era (2.4 release!) and asked in the order if it included the crypto lib's and got a hand written note with shipment saying exactly why they ship from Canada and no worries. Believe it was Theo who wrote that as well. This was mid/late 90's era. Maybe I should dig that out and pop into a museum of some sorts, as a bit of history and unique.
  - msla 5y ago
    A simple way to preserve it is to scan it and rip it and upload it all to archive.org. https://archive.org/details/cd-roms https://archive.org/details/cd-roms
    - Zenst 5y ago
      Excellent suggestion and added this to favourites as a backup reminder to do this. Hopefully be going thru that cupboard before the end of the year, so will get on that then. Thank you. I do recall it was the initial release with blowfish so, that's pretty neat.
  - maxclark 5y ago
    If you still have that it’s pretty awesome
- tedunangst 5y ago
  The workaround for the RSA patent using dynamically loaded stub libraries is also kinda noteworthy.
jmclnx 5y ago
> poorly written software will crash a lot more often on OpenBSD than elsewhere The above quote is what sold me on OpenBSD as a Devl Platform. I work with AIX and decided to test the objects I wrote for an interface to a proprietary application. Testing them on OpenBSD identified memory leaks and things like that in 2 of them. So now I always test on OpenBSD when I am able to. To do that on Linux would have required 1 or 2 third party applications I know nothing about, so I took the easy route :)
- binkHN 5y ago
  You’re not alone—this is somewhat common. Many programs that are written for multiple platforms benefit from this and I frequently see commit logs noting something similar to “Fixed a few <insert bugs, off by ones, memory allocation issue and whatnot here> that resulted in a crash on OpenBSD.” While great for the program and developer, unfortunately this also has the opposite effect of some less enlightened users reporting that some (poorly written) programs “always crash on OpenBSD.”
  - smhenderson 5y ago
    unfortunately this also has the opposite effect of some less enlightened users reporting that some (poorly written) programs “always crash on OpenBSD.” IDK, given their stance on who it's for, i.e. "we write OpenBSD for us, use it or don't, we don't care", that seems like a feature not a bug. It comes across as harsh or elitist to some people but the developers literally have no desire to gain market share, help newbies get started or port popular software to OpenBSD, unless they think it will directly benefit them. I find it kind of fun and refreshing having to solve an issue I'm having with OpenBSD by reaching for the very fine manual and experimenting with it. You won't find dozens of sites by searching the internet, often with conflicting information, that try to explain what's happening to you and how you can fix it. I have no option to use it at work right now but at home I always have one (old, recycled) server and one laptop running OpenBSD. And they're my favorite machines to use.
- mrweasel 5y ago
  Bob Beck also covers this in his talk about the first 30 days of libreSSL. The entire talk is amazing, even 7 years later. https://youtu.be/GnBbhXBDmwU https://youtu.be/GnBbhXBDmwU
wing-_-nuts 5y ago
Reading the article, and hearing them bang on about code quality and security, this reminds me. Is there any good modern book on C development with today's best practices? I have K&R but I've been told that's very outdated.
- anthk 5y ago
  K&R 2nd edition is ANSI C. It will run everywhere, but I think nowadays C99 is expected at least, along a book on BSD 4.4 and the infamous Advanced Programming in the Unix Environment. But the K&R 2nd edition is ANSI C is perfect to begin with. 99% of what you see in the src will be enough to be understood with that background.
- HugoDaniel 5y ago
  Modern C is a nice one, and free to read at https://hal.inria.fr/hal-02383654 https://hal.inria.fr/hal-02383654
- Koshkin 5y ago
  You still might want to read that first, if you haven't.
- guerrilla 5y ago
  There might be better ones but maybe Effective C from No Starch press.
lizknope 5y ago
I thought this was going to be about Theo being forced out of NetBSD back in 1994 and then starting OpenBSD. I was in college and ran Linux but my roommate ran NetBSD and was telling me all the mailing list drama. It is still archived here under footnotes 11 and 12 https://en.wikipedia.org/wiki/OpenBSD#cite_note-glass-12 https://en.wikipedia.org/wiki/OpenBSD#cite_note-glass-12

219 points by janvdberg 5y ago

I never could "bond" with OpenBSD, despite being a supporter and even still possessed of some of the distribution CDs circa 2002. It always felt just a little out of reach for me.

cestith 5y ago

https://bsdly.blogspot.com/2021/09/what-every-it-person-needs-to-know.html https://bsdly.blogspot.com/2021/09/what-every-it-person-need... is the original article mentioned at the very end of the submitted article.

usui 5y ago

Wow, this entire thread has made me appreciate OpenBSD a lot more compared to FreeBSD/NetBSD. I'm interested to hear about part 2 when it comes out and what he has to say about macOS/Apple.

adharmad 5y ago

Historical email archives from the NetBSD mailing list which show some of the early conversations around why Theo founded OpenBSD: https://www.theos.com/deraadt/coremail.html https://www.theos.com/deraadt/coremail.html

xvilka 5y ago

Just installed OpenBSD 7.0 on Raspberry Pi 3b+ for testing purposes. Latest version supports and work with all devices out of the box including WiFi. It required to install brcm firmware manually with pkg_add though. The rest was smooth.

