5 ms·

Yes, the Book of PF, fourth edition is coming soon

138 points by turtleyacht 1y ago

skywal_l 1y ago
PF: Packet Filtering (Open BSD Firewall). Saved you a click there.
- petegordon 1y ago
  Thank you
- Rygian 1y ago
  Interestingly, the author dodged that one: >A few questions immediately pop into readers' minds on hearing this news. The ones I get most often are, > Why now? What took you so long? >which quite frequently combines with > What changed? Are previous editions now useless? Which somehow contribute to highlight the inadequacy of the reader for not knowing what PF stands for in the first place.
  - depr 1y ago
    There has arisen this strange obsession on this website with every page having to explain what a project is about. This makes some sense for the marketing of the project, if there is for example a new version of some software. But for a personal blog it really does not. If a reader of a technical website is incapable of searching for "openbsd pf" then maybe they are indeed inadequate and are better off reading something else.
    - radiowave 1y ago
      Right. It's a question of context. And here we all are on a website that is basically purpose built for taking things out of context. We might just need to manage our expections in this regard.
      - andrewflnr 1y ago
        I just think it would be nice if "The Book of PF" was quoted so it's obvious it's a book title, not just a weirdly phrased sentence. After that, yeah, it's pretty obvious whether you care about the topic or can just move on without commenting on your apathy.
    - Rygian 1y ago
      I've been rightfully downvoted above. My comment was not perceived as pH-neutral as I was imagining it. HN is a place where people come to get exposed to a very diverse list of topics, from seismic faults to quantum computing. As such, my expectation is that an article linked on the front page has a minimum of context for those coming from far away. In this case, the article that was chosen onto the front page not only lacks that context, but also is blissfully unaware of this expectation. Which is perfectly fine and normal for the author and for the intended readership. I found that mismatch fun to read, in the "frequent questions" part of the article, and did not anticipate that my remark would be taken as caustic.
  - mananaysiempre 1y ago
    It’s a post in a BSD blog, specifically of the author of The Book of PF, that is in its entirety concerned with the question of whether a new edition of The Book of PF is coming. It’s not an ad in a computer magazine. It’s fair to presuppose that a reader of the blog knows what The Book of PF is. (It’s then arguably not fair to post it for a general audience on HN, but the author can hardly control that.) Please don’t assume everybody who presupposes knowledge does so to assert their intellectual superiority. Presupposing knowledge is how we can communicate anything at all in a culture where one can be a dozen inferences or a couple of years of learning away from even understanding a question. And people who assert their intellectual superiority usually aren’t worth listening to at all—so if you end up concluding that every smart person is doing it, or even most of them, or most of them in a field, then you have a wide-ranging misunderstanding of some sort. This, about presupposing knowledge, is one that could be. (Another popular one is not understanding that, in mathematics, “obvious”, etc., does not mean “skill issue if you don’t get it” but rather “you’ve missed something important if you don’t get it, go back and think on it some more”.)
  - ecb_penguin 1y ago
    Ok, great, so we put Packet Filter in the title. Still doesn't explain it. So let's put Packet Filter for BSD in the title. You didn't explain what BSD is. Eventually let's just put the entire article in the title. > not knowing what PF stands for in the first place I'm going to level you up 10x right now. 1. Select the text "Book of PF" in Chrome 2. Right click on it 3. Search with Google 4. Read the summary "OpenBSD's stateful packet filter, PF, is the heart of the OpenBSD firewall" BOOM! You can now do this with anything you don't know! You no longer need to ask someone to explain everything to you!
    - Spooky23 1y ago
      I’m using Opera, what should I do? Unclear.
      - deleted 1y ago
        [deleted]
      - ecb_penguin 1y ago
        Works the same! I'd google it, though.
znpy 1y ago
I wish there was a "book of nftables" or something like that.
- quesera 1y ago
  When you choose BSD, many common Linux frustrations evaporate. :)
  - mananaysiempre 1y ago
