6 ms·

OpenBSD, the computer appliance maker's secret weapon

132 points by transpute 2y ago

yjftsjthsd-h 2y ago
> This is the little slice of computing heaven I currently live within. In a lot of ways it feels like what I imagine employed hackers of old in the 90s were up to. That does sound like a dream come true; how does one end up in such a gig? > If only there were a freely-usable set of Unix-like operating systems, with an emphasis on keeping things very, very stable over releases, even more stable than Debian does. Enter the BSDs. Free, Open, Net, take your pick. All of them take a “don’t fix it if it ain’t broken” approach to things, which means someone who started slinging NetBSD installs back in 2007 can probably spin up a well-manicured VM of that 2007 install and reliably make their way around the system, even today, in 2024. I dearly love all the major BSDs, but that... isn't the argument I would make for OpenBSD, which is quite happy to break things to improve them. For example, replacing sudo with doas - excellent move, but if you go back multiple versions your knowledge no longer works, much like Debian. (If I were making suggestions, I tend to feel that NetBSD has largely not yet realized it isn't a barely-forked UNIX running on a VAX; it feels much more unchanging to me, at least from a user perspective, though perhaps I merely lack the experience to know better.)
- hiAndrewQuinn 2y ago
  Author here - yeah, as I've learned more about OpenBSD I've realized that, while "don't fix it if it ain't broken" is still a valid claim about their overall approach, the OpenBSD hackers also just ... see a lot of stuff that's broken, everywhere. Still, somehow, on the margin, I feel I'd be more comfortable hopping back into a much earlier OpenBSD than a much earlier Debian. Maybe it's a taste thing.
- silver_silver 2y ago
  Not as radical a change as, e.g. integrating systemd though
  - graemep 2y ago
    The aim of systemd seems to be to use the Linux kernel as the base for a non-unix OS as shown (hence the "now with 42% linux philosophy tagline of the latest recent release https://www.theregister.com/2024/06/13/version_256_systemd/ https://www.theregister.com/2024/06/13/version_256_systemd/). Its not a bad idea if you agree with the aim - Linux already has lots of hardware support and an ecosystem to leverage. In the long run BSDs and non-systemd Linux will be more similar to each other than they are to Linux with systemd in a lot of ways. I have started using Alpine for servers - its small and fast. Not so sure about switching on desktops.
    - ziggy_star 2y ago
      I don't believe for a moment that was the initial aim of systemd. They just tried to improve on a pile of hacks and by pulling on that string it sort of ends up touching (or from your perspective infecting) everything. It vaguely reminds me of people arguing about "what color is your function". You open that portal and end up in a new universe. All or nothing. The unix wars are long over I'm not sure what you can point to that ever was a True Unix. Nostalgia not withstanding. What well defined standard Right Way you're actually clinging to is not clear. Whether it will end up for the best or not I don't know but the entire saga seems to be the pitfalls of endless tinkering on display rather than some unifying vision. I wish we lived in a world where systemd type efforts had clear end goals and well thought out architecture in mind when they start but open source doesn't like working this way. It just ends up as "my favorite way of doing things is better" based on vibes. In both directions. That's the problem with "philosophies".
      - galangalalgol 2y ago
        Given android doesn't use systemd, and containers don't expose it even if the host machine uses it, systemd isn't actually that entrenched or irreversible. Containerized applications don't know or care, and neither do all the people toting around android as phones, tablets, or laptops. Unix may only be tied together as a concept at this point by a posixish libc api, and that is probably just fine.
- zitterbewegung 2y ago
  What NetBSD's focus is to get it running on all possible hardware so yea that's why they really haven't gotten it to be much more different than any of the other BSDs. Since OpenBSD's purpose is to make one of the most secure UNIX platforms that's where they generally break things. They also anticipate security holes related to speculative execution like disabling hyperthreading.
deleted 2y ago
[deleted]
anotherhue 2y ago