knorker 5y ago

I like OpenBSD, but I wish all these OpenBSD articles stopped repeating the fake news that it invented W^X. Some of us were alive back then, and know that's not true. It invented the name W^X (a name that's technically incorrect because it's possible to have read-only pages that are not executable). But grsecurity patches had had it on Linux for, I believe, years. I'd been running it for a long time in any case. OpenBSD copied W^X, and copied it poorly. E.g. in the first version they said "this cannot be done on 32bit x86". That's funny, because grsec/pax patches did exactly that. OpenBSD eventually realized this, and copied that too. It was first in a mainstream OS to do it, yes. But that's not "inventing it". That said, OpenBSD is a nice system. It would not allow the wave of extreme instability that Linux has gotten lately in the form of systemd. OpenBSD folks would not accept init and other core services crashing regularly. I just need a bit more hardware support, and I'll switch. I'm fixing some of the blockers preventing me from switching as we speak. Biggest thing I'll miss from Linux is Wayland. I hope that comes to OpenBSD soon.

wahern 5y ago
Publishing kernel patches is one thing; publishing an entire operating system distribution where everything runs properly out-of-the-box with those patches enabled by default is quite another. Yes, PaX kernel patches were published in October 2000, 3 years before OpenBSD made an official release with W^X (OpenBSD 3.3, May 2003). But without extensive changes in user space to ensure that data and code were separated in object files, you ended up with alot of complexity, and that complexity ultimately turned out to make PaX significantly less effective: https://lwn.net/Articles/126986/ https://lwn.net/Articles/126986/ Indeed, that's always been the problem with grsecurity patches in general--poor system integration which they've often tried to overcome with sophisticated (arguably overly sophisticated) methods. Neither grsecurity nor OpenBSD "invented" PaX/W^X. They were using pre-existing hardware features designed precisely for this type of capability, it just was never comprehensively employed by a major operating system because it required extensive changes not only to kernels but also, as it turns out, to userland.
- knorker 5y ago
  > Publishing kernel patches is one thing; publishing an entire operating system distribution where everything runs properly out-of-the-box with those patches enabled by default is quite another. That's exactly my point. That's why I find it so annoying that these articles say the wrong thing. > Neither grsecurity nor OpenBSD "invented" PaX/W^X. They were using pre-existing hardware features designed precisely for this type of capability, The first version of PaX predate the page table no-execute bit in x86 hardware, and I believe (eventually) W^X didn't require it either. So no it was not a matter of merely starting to use existing hardware capability. That's why it even was an invention in the first place. Everything got vastly easier once the page-level execute bit was launched in hardware. At the time, when OpenBSD was asked "why aren't you looking at what PaX did?", and they answered that "we don't care what others in the industry are doing". Which is a strange way to think you can create the best security. So Linux patches: 2000. OpenBSD: 2003. Windows: 2004. (not saying OpenBSD didn't do it better, because they don't care about binary compatability, making it easier) If OpenBSD had "invented" it, then how could microsoft possibly have launched it only one year later? Again, I do credit OpenBSD for being the first OS to do these things by default on an OS. But that is, as you said, is "quite another [thing]" from inventing it.

_wldu 5y ago

OpenBSD and Debian are really the only systems I use and trust today. I'm sure there are some other 'old-school' open source operating systems out there that are just as useful. But these two have been great over the last 25 years.

copperx 5y ago
One thing that is glossed over is how Linux won to OpenBSD. I remember back in the 90's, web hosting providers boasted they used OpenBSD instead of Linux for security.
- masklinn 5y ago
  > One thing that is glossed over is how Linux won to OpenBSD. Isn’t https://en.m.wikipedia.org/wiki/UNIX_System_Laboratories,_Inc._v._Berkeley_Software_Design,_Inc https://en.m.wikipedia.org/wiki/UNIX_System_Laboratories,_In.... the answer? Linux was completely safe, BSDs were a risk, the choice was easy. USL / AT&T basically kneecapped the bsds.
AndyMcConachie 5y ago
I am completely in agreement with this comment.
bsdooby 5y ago
Slackware comes to mind.
- phone8675309 5y ago
  It would be nice if Slackware released at least as often as Debian stable though
  - hulitu 5y ago
    It's in RC now. My computer is waiting.
  - 5y ago

willis936 5y ago

Secure, yet refuses to implement hardware root-of-trust standards? https://isopenbsdsecu.re/mitigations/secure_boot/ https://isopenbsdsecu.re/mitigations/secure_boot/

anthk 5y ago
Who cares. You can encrypt the whole disk with bioctl(4).
- deleted 5y ago
  [deleted]
tonoto 5y ago
So you believe that the Microsoft-controlled solution is a viable option?
- willis936 5y ago
  Not only viable, but the standard. "What is UEFI Secure Boot NOT? UEFI Secure Boot is not an attempt by Microsoft to lock Linux out of the PC market here; SB is a security measure to protect against malware during early system boot. Microsoft act as a Certification Authority (CA) for SB, and they will sign programs on behalf of other trusted organisations so that their programs will also run."[0] 0. https://wiki.debian.org/SecureBoot https://wiki.debian.org/SecureBoot
  - math-dev 5y ago
    Never trust microsoft or any other big tech firm
  - hulitu 5y ago
    > Microsoft act as a Certification Authority (CA) for SB, and they will sign programs on behalf of other trusted organisations so that their programs will also run. This means: 1. You trust Microsoft (you delegate the trust of your data to Microsoft). 2. You trust that Microsoft certificate will not be revoked. Sorry, for me, secure boot is when i have the keys. When someone else has them they also have my data.

