3 ms·
> I'm surprised to see this; my first thought was also something like >> it's old unsecure code > and that seems very unlike OpenBSD. It is going into ports
by ninjin 1y ago
> I'm surprised to see this; my first thought was also something like
>> it's old unsecure code
> and that seems very unlike OpenBSD.
It is going into ports and I am positive there are plenty of worse offenders in terms of insecure software in there already. If this was going into base, I am confident the clean up would be substantial, but there is already cwm[1] and fvwm [2] for your modern and classic window manager needs in base.
[1]: https://en.wikipedia.org/wiki/Cwm_%28window_manager%29 https://en.wikipedia.org/wiki/Cwm_%28window_manager%29
[2]: https://en.wikipedia.org/wiki/FVWM https://en.wikipedia.org/wiki/FVWM
- n4r9 1y agoI'm not that familiar with OpenBSD but my impression was that the team is extremely security conscious. To the point that "there is insecure software in there already" is not an excuse. Perhaps I'm wrong about that?
- ch_123 1y agoMost of the security guarantees are made about the base install of the OS, which is mostly code which the OpenBSD team maintains and develops. The code in ports is mostly subject to the same security issues that exist elsewhere, except where facilities of OpenBSD block them (or the code has been patched by the port maintainers).
- anthk 1y agoA lot of ports are pledge/unveiled; and there are malloc settings which don't let rogue/badly written operations misbehave as they would do in the rest of BSD's or any GNU/Linux distro. https://man.openbsd.org/OpenBSD-5.3/man5/malloc.conf.5 https://man.openbsd.org/OpenBSD-5.3/man5/malloc.conf.5 Hint: https://richardlupton.com/posts/openbsd-malloc-options/ https://richardlupton.com/posts/openbsd-malloc-options/ Detox might crash. A lot.
- ninjin 1y agoIt is not an excuse, you are perhaps just not familiar with how software is handled by OpenBSD and other free operating systems. You have a base system, which includes the kernel, user land, etc. Then on top of this you have ports and packages, usually in a different source tree. Unless you have a nearly insane amount of resources, vetting all those ports and packages is incredibly hard if not impossible (think Canonical and Red Hat level of funding, when on a good year OpenBSD raises ~USD 500,000 and Red Hat's revenue is in the billions) and even then there will generally be different tiers of support. Thus, the strongest guarantees will always be with the base system as it is installed by everyone and outside of Linux also developed by a single team. Yes, plenty of ports such as Firefox on OpenBSD have some great security patches applied, but expecting all the over 10,000 ports to have the same level of quality and attention applied as what is in base is unrealistic no matter how much security and correctness is a priority. I have maintained ports and packages across the Linux and BSD ecosystems for a good while now and I have more confidence in what OpenBSD has in ports based on my own experience compared to several Linux package managers. However, that does not mean that I will try to pull out a random OpenBSD package and expose it to the Internet before doing due diligence.
- n4r9 1y agoThanks v much for the info. You're right, I'm unfamiliar with this process and its resource constraints.
- ninjin 1y agoNo worries, glad to help. I should also have added that on OpenBSD (and BSDs in general) base is much more complete than on most Linux distributions. I run a web, name, and mail server using OpenBSD and I do not need a single port or package for this. SMTP daemon, DNS daemon, web server, TLS certificate handling, etc. It is all in base and works together coherently, which is what draws people like me to BSDs.
- n3storm 1y agoMost Linux distros can do that without any external or extra repository.