I've played this distro hopping game since I was a teenager and they were mailing free cds of this weird new south-african thing called Ubuntu which wasn't nearly as cool as the FreeBSD 5.0 release. Enough of the astrological pseudo-science. This distro is good for hackers, use this if you want stability, use this for bleeding edge, this one is secure by default, that one has a nice UI, it's all nonsense. The only meaningful changes have been: The effective mandatory adoption of SystemD, and the emergence of NixOS. NixOS elevates the entire discussion. I can't wait for it to work across different UNIX kernels. It's not ready for regular people, it's not even ready for most enthusiasts, the language is awful and the nixpkgs set is full of inconsistencies, but it's all worth it. So let's stop with the voodoo and start applying the techniques in other places. Nix without Nix is what we need.
- dinozarw 2y ago
  > Nix without Nix So, GNU Guix?
  - anotherhue 2y ago
    I have only read about it but my takeaway was that it was like an opinionated sibling technology rather than a successor one. I don't know what a successor would look like, I worry that it would have to wrangle with 40 years of software compilation techniques.
    - speed_spread 2y ago
      I would start with Gentoo, which has recipes to build stuff from scratch for just about everything.
      - anotherhue 2y ago
        I came from fbsd ports so agreed but that's what I'm saying, that's more thsn 20 year old tech and we should be able to improve.
- solarpunk 2y ago
Jean-Papoulos 2y ago
Saying that something hasn't evolved in almost 20 years is a... strange flex ? I suppose there's a need for everything.
- brabel 2y ago
  I appreciate something like that. It can mean one of two things: * it's abandoned. * it's good for what it does, why change it? I don't know, to be honest, in which of these most BSDs are. But I see very little reason for an Operating System's tools and utilities to have changed much since the early 2000's. Perhaps even since the 1990's. Sure, their implementations may have been significantly improved, and maybe they've got some new stuff (specially in things that do need to evolve, like crypto) but the overall user interface remains the same. I think we should start seeing change for the sake of change as a bug, not a feature.
  - contingencies 2y ago
    it's good for what it does, why change it? Immediately, this quote came to mind: Those who don't understand Unix are condemned to reinvent it, poorly. - Henry Spencer Alternatively, Just do what slack did with irc. 'Reinvent' it with a modern interface and some fixes. The mercurial masses will flock to the hot new platform, VC will shower you with adoration and cash, we'll tell stories about how you don't eat breakfast and only ever wear one sock. Everyone will emulate you and then you can come back around as a wealthy guru investor. - @more_corn Or the wise man yells at cloud version, It used to be the case that people were admonished to "not re-invent the wheel". We now live in an age that spends a lot of time "reinventing the flat tire!" The flat tires come from the reinventors often not being in the same league as the original inventors. This is a symptom of a "pop culture" where identity and participation are much more important than progress... - Alan Kay (2016) ... via https://github.com/globalcitizen/taoup https://github.com/globalcitizen/taoup
- nabla9 2y ago
  Author talks about stability of the userland. OpenBSD is innovative, especially in all matters of security and stability. SROP, privilege separation and revocation, W^X, PIE, trapsleds, fork+exec separation. Removing weaknesses is evolution.
kogepathic 2y ago
The author has a good point but I am surprised they neglected to mention the most important aspect for any aspiring appliance maker: The BSD license Yes, thanks to the magic of the BSD license you can ship an appliance that is nothing more than a vanilla BSD and some hacky scripts and never have to worry about your customers demanding to see how much jank you have shoved into the box.
- enriquto 2y ago
  As a user, that is precisely the main drawback of the bsds (as much as I love them, especially OpenBSD). If I'm using a bsd in some third-party computer, some icky middleman may have changed stuff in the system for which I'm not allowed to see the patches. If the license was GPL, I would have the right to see these changes! Forbidding your users to see the inner workings of the system (hiding the jank that has been shoven into the box, as you say), does not seem like a positive thing..
  - deleted 2y ago
    [deleted]
  - michaelt 2y ago
