9 ms·

Why use OpenBSD?

146 points by akagusu 11mo ago

detourdog 11mo ago
The list is missing the fact that the documentation is consistent and centralized.
- mrweasel 11mo ago
  > is consistent and centralized complete, useful, well written and contently at hand.
- idoubtit 11mo ago
  The post has many links to OpenBSD's man pages, FAQ and manual. But I thought it was quite unsatisfying, even common tasks are missing. Or at least I couldn't find them. I had a test case in mind while reading the documentation: running a custom web service with Nginx as a reverse-proxy. In the documentation, I couldn't find anything about creating a service. Are we supposed to write a frontend script (in ksh) that accepts various arguments (ie start/reload/...)? And what about the logs of this wrapper? And if I want an auto-restart when my program crashes, I have to find another tool that will wrap and monitor the process? I've done all this tedious work in Linux long ago, and I'm not willing to do it again. If the question was "Why OpenBSD instead of Linux", I don't think documentation is a good argument. In fact, the only strong response I've read is "to try something a bit different and more niche".
  - detourdog 11mo ago
    This is the page I was thinking of…. https://www.openbsd.org/faq/index.html https://www.openbsd.org/faq/index.html
  - skydhash 11mo ago
    The documentation you need is: https://man.openbsd.org/intro.8 https://man.openbsd.org/intro.8 https://man.openbsd.org/rcctl https://man.openbsd.org/rcctl https://man.openbsd.org/rc.conf.local.8 https://man.openbsd.org/rc.conf.local.8 https://man.openbsd.org/rc.d.8 https://man.openbsd.org/rc.d.8
brobdingnagians 11mo ago
Servers I setup in openbsd just keep working, and are an easy patch/upgrade process. Servers I setup in Ubuntu break and have weird patching issues. Maybe it's something I'm doing, but I sure do like that OpenBSD seems a lot easier to just have solid and work indefinitely.
- shevy-java 11mo ago
  Well - I would recommend using a better linux distribution than Ubuntu. I run just lighttpd these days; used to run httpd before they decided the configuration must become even more complicated. I don't have any issues with lighttpd (admittedly only few people use it; most seem to now use nginx).
  - loloquwowndueo 11mo ago
    And which distribution would that be?
    - igtztorrero 11mo ago
      Debian
      - loloquwowndueo 11mo ago
        I agree but you could have just said it :)
    - dokyun 11mo ago
      Slackware
  - PunchyHamster 11mo ago
    Ubuntu seems to have a trend of taking something that works under Debian and somehow messing that up. Upgrades are one thing but for a while we had separate instruction on how to make Yubikey tokens work under each version of Ubuntu (we used them as smartcards for SSH key auth), while Debian instructions stayed the same... Update was also hit and miss on user's desktop machines, for a while ubuntu had a nasty habit of installing new kernel upgrades... without removing old ones, which eventually made boot run out of space and poor user usually had to give it to helpdesk to fix. Tho tbh most of the problems in any distro with packages is "an user installed 3rd party repo that don't have well structured packages and it got messy".
PunchyHamster 11mo ago
[flagged]
- shevy-java 11mo ago
  AI? I may be missing something. You are talking about whom here? The blog author?
  - andai 11mo ago
    GP is referring to the LLM crawler captcha thing. The one with the anime girls in it. It only took a few seconds on my phone, but it's slow on my old ThinkPad.
    - PunchyHamster 11mo ago
      it took tens of seconds to load, once it loaded it was quick And the point of "why waste time for captcha for static file" still stands, it's not like there is comment section for bots to abuse
      - natebc 11mo ago
        It's not about keeping spam out of comments, it's about keeping systems and content safe/operational for normal people and more costly or unavailable for the trillion dollar "AI" companies that are shitting all over everything. Don't blame this on site operators, this is the fault of careless LLM operators knocking down everybody's walls doors and windows to "learn" from their content.
- prmoustache 11mo ago
  Are you calling Anubis an AI trashcan? Are you opening their website with an i286 for it to take 40s to load?
  - PunchyHamster 11mo ago
    it took 30s to even load the trashcan
shevy-java 11mo ago
