6 ms·
This is one of the things the OpenBSD folks gave me a _hard_ time about when I was trying out their system. Yes, I said theirs, because since then I want nothi
by aspyct 4y ago
This is one of the things the OpenBSD folks gave me a _hard_ time about when I was trying out their system.
Yes, I said theirs, because since then I want nothing to do with that.
"Unix grey beards are forged in suffering".
Yeah, well, suffer if you'd like, but I have better things to do with my time.
- kunley 4y agoSome projects are just about belonging to some arcane group, not about creating something much useful... though of course the said group would disagree.
- YPPH 4y agoThe OpenBSD folks have a mentality of secure by default. Doing the best to encourage disk encryption upon install promotes that ideal.
- aspyct 4y agoYes, my point exactly. Disk encryption wasn't even part of the default install flow before. You had to go out of your way to find documentation, understand how to run it, find some more documentation, get "RTFM" replies on their IRC channel. Doesn't seem very secure by default to me.
- prmoustache 4y agoAt least they gave you a refund.
- aspyct 4y agoLol, that's the default response when people complain about other people being rude and not having paid something. Look, I was just trying OpenBSD with an open mind, and I met people who were unhelpful. Even in the street if I asked someone for the time and he said "get a watch", it would be rude. I understand that they don't want to help. But do they need to be rude about it?
- nix23 4y ago>Doesn't seem very secure by default to me. If you don't understand a system it's by definition not secure, keep your hands away or start learning your stuff, or at least don't call it secure (the big word that includes many different meanings)
- Zurrrrr 4y ago"secure by default" by OBSD basically just means everything disabled by default. Can't hack anything if nothing is running, right? Only issue is it's not that useable either.
- camgunz 4y agoYou've made a few comments implying that if OpenBSD ran some common services by default attackers would get remote root and nothing would stop them. But their services have a pretty good track record: - OpenSMTPd: 2 remote holes in 10 years - OpenSSH: 1 remote hole in 10 years - httpd: No remote vulns - relayd: No remote vulns What are you looking at that makes you confident that if OpenBSD ran these by default (which I think is a bad idea in general) they'd have a significantly worse security history?
- Zurrrrr 4y agoI don't mean to imply that if OpenBSD ran those specific services by default that it would be much worse. My point is that: a) Generally for a server people are running some kind of services, and that's going to include third party software. Not always, but often, and that software is not audited by OBSD team. Even say adding a module to httpd may allow for remote compromise and b) That the tools OpenBSD provides for dealing with an attacker who has managed to gain remote access are insufficient compared to what is available, and especially insufficient for an OS that claims to be focused on security.
- quesera 4y agoIt works both ways. The OpenBSD developers know that their users take security seriously, over convenience and just-works installers. So it's a safe bet that OpenBSD users will take the few extra (well-documented) manual steps to encrypt their storage devices, leaving the developers to focus on things that are not easy for users to do for themselves. Adding the convenience to the interactive installer is clearly a good thing, but it would not be at the tippy-top of the priority list if you have limited funding and developer time.
- YPPH 4y agoI mean, is that not like saying that a user will RTFM and disable all unnecessary services after their install? The OpenBSD mentality is the opposite - they will sacrifice convenience and disable all unnecessary services by default, in order to make the system as secure as possible, and you can go RTFM and knowingly increase your risk if you choose to. That mentality would suggest, I think, disk encryption should be opt-out on the install. Of course, the first step to getting there is an opt-in system.
- quesera 4y agoIt is, yes. It definitely works both ways. In this case (disk encryption) the process is simple, but the data collection and then things like back/fwd, changes, accept etc.. makes it more complicated than a simple boolean/checkbox. So the compromise was "bounce to the docs for this one", until this new improvement was added.
- implements 4y agoThing is, they say “Read the FAQ” - and if you actually do read and follow the FAQ then you can do what you want 99% of the time. For example, couldn’t access the internet using WiFi and wired Ethernet at the same time - spent hours fiddling about, trying to make both adapters ‘egress’ - couldn’t do it. Then … remembered the FAQ: Networking -> Wireless -> Trunking a Wireless Adapter - there it was. For a broader understanding there’s always: https://en.wikipedia.org/wiki/Absolute_OpenBSD https://en.wikipedia.org/wiki/Absolute_OpenBSD
- aspyct 4y agoYes. And then when you ask why the X11 server is bundled by default, even on a headless install, that's not in the FAQ, and they get very defensive about it... What I'm saying is: it's probably a great OS with great documentation, but the community isn't welcoming at all.
- mburee 4y agoCan't you just not select the X-related file sets during installation?
- prmoustache 4y ago"Unix grey beards are forged in suffering". I am pretty sure nobody said that and you invent it.
- speed_spread 4y agoIf you want the same experience with Linux you can head to the Arch forums.