    I mean, it's not great. But there's plenty of jank in e.g. Android phones. And of course anything the vendor doesn't feel like open sourcing they can just cram into something like 'google play services' to keep it closed source. And vendors who want to TiVo-ize Linux can do it just fine, thanks to the Linux kernel embracing the TPM.
    - afiori 2y ago
      Tivoization is completely orthogonal to the issue of opaque patched blobs. For example every software/firmware using custom Risc-V instructions is tivoized. The problem of blobs are inability to examine it and inability to reasonably modify it. Tivoization just makes it harder to run a software/blob on different hardware.
      - 2y ago
bitwize 2y ago
There's something... oddly satisfying about tailing your logs and watching skiddie exploits harmlessly glance off OpenBSD's hide. Still the only OS I'd trust hooking directly up to the internet with a web server or something, without a firewall of some sort in between. I got into OpenBSD again when I bought a new, cheap potato to play with -- an HP thin client PC I scored off eBay for $25. The super-lightweight candidate operating systems I tried for it -- AROS and Haiku -- both struggled with its eMMC controller and couldn't even find a volume to install to; the same, oddly, was true of NetBSD. OpenBSD found it just fine.
- cess11 2y ago
  Why would you turn off the firewall?
  - BSDobelix 2y ago
    Because you just have services that are already "internet hardened" running?
    - saagarjha 2y ago
      Sounds like a poor reason to turn off your firewall
      - WesolyKubeczek 2y ago
        Can't see a reason to close ports with firewall on which there is nothing listening anyway. The best defence, IMO, is not to have the thing if you don't need the thing. Having to remember about it all the time sometimes prevents the work from getting done.
        adrian_b 2y ago
        You may want to not send back the "unreachable port" ICMP messages that are the default behavior for ports on which there is nothing listening. The traditional configuration for a server or router is to block in the firewall all the unused ports, which means that ICMP responses will not be sent back, with the exception of the range of ports that are normally used by the "traceroute" utility. Unfortunately, there are also stupid people who block in the firewall even the traceroute ports, which makes more difficult the diagnosing of any network problem.
DEADMINCE 2y ago
> If they run into OpenBSD, however, their efforts are quite likely to be thwarted just because the blowfish is so darn spiky. Ehhhhhhh. As a teen eating up all the computer security stuff I could find, and getting into osdev and learning as much as I could, OpenBSD always seemed kind of off to me. The security claims are hugely overstated, and for an OS that claims security as its focus, they are slow if not reluctant to add tools that vastly increase security, like even a simple RBAC implementation. Disabling services by default should have been the default for all operating systems, and writing OpenSSH has been great, but let's all stop perpetuating the myth of OpenBSD as an especially hardened OS. I agree about the BSDs being a secret weapon, but that's more to do with the license as someone else mentioned, and I'd think Net and Free are more commonly taken from.
- davidgerard 2y ago
  The thing that seems to be missing from your post is a list of examples of its security not being all that in practice.
  - DEADMINCE 2y ago
    I wouldn't say it's missing. I deliberately generalized. I mentioned RBAC as an example. If people want to learn more there is no shortage of info. There was even a talk[0] at the 36th CCC. [0] - https://www.youtube.com/watch?v=3E9ga-CylWQ https://www.youtube.com/watch?v=3E9ga-CylWQ
- crest 2y ago
  OpenBSD was stagnant when it came to hardening for a while, but the last few releases really added new defense in depth technologies e.g. whitelisting all syscall entry points at link time -> if your process doesn't contain fork() and execve() they're is unavailable even after you exploited a RCE. If the process is already restricted by pledge() and unveil() it can't just regain the disabled system calls. These technologies are not a fine grained and "theoretical sound" like a pure capability like FreeBSD's Capsicum, but they're a whole lot easier to retrofit to existing non-trivial applications which means more code is covered by good enough mitigations to drive the attack costs up significantly and make certain (classes of) bugs unexploitable.
deleted 2y ago
[deleted]
pyuser583 2y ago
If only you could install Java.
- cenamus 2y ago
  You can? There's OpenJDK 17 available
  - pyuser583 2y ago
    Is that native support?