    Rusty Russell’s old iptables HOWTO was okay—or as okay as an iptables anything can be. An nftables HOWTO covering basically the same issues that The Book of PF does has the potential to be much better, simply because it would concern a much less messy system, but somebody has to write it. There’s little Linux-specific about this situation.
    - quesera 1y ago
      It is Linux-specific to some degree. There's a culture of documentation in BSD which exceeds Linux. There's a larger commercial/reputational market for a Linux book of course, but that attracts different writers, who are often not as good/knowledgeable/motivated/dedicated/etc as the BSD documentation writers. Additionally, BSD has a culture of simplicity and consistency which is entirely absent in Linux. This makes documentation more clear and much more durable.
  - znpy 1y ago
    yeah, but many new ones appear, sadly. (I've used both FreeBSD and NetBSD in the past, this is not a baseless claim)
  - fidotron 1y ago
    Yeah, but some of us like pf and systemd. It's so confusing.
    - quesera 1y ago
      Oh come now, no one likes systemd! I kid. Sort of. Systemd is a great startup launcher -- maybe even an improvement over rc.d. Although I confess I've never had any issues with rc.d. Systemd can be quicker, which is nice, but 15 seconds saved on a server that reboots very infrequently is not super interesting. More importantly, the rest of systemd is less compelling.
kstrauser 1y ago
I’ll toss this out there: pf ruined all other firewalls for me. Once you’ve been spoiled by pf.conf, it’s awfully hard to look at any other without running away screaming. Seriously, it’s a joy, like discovering Python after you’ve learned Brainfuck. I wish Linux’s firewalls were so easy to configure. The closest I’ve found there is with ufw, which isn’t nearly so comprehensive or straightforward, but at least goes in the right direction.
- betaby 1y ago
  > I wish Linux’s firewalls were so easy to configure. nft (nftables) is easy and has a similar pf-like 'feel' while offering way more functionality. After decades of `iptables` (and `ipchains` before) nft(ables) is a breath of fresh air.
  - kstrauser 1y ago
    I still greatly prefer pf, but yes, nftables is vastly better than iptables. Ipchains always looked like a RAM dump converted to Forth. It got the job done, mostly, but I never could understand how it got popular when the BSDs were already using nicer alternatives.
    - rfmoz 1y ago
      Nftables is a step forward in the Linux firewall. It evolved a lot in the last years and nowadays it really requires that the tooling linked to iptables setups do the migration step. The scenario is like the cgroup v1 and v2 change.
    - somat 1y ago
      Iptables suffers from the common "it's a command line program so we are going to use getopt to parse it" I find the getopt style... tolerable at best for short commands. But for long expressions in a dsl(like find or iptables) it is noisy and ugly. Iptables would have been twice as nice to use if they got rid of all the pointless dashes(and I have written preprocessors to do just this). The clearest example of this was the megaraid command for lsi raid cards. It's commands are documented in the getopt style but I accidentally found out that the dashes were optional. And while the syntax was still sort of ass, my scripts were much easier to read.
throw0101d 1y ago
Also worth checking out Michael W Lucas' books: * https://mwl.io/nonfiction https://mwl.io/nonfiction I've heard (but not read) good things about his fictional works as well, e.g., $ git commit murder: * https://mwl.io/fiction/crime#gcm https://mwl.io/fiction/crime#gcm * https://mwl.io/fiction https://mwl.io/fiction
nokun7 1y ago
Basic question: Is PF related to ebpf by any chance?
- giovannibonetti 1y ago
  PF stands for packet filter in both cases
- somat 1y ago
  no, but b in bpf stands for Berkeley, so the interface originated from bsd. bpf is a virtual machine to process network packets in kernel space. So it is sort of like the low level assembly language of network processing. It is entirely possible to build a high-level packet filtering language that compiles down to bpf, But I don't think PF does this. PF appears to use it's own specific network processing interface. https://man.openbsd.org/pf https://man.openbsd.org/pf Note the pf specific ioctls used to inject rules into the kernel.
elchief 1y ago
Don't know if it's allowed here, but I'm selling my PC Engines APU2 if anyone is interested :) It has OpnSense installed, but you can install anything you want 4GB RAM, 16GB ssd, wifi https://www.facebook.com/marketplace/item/4038077093121720 https://www.facebook.com/marketplace/item/4038077093121720

