7 ms·

What are some pros and cons of using OpenBSD instead of Linux?

hospitalJail 3y ago
You join the social club of people who say "Its not Linux!" I even had chatgpt try to come up with valid reasons and it struggled.
- deleted 3y ago
  [deleted]
- zilti 3y ago
  If you are the kind of person who uses ChatGPT for such questions, you wouldn't understand it anyway
- codetrotter 3y ago
  Either you are prompting it wrong, or you got unlucky, or you are stuck on GPT3.5 still and it’s less capable compared to GPT4 than I remember. Me: > Give me a short list of five top things that OpenBSD is superior over Linux for ChatGPT: > OpenBSD is known for its strong emphasis on security, simplicity, and code correctness. Here's a brief list of five aspects where OpenBSD is often considered superior to Linux: > 1. Security by Default: OpenBSD is renowned for its security-oriented design. The system is configured with secure defaults, and security features are integrated directly into the core system, not as add-ons. > 2. Code Quality and Audit: The OpenBSD project places a high priority on clean, readable, and well-documented code. Regular code audits are conducted to identify and fix security vulnerabilities and bugs. > 3. Integrated Cryptography: OpenBSD includes various cryptographic tools and libraries as part of its base system, making it easier to implement secure applications. > 4. Pf (Packet Filter): OpenBSD's native firewall, pf, is highly regarded for its flexibility and efficiency. It's often considered more straightforward and powerful than iptables, commonly used in Linux. > 5. Documentation and Man Pages: OpenBSD’s documentation, especially its man pages, is extensive and well-maintained. It provides detailed and up-to-date information on system commands, configurations, and daemons. > It's important to note that while OpenBSD excels in these areas, the choice between OpenBSD and Linux depends on specific use cases and personal preferences. And then for the cons, flip the question around and ask ChatGPT for a list of five ways in which Linux is superior over OpenBSD. (Left as an exercise for the reader.)
technofiend 3y ago
It's a legit question, but if you have to ask, then most likely OpenBSD is not for you. I don't say that out of some elitist or gatekeeping motive, rather I think most people who use it have a specific need for it, or feel strongly about the principles behind the OS, which are security first and secure-by-default. Here's a breakdown of some technical differences between the two, but really if you want to explore alternatives to Linux or even Linux alternatives I highly recommend you do so, even OpenBSD, but I respectfully suggest you have a use case in mind first. https://www.geeksforgeeks.org/difference-between-linux-and-openbsd/ https://www.geeksforgeeks.org/difference-between-linux-and-o... The security first/secure-by-default mindset in OpenBSD means the core distribution is very locked down. By that I mean there's very little in the base OS in terms of services. OpenBSD had a robust "ports" selection for things you may need to add. My use case for OpenBSD was as a firewall, but it was eventually retired because it just couldn't keep up with my network speeds. It still is a secure unix server for things like radius authentication of wireless clients.
- rubymamis 3y ago
  Compared to a Linux distro, would an end user have much better security out-of-the box, or would one need to be tech-savvy enough for that?
  - opencl 3y ago
    OpenBSD out of the box is an extremely minimal setup compared to the default install of most Linux distros. A lot of the security of the default install comes from minimizing the attack surface by having very few services running. So you do not need to be tech-savvy to make it secure, but you might need to be tech-savvy to turn it into a usable system for your use case.
    - seanw444 3y ago
      To add: it's not just the fact that it's barely running anything that makes it secure, but the things that you do run have effort put into making their codebase secure as well. Such as the various daemons, like httpd.
radiator 3y ago
Pro: A website can never steal your SSH keys, because firefox is limited, via unveil(2), to only seeing your ~/Downloads folder. Con: Every time you need to upload a file using your browser, you have to move it to this folder first.
- elric 3y ago
  You can do similar things in Linux with firejail, but there are a lot of folks who feel uneasy about the safety of firejail.
  - radiator 3y ago
    Besides firefox, more than 80 userland programs have their access to the filesystem restricted with the use of unveil.
    - PrimeMcFly 3y ago
      If Theo stopped being so resistant to solutions like AppArmor, then OpenBSD could have a real security layer instead of toys like unveil and pledge.
      - thewanderer1983 3y ago
        Here is Justine's write up on pledge and why he wants to port it to Linux. https://justine.lol/pledge/ https://justine.lol/pledge/
        PrimeMcFly 3y ago
        It has its uses I guess, but it requires opt-in which is a pretty big disadvantage, and then still can't do even a fraction of what SELinux can already do. SELinux isn't that hard to learn, and the security benefits are immense.
    - okasaki 3y ago
      2024-01-08 22:34 ubuntu@knope:~$ sudo apparmor_status apparmor module is loaded. 185 profiles are loaded. 104 profiles are in enforce mode. (...) 124 processes have profiles defined. 122 processes are in enforce mode. including firefox and chromium
enriquto 3y ago