    - cylinder714 2y ago
      Yes: https://openports.pl/search?file=&descr=&path=&pkgname=jdk&category=&maintainer= https://openports.pl/search?file=&descr=&path=&pkgname=jdk&c...
      - cenamus 2y ago
        Ahh, even version 21 now, I've been waiting for that one
cookiengineer 2y ago
What's completely missing here is a big topic: compliance and security Both OpenBSD and FreeBSD have laughable security disclosures and absolute lack of any compliance processes, which is the most important part as a vendor of anything. FreeBSD even got that far that they invented their own VuXML format (without a spec, of course) instead of adopting an open standard like OVAL, which is used by most enterprise distributions. In the BSD world, vulnerability disclosures happen via mailing lists, aka, bad luck if you missed the email. And that's the definition of being 100% unreliable. OpenBSD doesn't even have a VuXML file. Only free form text archive of emails that is unparseable. I don't understand how anyone can claim they are so super duper secure in their development cycle, while not even having a web page of security disclosures that happened in the past. It's pretty damn narcisstic to be honest.
- antonios 2y ago
  > while not even having a web page of security disclosures that happened in the past https://www.openbsd.org/errata75.html https://www.openbsd.org/errata75.html
  - cookiengineer 2y ago
    You seem to have ignored the rest of my comment on purpose. Useless source, because it is not parseable in an automated manner.
- dazzawazza 2y ago
  isn't this a list of all FreeBSD vulnerabilities over time? https://www.freebsd.org/security/advisories/ https://www.freebsd.org/security/advisories/ or http://vuxml.freebsd.org/freebsd/index.html http://vuxml.freebsd.org/freebsd/index.html Missing one of the infrequent emails from the security mailing list would be hard but my boxes also email me about vulnerabilities they are exposed to so it would be very hard to ignore them. I am sure there is room for improvement though.
- PedroBatista 2y ago
  So *BSD is a joke because all the apparatus, "compliance processes" and "standards" are not followed? Is that the gist of it? Never mind the actual security and quality of the code and professionalism of the people involved. The dances are not performed and the compliance Gods are not appeased. btw: https://www.vuxml.org/freebsd/ https://www.vuxml.org/freebsd/
WesolyKubeczek 2y ago
I don't know, to this day I collect logs from my AWS instances and ripgrep/tail/less them like some unwashed pleb from the 1990s. I package RPMs and build containers from them. It's efficient, and I like to know what my stack is made of all the way up and all the way down. Is this such a boomer notion to have? (You could argue that "millenials are becoming the new boomers", but you know what I mean, stop nitpicking.)
LAC-Tech 2y ago
Doesn't OpenBSD files system corrupt easily, ie due to powercuts? I can recall OpenBSDers talking about how they used a UPS to prevent this.
- jmclnx 2y ago
  My personal experience, not really and I have had a few outages. But I saw a post were this did happen to someone and they had to do a re-install. But they did say that had a full backup.
  - LAC-Tech 2y ago
    Looked it up; OpenBSD lacks a journaling file system.
kylegordon 2y ago
My first observation of this calm oasis was watching a Dell Compellent boot around 2010. I was somewhat happy to see a familiar boot process on the display!
- mrweasel 2y ago
  Presumably those where running FreeBSD? Can't imagine that Compellent was Net- or OpenBSD based.
deleted 2y ago
[deleted]
jmclnx 2y ago
I like both OpenBSD and NetBSD equally, I cannot decide which one I like better :) But for appliance use, I think NetBSD has a very slight edge over OpenBSD: * NetBSD has very long release cycles. OpenBSD's 6 month release means you will have to upgrade all appliances at least once per year. * On install, NetBSD allows you to install a very small subset of the system. OpenBSD recommends installing all packages. But with that said, both systems are very small when compared to Linux. OpenBSD to me has one advantage I can think of right now. Upgrading is a easier, if you keep upgrading every 6 months. They seem to be heading to fully automated upgrades. But with NetBSD, it is possible to skip releases (ie: 8.x to 10.x) if you know what you are doing. I went from 7.1 directly to 9.3 and got a workable system. But that did mung pkgsrc, a bit of hacking got that "workable". Once the "emergency" was over, I did a full reinstall of 9.3. Anyway, yes, I agree just about any BSD would be great for appliance use.