maxclark 5y ago

It’s fun to see these posts but soo much backstory and history is glossed over and skipped. OpenBSD developers used to have development sprints and code check ins in Canada to work around US crypto laws. It’s hard to explain how big a deal OpenSSH was/is and how much we owe to the OpenBSD project for it. Also the fork from NetBSD is way more colorful.

Zenst 5y ago
> OpenBSD developers used to have development sprints and code check ins in Canada to work around US crypto laws. Yip, I brought OpenBSD CD set back in that era (2.4 release!) and asked in the order if it included the crypto lib's and got a hand written note with shipment saying exactly why they ship from Canada and no worries. Believe it was Theo who wrote that as well. This was mid/late 90's era. Maybe I should dig that out and pop into a museum of some sorts, as a bit of history and unique.
- msla 5y ago
  A simple way to preserve it is to scan it and rip it and upload it all to archive.org. https://archive.org/details/cd-roms https://archive.org/details/cd-roms
  - Zenst 5y ago
    Excellent suggestion and added this to favourites as a backup reminder to do this. Hopefully be going thru that cupboard before the end of the year, so will get on that then. Thank you. I do recall it was the initial release with blowfish so, that's pretty neat.
- maxclark 5y ago
  If you still have that it’s pretty awesome
tedunangst 5y ago
The workaround for the RSA patent using dynamically loaded stub libraries is also kinda noteworthy.

jmclnx 5y ago

> poorly written software will crash a lot more often on OpenBSD than elsewhere The above quote is what sold me on OpenBSD as a Devl Platform. I work with AIX and decided to test the objects I wrote for an interface to a proprietary application. Testing them on OpenBSD identified memory leaks and things like that in 2 of them. So now I always test on OpenBSD when I am able to. To do that on Linux would have required 1 or 2 third party applications I know nothing about, so I took the easy route :)

binkHN 5y ago
You’re not alone—this is somewhat common. Many programs that are written for multiple platforms benefit from this and I frequently see commit logs noting something similar to “Fixed a few <insert bugs, off by ones, memory allocation issue and whatnot here> that resulted in a crash on OpenBSD.” While great for the program and developer, unfortunately this also has the opposite effect of some less enlightened users reporting that some (poorly written) programs “always crash on OpenBSD.”
- smhenderson 5y ago
  unfortunately this also has the opposite effect of some less enlightened users reporting that some (poorly written) programs “always crash on OpenBSD.” IDK, given their stance on who it's for, i.e. "we write OpenBSD for us, use it or don't, we don't care", that seems like a feature not a bug. It comes across as harsh or elitist to some people but the developers literally have no desire to gain market share, help newbies get started or port popular software to OpenBSD, unless they think it will directly benefit them. I find it kind of fun and refreshing having to solve an issue I'm having with OpenBSD by reaching for the very fine manual and experimenting with it. You won't find dozens of sites by searching the internet, often with conflicting information, that try to explain what's happening to you and how you can fix it. I have no option to use it at work right now but at home I always have one (old, recycled) server and one laptop running OpenBSD. And they're my favorite machines to use.
mrweasel 5y ago
Bob Beck also covers this in his talk about the first 30 days of libreSSL. The entire talk is amazing, even 7 years later. https://youtu.be/GnBbhXBDmwU https://youtu.be/GnBbhXBDmwU

wing-_-nuts 5y ago

Reading the article, and hearing them bang on about code quality and security, this reminds me. Is there any good modern book on C development with today's best practices? I have K&R but I've been told that's very outdated.

anthk 5y ago
K&R 2nd edition is ANSI C. It will run everywhere, but I think nowadays C99 is expected at least, along a book on BSD 4.4 and the infamous Advanced Programming in the Unix Environment. But the K&R 2nd edition is ANSI C is perfect to begin with. 99% of what you see in the src will be enough to be understood with that background.
HugoDaniel 5y ago
Modern C is a nice one, and free to read at https://hal.inria.fr/hal-02383654 https://hal.inria.fr/hal-02383654
Koshkin 5y ago
You still might want to read that first, if you haven't.
guerrilla 5y ago
There might be better ones but maybe Effective C from No Starch press.

lizknope 5y ago

I thought this was going to be about Theo being forced out of NetBSD back in 1994 and then starting OpenBSD. I was in college and ran Linux but my roommate ran NetBSD and was telling me all the mailing list drama. It is still archived here under footnotes 11 and 12 https://en.wikipedia.org/wiki/OpenBSD#cite_note-glass-12 https://en.wikipedia.org/wiki/OpenBSD#cite_note-glass-12