> What are some pros and cons of using OpenBSD instead of Linux? Pros: htop only fills half of your terminal, and you know exactly what each process does because you put them there. A few well-written man pages are the complete documentation of the system. The whole thing is run by a handful of shell scripts. Cons: exactly the same text, but read with a different tone.
- user3939382 3y ago
  Yep I love it. ps -ax gives you like 12 processes and the role of each is obvious and essential. The OS isn't doing anything you didn't ask it to, you can actually understand the OS. Try that on a default Ubuntu install, it's like macOS, just totally and literally out of control.
  - yeeeloit 3y ago
    > you can actually understand the OS. The way you describe FreeBSD is how I imagine an OS should be. I'm going to make it a goal this year to get a server up and running. Thanks. -- Rant Linux gives me more inferiority complex than any other technology I've ever touched. Sure, something like a database system, or a moderately large code base or framework is complicated, and intimidating, and it might take many years to get a grip on, and understand, let alone master. But Linux? I just don't get it. I've tried for years, read books about it, etc. etc. But in the end it's voodoo to me, and I'm always left searching for answers to problems, unable to solve them myself. The answers are always just rote step-by-step; do this and copy this command, problem solved. Why? how? nothing makes sense!!! I always have the sense that somewhere out there is the holy bible of Linux, the missing piece of the puzzle; read this and it will all make sense. Admittedly I've never compiled a distro. So in some respect I'm guilty of not going into the deep end. I suspect that if I learnt systems programming, and really go into the thick of it... then somewhere I might start to find my feet. But it's easier to just believe that I'm stupid, and Linux is beyond my ability to comprehend.
    - exe34 3y ago
      Have you tried LFS? You can copy and paste, but you have to read the commands and figure out what they're doing. This will give you an overall theoretical idea of how things are laid out - but you have to realise that every new version of something, there's some developer somewhere who wants to exercise their creativity and make something really clever and cool (to them), so it probably won't make any sense to you after the upgrade. That's the point you realise you're on the eternal treadmill of trying to keep your system doing what you need it to do, without freezing in the vulnerabilities.
sneed_chucker 3y ago
Pros: lightweight, really good docs, security as a design goal, designed from the top down as a complete OS so the userland generally all plays nice together and feels more coherent and less bloated than a typical Linux distro Cons: hardware compatibility/drivers (especially for WiFi and GPU) is worse than Linux, finding help online is worse than Linux, software availability and compatibility tends to be worse than Linux, but generally you can get everything you need especially if you're willing to build from source. Subjective: Lots of Linuxisms that people are used to having aren't present on BSD. For example, no docker, no systemd, no Snap/AppImage/Flatpak, and no eBPF. This is true even on FreeBSD, which is the most Linux-like of the family. BSDs have their own answers to most of the problems that these tools solve, but you'll have to learn those tools and your Linux knowledge and muscle memory will be mostly useless.
- Pay08 3y ago
  Since when is an init system or Docker linuxisms?
  - sneed_chucker 3y ago
    An init system isn't a Linuxism obviously. Systemd is though. Docker is unambiguously a Linuxism. Docker on MacOS and Windows only works by running a lightweight Linux VM under the hood. Docker does not currently run on any of the BSDs, though you can achieve similar process isolation with jails.
PrimeMcFly 3y ago
Pros: More of the software has been audited. That's it really. There's nice documentation but that's true for many linux distros as well, and much of the security claims are overblown. Cons: Lack of available software and software compatibility. Lack of good security options to restrict software and the system.
LanzVonL 3y ago
[flagged]
- yeeeloit 3y ago
  > Indians and Chinese had teamed up to backdoor it. link?
  - Pay08 3y ago
    [dead]
    - MCUmaster 3y ago
      The only disease here is you and yours. https://cse.umn.edu/cs/linux-incident https://cse.umn.edu/cs/linux-incident
ikmckenz 3y ago
Pros: Secure-by-default, easy to understand your whole system, pledge and unveil are developer-friendly hardening mechanisms, all the answers to your questions are in the (very good) documentation Cons: all the answers to your questions are in the documentation, and not in stack overflow.
artsi0m 3y ago
It somehow happens that OpenBSD feels like an whole operating system rather than Linux distro built from various components. For example, when pledge(2) and unveil(2) appeared, many user-space programms got patched as soon as possible. You can see simillar process now, after pinsyscall(2) appeared and syscall(2) was removed. I heard, that there is something simillar in FreeBSD with zstd compression. For me cons is that you can't run some programms that depends on Linux kernel insides, like rr debugger, which depends on some specific of linux ptrace(2): https://github.com/rr-debugger/rr?tab=readme-ov-file#system-requirements https://github.com/rr-debugger/rr?tab=readme-ov-file#system-...