132 points by transpute 2y ago

> This is the little slice of computing heaven I currently live within. In a lot of ways it feels like what I imagine employed hackers of old in the 90s were up to. That does sound like a dream come true; how does one end up in such a gig? > If only there were a freely-usable set of Unix-like operating systems, with an emphasis on keeping things very, very stable over releases, even more stable than Debian does. Enter the BSDs. Free, Open, Net, take your pick. All of them take a “don’t fix it if it ain’t broken” approach to things, which means someone who started slinging NetBSD installs back in 2007 can probably spin up a well-manicured VM of that 2007 install and reliably make their way around the system, even today, in 2024. I dearly love all the major BSDs, but that... isn't the argument I would make for OpenBSD, which is quite happy to break things to improve them. For example, replacing sudo with doas - excellent move, but if you go back multiple versions your knowledge no longer works, much like Debian. (If I were making suggestions, I tend to feel that NetBSD has largely not yet realized it isn't a barely-forked UNIX running on a VAX; it feels much more unchanging to me, at least from a user perspective, though perhaps I merely lack the experience to know better.)

hiAndrewQuinn 2y ago
Author here - yeah, as I've learned more about OpenBSD I've realized that, while "don't fix it if it ain't broken" is still a valid claim about their overall approach, the OpenBSD hackers also just ... see a lot of stuff that's broken, everywhere. Still, somehow, on the margin, I feel I'd be more comfortable hopping back into a much earlier OpenBSD than a much earlier Debian. Maybe it's a taste thing.
silver_silver 2y ago
Not as radical a change as, e.g. integrating systemd though
- graemep 2y ago
  The aim of systemd seems to be to use the Linux kernel as the base for a non-unix OS as shown (hence the "now with 42% linux philosophy tagline of the latest recent release https://www.theregister.com/2024/06/13/version_256_systemd/ https://www.theregister.com/2024/06/13/version_256_systemd/). Its not a bad idea if you agree with the aim - Linux already has lots of hardware support and an ecosystem to leverage. In the long run BSDs and non-systemd Linux will be more similar to each other than they are to Linux with systemd in a lot of ways. I have started using Alpine for servers - its small and fast. Not so sure about switching on desktops.
  - ziggy_star 2y ago
    I don't believe for a moment that was the initial aim of systemd. They just tried to improve on a pile of hacks and by pulling on that string it sort of ends up touching (or from your perspective infecting) everything. It vaguely reminds me of people arguing about "what color is your function". You open that portal and end up in a new universe. All or nothing. The unix wars are long over I'm not sure what you can point to that ever was a True Unix. Nostalgia not withstanding. What well defined standard Right Way you're actually clinging to is not clear. Whether it will end up for the best or not I don't know but the entire saga seems to be the pitfalls of endless tinkering on display rather than some unifying vision. I wish we lived in a world where systemd type efforts had clear end goals and well thought out architecture in mind when they start but open source doesn't like working this way. It just ends up as "my favorite way of doing things is better" based on vibes. In both directions. That's the problem with "philosophies".
    - galangalalgol 2y ago
      Given android doesn't use systemd, and containers don't expose it even if the host machine uses it, systemd isn't actually that entrenched or irreversible. Containerized applications don't know or care, and neither do all the people toting around android as phones, tablets, or laptops. Unix may only be tied together as a concept at this point by a posixish libc api, and that is probably just fine.
zitterbewegung 2y ago
What NetBSD's focus is to get it running on all possible hardware so yea that's why they really haven't gotten it to be much more different than any of the other BSDs. Since OpenBSD's purpose is to make one of the most secure UNIX platforms that's where they generally break things. They also anticipate security holes related to speculative execution like disabling hyperthreading.