138 points by turtleyacht 1y ago

skywal_l 1y ago

PF: Packet Filtering (Open BSD Firewall). Saved you a click there.

petegordon 1y ago
Thank you
Rygian 1y ago
Interestingly, the author dodged that one: >A few questions immediately pop into readers' minds on hearing this news. The ones I get most often are, > Why now? What took you so long? >which quite frequently combines with > What changed? Are previous editions now useless? Which somehow contribute to highlight the inadequacy of the reader for not knowing what PF stands for in the first place.
- depr 1y ago
  There has arisen this strange obsession on this website with every page having to explain what a project is about. This makes some sense for the marketing of the project, if there is for example a new version of some software. But for a personal blog it really does not. If a reader of a technical website is incapable of searching for "openbsd pf" then maybe they are indeed inadequate and are better off reading something else.
  - radiowave 1y ago
    Right. It's a question of context. And here we all are on a website that is basically purpose built for taking things out of context. We might just need to manage our expections in this regard.
    - andrewflnr 1y ago
      I just think it would be nice if "The Book of PF" was quoted so it's obvious it's a book title, not just a weirdly phrased sentence. After that, yeah, it's pretty obvious whether you care about the topic or can just move on without commenting on your apathy.
  - Rygian 1y ago
    I've been rightfully downvoted above. My comment was not perceived as pH-neutral as I was imagining it. HN is a place where people come to get exposed to a very diverse list of topics, from seismic faults to quantum computing. As such, my expectation is that an article linked on the front page has a minimum of context for those coming from far away. In this case, the article that was chosen onto the front page not only lacks that context, but also is blissfully unaware of this expectation. Which is perfectly fine and normal for the author and for the intended readership. I found that mismatch fun to read, in the "frequent questions" part of the article, and did not anticipate that my remark would be taken as caustic.
- mananaysiempre 1y ago
  It’s a post in a BSD blog, specifically of the author of The Book of PF, that is in its entirety concerned with the question of whether a new edition of The Book of PF is coming. It’s not an ad in a computer magazine. It’s fair to presuppose that a reader of the blog knows what The Book of PF is. (It’s then arguably not fair to post it for a general audience on HN, but the author can hardly control that.) Please don’t assume everybody who presupposes knowledge does so to assert their intellectual superiority. Presupposing knowledge is how we can communicate anything at all in a culture where one can be a dozen inferences or a couple of years of learning away from even understanding a question. And people who assert their intellectual superiority usually aren’t worth listening to at all—so if you end up concluding that every smart person is doing it, or even most of them, or most of them in a field, then you have a wide-ranging misunderstanding of some sort. This, about presupposing knowledge, is one that could be. (Another popular one is not understanding that, in mathematics, “obvious”, etc., does not mean “skill issue if you don’t get it” but rather “you’ve missed something important if you don’t get it, go back and think on it some more”.)
- ecb_penguin 1y ago
  Ok, great, so we put Packet Filter in the title. Still doesn't explain it. So let's put Packet Filter for BSD in the title. You didn't explain what BSD is. Eventually let's just put the entire article in the title. > not knowing what PF stands for in the first place I'm going to level you up 10x right now. 1. Select the text "Book of PF" in Chrome 2. Right click on it 3. Search with Google 4. Read the summary "OpenBSD's stateful packet filter, PF, is the heart of the OpenBSD firewall" BOOM! You can now do this with anything you don't know! You no longer need to ask someone to explain everything to you!
  - Spooky23 1y ago
    I’m using Opera, what should I do? Unclear.
    - deleted 1y ago
      [deleted]
    - ecb_penguin 1y ago
      Works the same! I'd google it, though.

znpy 1y ago

I wish there was a "book of nftables" or something like that.