You join the social club of people who say "Its not Linux!" I even had chatgpt try to come up with valid reasons and it struggled.

deleted 3y ago
[deleted]
zilti 3y ago
If you are the kind of person who uses ChatGPT for such questions, you wouldn't understand it anyway
codetrotter 3y ago
Either you are prompting it wrong, or you got unlucky, or you are stuck on GPT3.5 still and it’s less capable compared to GPT4 than I remember. Me: > Give me a short list of five top things that OpenBSD is superior over Linux for ChatGPT: > OpenBSD is known for its strong emphasis on security, simplicity, and code correctness. Here's a brief list of five aspects where OpenBSD is often considered superior to Linux: > 1. Security by Default: OpenBSD is renowned for its security-oriented design. The system is configured with secure defaults, and security features are integrated directly into the core system, not as add-ons. > 2. Code Quality and Audit: The OpenBSD project places a high priority on clean, readable, and well-documented code. Regular code audits are conducted to identify and fix security vulnerabilities and bugs. > 3. Integrated Cryptography: OpenBSD includes various cryptographic tools and libraries as part of its base system, making it easier to implement secure applications. > 4. Pf (Packet Filter): OpenBSD's native firewall, pf, is highly regarded for its flexibility and efficiency. It's often considered more straightforward and powerful than iptables, commonly used in Linux. > 5. Documentation and Man Pages: OpenBSD’s documentation, especially its man pages, is extensive and well-maintained. It provides detailed and up-to-date information on system commands, configurations, and daemons. > It's important to note that while OpenBSD excels in these areas, the choice between OpenBSD and Linux depends on specific use cases and personal preferences. And then for the cons, flip the question around and ask ChatGPT for a list of five ways in which Linux is superior over OpenBSD. (Left as an exercise for the reader.)

technofiend 3y ago

It's a legit question, but if you have to ask, then most likely OpenBSD is not for you. I don't say that out of some elitist or gatekeeping motive, rather I think most people who use it have a specific need for it, or feel strongly about the principles behind the OS, which are security first and secure-by-default. Here's a breakdown of some technical differences between the two, but really if you want to explore alternatives to Linux or even Linux alternatives I highly recommend you do so, even OpenBSD, but I respectfully suggest you have a use case in mind first. https://www.geeksforgeeks.org/difference-between-linux-and-openbsd/ https://www.geeksforgeeks.org/difference-between-linux-and-o... The security first/secure-by-default mindset in OpenBSD means the core distribution is very locked down. By that I mean there's very little in the base OS in terms of services. OpenBSD had a robust "ports" selection for things you may need to add. My use case for OpenBSD was as a firewall, but it was eventually retired because it just couldn't keep up with my network speeds. It still is a secure unix server for things like radius authentication of wireless clients.

rubymamis 3y ago
Compared to a Linux distro, would an end user have much better security out-of-the box, or would one need to be tech-savvy enough for that?
- opencl 3y ago
  OpenBSD out of the box is an extremely minimal setup compared to the default install of most Linux distros. A lot of the security of the default install comes from minimizing the attack surface by having very few services running. So you do not need to be tech-savvy to make it secure, but you might need to be tech-savvy to turn it into a usable system for your use case.
  - seanw444 3y ago
    To add: it's not just the fact that it's barely running anything that makes it secure, but the things that you do run have effort put into making their codebase secure as well. Such as the various daemons, like httpd.

radiator 3y ago

Pro: A website can never steal your SSH keys, because firefox is limited, via unveil(2), to only seeing your ~/Downloads folder. Con: Every time you need to upload a file using your browser, you have to move it to this folder first.

elric 3y ago
You can do similar things in Linux with firejail, but there are a lot of folks who feel uneasy about the safety of firejail.
- radiator 3y ago
  Besides firefox, more than 80 userland programs have their access to the filesystem restricted with the use of unveil.
  - PrimeMcFly 3y ago
    If Theo stopped being so resistant to solutions like AppArmor, then OpenBSD could have a real security layer instead of toys like unveil and pledge.
    - thewanderer1983 3y ago
      Here is Justine's write up on pledge and why he wants to port it to Linux. https://justine.lol/pledge/ https://justine.lol/pledge/
      - PrimeMcFly 3y ago
        It has its uses I guess, but it requires opt-in which is a pretty big disadvantage, and then still can't do even a fraction of what SELinux can already do. SELinux isn't that hard to learn, and the security benefits are immense.
  - okasaki 3y ago
    2024-01-08 22:34 ubuntu@knope:~$ sudo apparmor_status apparmor module is loaded. 185 profiles are loaded. 104 profiles are in enforce mode. (...) 124 processes have profiles defined. 122 processes are in enforce mode. including firefox and chromium

enriquto 3y ago

> What are some pros and cons of using OpenBSD instead of Linux? Pros: htop only fills half of your terminal, and you know exactly what each process does because you put them there. A few well-written man pages are the complete documentation of the system. The whole thing is run by a handful of shell scripts. Cons: exactly the same text, but read with a different tone.