deleted 2y ago

[deleted]

anotherhue 2y ago

I've played this distro hopping game since I was a teenager and they were mailing free cds of this weird new south-african thing called Ubuntu which wasn't nearly as cool as the FreeBSD 5.0 release. Enough of the astrological pseudo-science. This distro is good for hackers, use this if you want stability, use this for bleeding edge, this one is secure by default, that one has a nice UI, it's all nonsense. The only meaningful changes have been: The effective mandatory adoption of SystemD, and the emergence of NixOS. NixOS elevates the entire discussion. I can't wait for it to work across different UNIX kernels. It's not ready for regular people, it's not even ready for most enthusiasts, the language is awful and the nixpkgs set is full of inconsistencies, but it's all worth it. So let's stop with the voodoo and start applying the techniques in other places. Nix without Nix is what we need.

dinozarw 2y ago
> Nix without Nix So, GNU Guix?
- anotherhue 2y ago
  I have only read about it but my takeaway was that it was like an opinionated sibling technology rather than a successor one. I don't know what a successor would look like, I worry that it would have to wrangle with 40 years of software compilation techniques.
  - speed_spread 2y ago
    I would start with Gentoo, which has recipes to build stuff from scratch for just about everything.
    - anotherhue 2y ago
      I came from fbsd ports so agreed but that's what I'm saying, that's more thsn 20 year old tech and we should be able to improve.
solarpunk 2y ago

Jean-Papoulos 2y ago

Saying that something hasn't evolved in almost 20 years is a... strange flex ? I suppose there's a need for everything.

brabel 2y ago
I appreciate something like that. It can mean one of two things: * it's abandoned. * it's good for what it does, why change it? I don't know, to be honest, in which of these most BSDs are. But I see very little reason for an Operating System's tools and utilities to have changed much since the early 2000's. Perhaps even since the 1990's. Sure, their implementations may have been significantly improved, and maybe they've got some new stuff (specially in things that do need to evolve, like crypto) but the overall user interface remains the same. I think we should start seeing change for the sake of change as a bug, not a feature.
- contingencies 2y ago
  it's good for what it does, why change it? Immediately, this quote came to mind: Those who don't understand Unix are condemned to reinvent it, poorly. - Henry Spencer Alternatively, Just do what slack did with irc. 'Reinvent' it with a modern interface and some fixes. The mercurial masses will flock to the hot new platform, VC will shower you with adoration and cash, we'll tell stories about how you don't eat breakfast and only ever wear one sock. Everyone will emulate you and then you can come back around as a wealthy guru investor. - @more_corn Or the wise man yells at cloud version, It used to be the case that people were admonished to "not re-invent the wheel". We now live in an age that spends a lot of time "reinventing the flat tire!" The flat tires come from the reinventors often not being in the same league as the original inventors. This is a symptom of a "pop culture" where identity and participation are much more important than progress... - Alan Kay (2016) ... via https://github.com/globalcitizen/taoup https://github.com/globalcitizen/taoup
nabla9 2y ago
Author talks about stability of the userland. OpenBSD is innovative, especially in all matters of security and stability. SROP, privilege separation and revocation, W^X, PIE, trapsleds, fork+exec separation. Removing weaknesses is evolution.

kogepathic 2y ago

The author has a good point but I am surprised they neglected to mention the most important aspect for any aspiring appliance maker: The BSD license Yes, thanks to the magic of the BSD license you can ship an appliance that is nothing more than a vanilla BSD and some hacky scripts and never have to worry about your customers demanding to see how much jank you have shoved into the box.

enriquto 2y ago
As a user, that is precisely the main drawback of the bsds (as much as I love them, especially OpenBSD). If I'm using a bsd in some third-party computer, some icky middleman may have changed stuff in the system for which I'm not allowed to see the patches. If the license was GPL, I would have the right to see these changes! Forbidding your users to see the inner workings of the system (hiding the jank that has been shoven into the box, as you say), does not seem like a positive thing..
- deleted 2y ago
  [deleted]
- michaelt 2y ago
  I mean, it's not great. But there's plenty of jank in e.g. Android phones. And of course anything the vendor doesn't feel like open sourcing they can just cram into something like 'google play services' to keep it closed source. And vendors who want to TiVo-ize Linux can do it just fine, thanks to the Linux kernel embracing the TPM.
  - afiori 2y ago
    Tivoization is completely orthogonal to the issue of opaque patched blobs. For example every software/firmware using custom Risc-V instructions is tivoized. The problem of blobs are inability to examine it and inability to reasonably modify it. Tivoization just makes it harder to run a software/blob on different hardware.
    - 2y ago