quesera 1y ago
When you choose BSD, many common Linux frustrations evaporate. :)
- mananaysiempre 1y ago
  Rusty Russell’s old iptables HOWTO was okay—or as okay as an iptables anything can be. An nftables HOWTO covering basically the same issues that The Book of PF does has the potential to be much better, simply because it would concern a much less messy system, but somebody has to write it. There’s little Linux-specific about this situation.
  - quesera 1y ago
    It is Linux-specific to some degree. There's a culture of documentation in BSD which exceeds Linux. There's a larger commercial/reputational market for a Linux book of course, but that attracts different writers, who are often not as good/knowledgeable/motivated/dedicated/etc as the BSD documentation writers. Additionally, BSD has a culture of simplicity and consistency which is entirely absent in Linux. This makes documentation more clear and much more durable.
- znpy 1y ago
  yeah, but many new ones appear, sadly. (I've used both FreeBSD and NetBSD in the past, this is not a baseless claim)
- fidotron 1y ago
  Yeah, but some of us like pf and systemd. It's so confusing.
  - quesera 1y ago
    Oh come now, no one likes systemd! I kid. Sort of. Systemd is a great startup launcher -- maybe even an improvement over rc.d. Although I confess I've never had any issues with rc.d. Systemd can be quicker, which is nice, but 15 seconds saved on a server that reboots very infrequently is not super interesting. More importantly, the rest of systemd is less compelling.

kstrauser 1y ago

I’ll toss this out there: pf ruined all other firewalls for me. Once you’ve been spoiled by pf.conf, it’s awfully hard to look at any other without running away screaming. Seriously, it’s a joy, like discovering Python after you’ve learned Brainfuck. I wish Linux’s firewalls were so easy to configure. The closest I’ve found there is with ufw, which isn’t nearly so comprehensive or straightforward, but at least goes in the right direction.

betaby 1y ago
> I wish Linux’s firewalls were so easy to configure. nft (nftables) is easy and has a similar pf-like 'feel' while offering way more functionality. After decades of `iptables` (and `ipchains` before) nft(ables) is a breath of fresh air.
- kstrauser 1y ago
  I still greatly prefer pf, but yes, nftables is vastly better than iptables. Ipchains always looked like a RAM dump converted to Forth. It got the job done, mostly, but I never could understand how it got popular when the BSDs were already using nicer alternatives.
  - rfmoz 1y ago
    Nftables is a step forward in the Linux firewall. It evolved a lot in the last years and nowadays it really requires that the tooling linked to iptables setups do the migration step. The scenario is like the cgroup v1 and v2 change.
  - somat 1y ago
    Iptables suffers from the common "it's a command line program so we are going to use getopt to parse it" I find the getopt style... tolerable at best for short commands. But for long expressions in a dsl(like find or iptables) it is noisy and ugly. Iptables would have been twice as nice to use if they got rid of all the pointless dashes(and I have written preprocessors to do just this). The clearest example of this was the megaraid command for lsi raid cards. It's commands are documented in the getopt style but I accidentally found out that the dashes were optional. And while the syntax was still sort of ass, my scripts were much easier to read.

throw0101d 1y ago

Also worth checking out Michael W Lucas' books: * https://mwl.io/nonfiction https://mwl.io/nonfiction I've heard (but not read) good things about his fictional works as well, e.g., $ git commit murder: * https://mwl.io/fiction/crime#gcm https://mwl.io/fiction/crime#gcm * https://mwl.io/fiction https://mwl.io/fiction

nokun7 1y ago

Basic question: Is PF related to ebpf by any chance?

giovannibonetti 1y ago
PF stands for packet filter in both cases
somat 1y ago
no, but b in bpf stands for Berkeley, so the interface originated from bsd. bpf is a virtual machine to process network packets in kernel space. So it is sort of like the low level assembly language of network processing. It is entirely possible to build a high-level packet filtering language that compiles down to bpf, But I don't think PF does this. PF appears to use it's own specific network processing interface. https://man.openbsd.org/pf https://man.openbsd.org/pf Note the pf specific ioctls used to inject rules into the kernel.

elchief 1y ago

Don't know if it's allowed here, but I'm selling my PC Engines APU2 if anyone is interested :) It has OpnSense installed, but you can install anything you want 4GB RAM, 16GB ssd, wifi https://www.facebook.com/marketplace/item/4038077093121720 https://www.facebook.com/marketplace/item/4038077093121720