user3939382 3y ago
Yep I love it. ps -ax gives you like 12 processes and the role of each is obvious and essential. The OS isn't doing anything you didn't ask it to, you can actually understand the OS. Try that on a default Ubuntu install, it's like macOS, just totally and literally out of control.
- yeeeloit 3y ago
  > you can actually understand the OS. The way you describe FreeBSD is how I imagine an OS should be. I'm going to make it a goal this year to get a server up and running. Thanks. -- Rant Linux gives me more inferiority complex than any other technology I've ever touched. Sure, something like a database system, or a moderately large code base or framework is complicated, and intimidating, and it might take many years to get a grip on, and understand, let alone master. But Linux? I just don't get it. I've tried for years, read books about it, etc. etc. But in the end it's voodoo to me, and I'm always left searching for answers to problems, unable to solve them myself. The answers are always just rote step-by-step; do this and copy this command, problem solved. Why? how? nothing makes sense!!! I always have the sense that somewhere out there is the holy bible of Linux, the missing piece of the puzzle; read this and it will all make sense. Admittedly I've never compiled a distro. So in some respect I'm guilty of not going into the deep end. I suspect that if I learnt systems programming, and really go into the thick of it... then somewhere I might start to find my feet. But it's easier to just believe that I'm stupid, and Linux is beyond my ability to comprehend.
  - exe34 3y ago
    Have you tried LFS? You can copy and paste, but you have to read the commands and figure out what they're doing. This will give you an overall theoretical idea of how things are laid out - but you have to realise that every new version of something, there's some developer somewhere who wants to exercise their creativity and make something really clever and cool (to them), so it probably won't make any sense to you after the upgrade. That's the point you realise you're on the eternal treadmill of trying to keep your system doing what you need it to do, without freezing in the vulnerabilities.

sneed_chucker 3y ago

Pros: lightweight, really good docs, security as a design goal, designed from the top down as a complete OS so the userland generally all plays nice together and feels more coherent and less bloated than a typical Linux distro Cons: hardware compatibility/drivers (especially for WiFi and GPU) is worse than Linux, finding help online is worse than Linux, software availability and compatibility tends to be worse than Linux, but generally you can get everything you need especially if you're willing to build from source. Subjective: Lots of Linuxisms that people are used to having aren't present on BSD. For example, no docker, no systemd, no Snap/AppImage/Flatpak, and no eBPF. This is true even on FreeBSD, which is the most Linux-like of the family. BSDs have their own answers to most of the problems that these tools solve, but you'll have to learn those tools and your Linux knowledge and muscle memory will be mostly useless.

Pay08 3y ago
Since when is an init system or Docker linuxisms?
- sneed_chucker 3y ago
  An init system isn't a Linuxism obviously. Systemd is though. Docker is unambiguously a Linuxism. Docker on MacOS and Windows only works by running a lightweight Linux VM under the hood. Docker does not currently run on any of the BSDs, though you can achieve similar process isolation with jails.

PrimeMcFly 3y ago

Pros: More of the software has been audited. That's it really. There's nice documentation but that's true for many linux distros as well, and much of the security claims are overblown. Cons: Lack of available software and software compatibility. Lack of good security options to restrict software and the system.

LanzVonL 3y ago

[flagged]

yeeeloit 3y ago
> Indians and Chinese had teamed up to backdoor it. link?
- Pay08 3y ago
  [dead]
  - MCUmaster 3y ago
    The only disease here is you and yours. https://cse.umn.edu/cs/linux-incident https://cse.umn.edu/cs/linux-incident

ikmckenz 3y ago

Pros: Secure-by-default, easy to understand your whole system, pledge and unveil are developer-friendly hardening mechanisms, all the answers to your questions are in the (very good) documentation Cons: all the answers to your questions are in the documentation, and not in stack overflow.

artsi0m 3y ago

It somehow happens that OpenBSD feels like an whole operating system rather than Linux distro built from various components. For example, when pledge(2) and unveil(2) appeared, many user-space programms got patched as soon as possible. You can see simillar process now, after pinsyscall(2) appeared and syscall(2) was removed. I heard, that there is something simillar in FreeBSD with zstd compression. For me cons is that you can't run some programms that depends on Linux kernel insides, like rr debugger, which depends on some specific of linux ptrace(2): https://github.com/rr-debugger/rr?tab=readme-ov-file#system-requirements https://github.com/rr-debugger/rr?tab=readme-ov-file#system-...