bitwize 2y ago

There's something... oddly satisfying about tailing your logs and watching skiddie exploits harmlessly glance off OpenBSD's hide. Still the only OS I'd trust hooking directly up to the internet with a web server or something, without a firewall of some sort in between. I got into OpenBSD again when I bought a new, cheap potato to play with -- an HP thin client PC I scored off eBay for $25. The super-lightweight candidate operating systems I tried for it -- AROS and Haiku -- both struggled with its eMMC controller and couldn't even find a volume to install to; the same, oddly, was true of NetBSD. OpenBSD found it just fine.

cess11 2y ago
Why would you turn off the firewall?
- BSDobelix 2y ago
  Because you just have services that are already "internet hardened" running?
  - saagarjha 2y ago
    Sounds like a poor reason to turn off your firewall
    - WesolyKubeczek 2y ago
      Can't see a reason to close ports with firewall on which there is nothing listening anyway. The best defence, IMO, is not to have the thing if you don't need the thing. Having to remember about it all the time sometimes prevents the work from getting done.
      - adrian_b 2y ago
        You may want to not send back the "unreachable port" ICMP messages that are the default behavior for ports on which there is nothing listening. The traditional configuration for a server or router is to block in the firewall all the unused ports, which means that ICMP responses will not be sent back, with the exception of the range of ports that are normally used by the "traceroute" utility. Unfortunately, there are also stupid people who block in the firewall even the traceroute ports, which makes more difficult the diagnosing of any network problem.

DEADMINCE 2y ago

> If they run into OpenBSD, however, their efforts are quite likely to be thwarted just because the blowfish is so darn spiky. Ehhhhhhh. As a teen eating up all the computer security stuff I could find, and getting into osdev and learning as much as I could, OpenBSD always seemed kind of off to me. The security claims are hugely overstated, and for an OS that claims security as its focus, they are slow if not reluctant to add tools that vastly increase security, like even a simple RBAC implementation. Disabling services by default should have been the default for all operating systems, and writing OpenSSH has been great, but let's all stop perpetuating the myth of OpenBSD as an especially hardened OS. I agree about the BSDs being a secret weapon, but that's more to do with the license as someone else mentioned, and I'd think Net and Free are more commonly taken from.

davidgerard 2y ago
The thing that seems to be missing from your post is a list of examples of its security not being all that in practice.
- DEADMINCE 2y ago
  I wouldn't say it's missing. I deliberately generalized. I mentioned RBAC as an example. If people want to learn more there is no shortage of info. There was even a talk[0] at the 36th CCC. [0] - https://www.youtube.com/watch?v=3E9ga-CylWQ https://www.youtube.com/watch?v=3E9ga-CylWQ
crest 2y ago
OpenBSD was stagnant when it came to hardening for a while, but the last few releases really added new defense in depth technologies e.g. whitelisting all syscall entry points at link time -> if your process doesn't contain fork() and execve() they're is unavailable even after you exploited a RCE. If the process is already restricted by pledge() and unveil() it can't just regain the disabled system calls. These technologies are not a fine grained and "theoretical sound" like a pure capability like FreeBSD's Capsicum, but they're a whole lot easier to retrofit to existing non-trivial applications which means more code is covered by good enough mitigations to drive the attack costs up significantly and make certain (classes of) bugs unexploitable.

deleted 2y ago

[deleted]

pyuser583 2y ago

If only you could install Java.

