4 ms·

This reads like a rant from somebody with an axe to grind. Rightly or wrongly, I’m gonna ignore it for that reason.

by mnd999 4y ago

werid 4y ago
That's because it is. Author is an OpenBSD fan/user, and have updated this article many times as the years pass. Maybe time for them to write an article on OpenBSD's pros directly instead of indirectly by attacking FreeBSD.
- crest 4y ago
  Even as a FreeBSD "fan" I have to admit that there are some valid points in his rant e.g. the threaded AES-CTR did introduce a slightly larger attack surface to bugs hidden by OpenSSH opting to use only processes. I still preferred filling my multi-Gb/s pipes with backups for an hour or two every night instead of having replication take most of the day at ~300Mb/s. I need backups to be replicated nightly off-site before the start of business. The largest single backup job alone would have been too slow to finish in time after a busy day over unpatched SSH. I needed a tool that's fast enough to finish transfers in the available time window. Had FreeBSD shipped an unpatched SSH I would've had to implement most of its core features in something else instead of running a multi-threaded implementation of the same symmetric ciphers.
  - cma 4y ago
    Maybe the process method in place and added a --less-secure-turbo-threaded-mode option.
- GekkePrutser 4y ago
  It sounds like they're also still using FreeBSD. I wonder why if they consider it so bad.
  - ctrlmeta 4y ago
    The most active users of a technology make the best critic too. Being an active user of something and being a critic of it are not mutually exclusive.
- sph 4y ago
  Excellent ad hominem. One thing they certainly haven't done is attack the author instead of debating their points. Still waiting for a reasoned rebuttal, rather than dismissing them summarily because they like another OS. Also, what is wrong in updating an article so it stays relevant and doesn't refer to things that have been fixed?
shric 4y ago
I've been using FreeBSD for 26 years on personal servers. I think there's merit to going through this and deciding whether to agree or not with changing certain defaults. I have similar changes on machines, though not as aggressive as the article suggests.
bell-cot 4y ago
Sadly, yes. If his goal was actually improving real-world security...well, with less than the effort level he seems to be putting into this, he could write a "config-audit" script, which would read through a FreeBSD system's config files, and make well-explained recommendations for improvements. From a quick look at the FreeBSD Ports, I doesn't see anything like that.
sph 4y ago
Reading like a rant doesn't exclude being truthy or informative. But if your goal is to avoid rants rather than viewing a problem from a different POV, ignoring it is the best choice.
- mnd999 4y ago
  That’s true but like I said, rightly or wrongly (and maybe I am wrong to dismiss it), I can’t be bothered with it. This is a nice way to write if you want to let off steam, or have an argument on a site like this, but if you’re trying to influence people it’s not gonna work.
  - outworlder 4y ago
    But you can be bothered enough to comment. Interesting.
    - mnd999 4y ago
      If you have a point to make I would suggest you make it. This kind of low quality ambiguous response adds nothing to the discussion.

This reads like a rant from somebody with an axe to grind. Rightly or wrongly, I’m gonna ignore it for that reason.

by mnd999 4y ago

This reads like a rant from somebody with an axe to grind. Rightly or wrongly, I’m gonna ignore it for that reason.

That's because it is. Author is an OpenBSD fan/user, and have updated this article many times as the years pass. Maybe time for them to write an article on OpenBSD's pros directly instead of indirectly by attacking FreeBSD.

crest 4y ago
Even as a FreeBSD "fan" I have to admit that there are some valid points in his rant e.g. the threaded AES-CTR did introduce a slightly larger attack surface to bugs hidden by OpenSSH opting to use only processes. I still preferred filling my multi-Gb/s pipes with backups for an hour or two every night instead of having replication take most of the day at ~300Mb/s. I need backups to be replicated nightly off-site before the start of business. The largest single backup job alone would have been too slow to finish in time after a busy day over unpatched SSH. I needed a tool that's fast enough to finish transfers in the available time window. Had FreeBSD shipped an unpatched SSH I would've had to implement most of its core features in something else instead of running a multi-threaded implementation of the same symmetric ciphers.
- cma 4y ago
  Maybe the process method in place and added a --less-secure-turbo-threaded-mode option.
GekkePrutser 4y ago
It sounds like they're also still using FreeBSD. I wonder why if they consider it so bad.
- ctrlmeta 4y ago
  The most active users of a technology make the best critic too. Being an active user of something and being a critic of it are not mutually exclusive.
sph 4y ago
Excellent ad hominem. One thing they certainly haven't done is attack the author instead of debating their points. Still waiting for a reasoned rebuttal, rather than dismissing them summarily because they like another OS. Also, what is wrong in updating an article so it stays relevant and doesn't refer to things that have been fixed?

shric 4y ago

I've been using FreeBSD for 26 years on personal servers. I think there's merit to going through this and deciding whether to agree or not with changing certain defaults. I have similar changes on machines, though not as aggressive as the article suggests.

bell-cot 4y ago

Sadly, yes. If his goal was actually improving real-world security...well, with less than the effort level he seems to be putting into this, he could write a "config-audit" script, which would read through a FreeBSD system's config files, and make well-explained recommendations for improvements. From a quick look at the FreeBSD Ports, I doesn't see anything like that.

sph 4y ago

Reading like a rant doesn't exclude being truthy or informative. But if your goal is to avoid rants rather than viewing a problem from a different POV, ignoring it is the best choice.

mnd999 4y ago
That’s true but like I said, rightly or wrongly (and maybe I am wrong to dismiss it), I can’t be bothered with it. This is a nice way to write if you want to let off steam, or have an argument on a site like this, but if you’re trying to influence people it’s not gonna work.
- outworlder 4y ago
  But you can be bothered enough to comment. Interesting.
  - mnd999 4y ago
    If you have a point to make I would suggest you make it. This kind of low quality ambiguous response adds nothing to the discussion.