cenamus 2y ago
You can? There's OpenJDK 17 available
- pyuser583 2y ago
  Is that native support?
  - cylinder714 2y ago
    Yes: https://openports.pl/search?file=&descr=&path=&pkgname=jdk&category=&maintainer= https://openports.pl/search?file=&descr=&path=&pkgname=jdk&c...
    - cenamus 2y ago
      Ahh, even version 21 now, I've been waiting for that one

cookiengineer 2y ago

What's completely missing here is a big topic: compliance and security Both OpenBSD and FreeBSD have laughable security disclosures and absolute lack of any compliance processes, which is the most important part as a vendor of anything. FreeBSD even got that far that they invented their own VuXML format (without a spec, of course) instead of adopting an open standard like OVAL, which is used by most enterprise distributions. In the BSD world, vulnerability disclosures happen via mailing lists, aka, bad luck if you missed the email. And that's the definition of being 100% unreliable. OpenBSD doesn't even have a VuXML file. Only free form text archive of emails that is unparseable. I don't understand how anyone can claim they are so super duper secure in their development cycle, while not even having a web page of security disclosures that happened in the past. It's pretty damn narcisstic to be honest.

antonios 2y ago
> while not even having a web page of security disclosures that happened in the past https://www.openbsd.org/errata75.html https://www.openbsd.org/errata75.html
- cookiengineer 2y ago
  You seem to have ignored the rest of my comment on purpose. Useless source, because it is not parseable in an automated manner.
dazzawazza 2y ago
isn't this a list of all FreeBSD vulnerabilities over time? https://www.freebsd.org/security/advisories/ https://www.freebsd.org/security/advisories/ or http://vuxml.freebsd.org/freebsd/index.html http://vuxml.freebsd.org/freebsd/index.html Missing one of the infrequent emails from the security mailing list would be hard but my boxes also email me about vulnerabilities they are exposed to so it would be very hard to ignore them. I am sure there is room for improvement though.
PedroBatista 2y ago
So *BSD is a joke because all the apparatus, "compliance processes" and "standards" are not followed? Is that the gist of it? Never mind the actual security and quality of the code and professionalism of the people involved. The dances are not performed and the compliance Gods are not appeased. btw: https://www.vuxml.org/freebsd/ https://www.vuxml.org/freebsd/

WesolyKubeczek 2y ago

I don't know, to this day I collect logs from my AWS instances and ripgrep/tail/less them like some unwashed pleb from the 1990s. I package RPMs and build containers from them. It's efficient, and I like to know what my stack is made of all the way up and all the way down. Is this such a boomer notion to have? (You could argue that "millenials are becoming the new boomers", but you know what I mean, stop nitpicking.)

LAC-Tech 2y ago

Doesn't OpenBSD files system corrupt easily, ie due to powercuts? I can recall OpenBSDers talking about how they used a UPS to prevent this.

jmclnx 2y ago
My personal experience, not really and I have had a few outages. But I saw a post were this did happen to someone and they had to do a re-install. But they did say that had a full backup.
- LAC-Tech 2y ago
  Looked it up; OpenBSD lacks a journaling file system.

kylegordon 2y ago

My first observation of this calm oasis was watching a Dell Compellent boot around 2010. I was somewhat happy to see a familiar boot process on the display!

mrweasel 2y ago
Presumably those where running FreeBSD? Can't imagine that Compellent was Net- or OpenBSD based.

deleted 2y ago

[deleted]

jmclnx 2y ago

I like both OpenBSD and NetBSD equally, I cannot decide which one I like better :) But for appliance use, I think NetBSD has a very slight edge over OpenBSD: * NetBSD has very long release cycles. OpenBSD's 6 month release means you will have to upgrade all appliances at least once per year. * On install, NetBSD allows you to install a very small subset of the system. OpenBSD recommends installing all packages. But with that said, both systems are very small when compared to Linux. OpenBSD to me has one advantage I can think of right now. Upgrading is a easier, if you keep upgrading every 6 months. They seem to be heading to fully automated upgrades. But with NetBSD, it is possible to skip releases (ie: 8.x to 10.x) if you know what you are doing. I went from 7.1 directly to 9.3 and got a workable system. But that did mung pkgsrc, a bit of hacking got that "workable". Once the "emergency" was over, I did a full reinstall of 9.3. Anyway, yes, I agree just about any BSD would be great for appliance use.