I appreciate that OpenBSD sold its course on security-everywhere. Unfortunately I also kind of lost faith in the BSD variants. There are a few minor things such as PC-BSD suddenly vanishing, or years before NetBSD on their mailing list admitting that Linux outperformed their "runs on any toaster and other gimmick" strategy. But one of the key issues I had was this: I installed it (FreeBSD) on my second computer. I went out of my apartment and returned hours later. Well, the FreeBSD machine was no longer running; my linux machine on the other hand is running non-stop for months, literally. This may be a fluke, perhaps the computer had a problem - I am not saying this is really what the BSDs are all about, as I also had them installed before. But then I also asked myself "why would I want to bother with the BSDs, if Linux simply runs better?". And I haven't found a good, convincing answer to that for me to rationalise why I'd still be using the BSDs. Note: I also use Linux in a non-standard way, e. g. versioned AppDirs, but essentially Linux is simply more flexible than the BSDs (that is my opinion) and there are more users too. There will be always some BSD users, but to me they are like a dying breed. They would need to market themselves as a "runs outside the nerd bubble as well"; even Linux is still stuck in its own nerd bubble. You have to break out of it if you want to really dominate (Linux semi-does it indirectly, e. g. we can count many smartphones as Linux-driven, but I am still using a desktop computer system here, so to me this is what really counts, even if the total number is less than the smartphone users numbers).
- prmoustache 11mo ago
  What Linux has is mostly better hardware support and on gnome and some distributions they have a software installation tool that look like an app store but that's about it... Everything else is pretty much the same, random people wouldn't figure out a system is freebsd instead of Linux when running same desktop (like plasma).
  - sekh60 11mo ago
    The license makes it very different philosophically.
    - pjmlp 11mo ago
scatbot 11mo ago
One of the reasons why I'm using OpenBSD is because it passes what I think of as a litmus test for FLOSS software: can I build the whole thing from scratch, in a short time and with minimal fuss? In the case of OpenBSD, the answer is yes. I can install it on a new machine, fetch the source code from mirrors, do some edits to the source, build a fresh release, write it to a USB stick and boot it on another machine. On my machine, the whole process takes about 10 minutes for the kernel, additional 20 minutes for base and maybe an hour if you add Xenocara. Compare that to Linux distros like Ubuntu or Arch where building from scratch is either discouraged or some fringe activity that requires skimming through wiki articles, forum posts or old Websites on the Wayback Machine.
- sekh60 11mo ago
  Gentoo is a Linux rolling release built from source (just recently they gave the option of using binary packages as well). I've ran it on my desktop for years.
- PunchyHamster 11mo ago
  Buildroot does exactly that and it gives you big TUI menu to pick what you want included in your linux image
  - Milpotel 11mo ago
    There is also T2 SDE.
- pabs3 11mo ago
  Does OpenBSD have Bootstrappable Builds from source without any binaries? I'm guessing not yet, since GNU Guix (Linux distro) pioneered that, and I haven't seen any BSD distro interested in the related Reproducible Builds project. https://bootstrappable.org/ https://bootstrappable.org/ https://reproducible-builds.org/ https://reproducible-builds.org/
mono442 11mo ago
To be honest I don't really see a reason to use a *BSD system myself other than just for the sake of using something different and less mainstream. FreeBSD had some advantages in the past but nowadays Linux has caught up in features.
- PunchyHamster 11mo ago
  BSD license so you don't have to upstream your stuff would be one. Tho it's not an advantage to *BSD systems, Linux near-forcing vendors to go mainline (as keeping separate kernel tree is PITA) did a lot of good in hardware support.
  - graemep 11mo ago
    Not really a problem for users. Only for people who want to redistribute a fork. It matters if you are Apple or Sony, but not for most people. incidentally, the requirement of the GPL is not to upstream your stuff, but to offer to make the modified source available to anyone you distribute the code to. Often the same in practice, but does not have to be.
- Gualdrapo 11mo ago
  I feel like DragonflyBSD is really cool if you want to look at some BSD that offers some advantages and something unique to your day-to-day desktop usage. And I feel like their community is not as toxic as that of FreeBSD and OpenBSD with their holier-than-thou attitude towards Linux. I'd love it if Gentoo/BSD were a thing once again, I like the BSD concepts but there's nothing like Portage on BSD so far - afaik pkgsrc is nowhere close to it.
- rixed 11mo ago
  When I switched to FreeBSD, it was because of the quality of the documentation. In Linux manpages are a patchwork from various sources, and it shows; it's not rare for a manpage to be missing, obsolete, or to document another similar tool, or to be inacurrate... Much better than in many other OSes, but still nowhere as good as in FreeBSD. Now that I think of it, when I switched from DOS to Linux it was already because I found manpages amazing. Maybe I've just a soft spot for documentation.
hellcow 11mo ago
I built my last company on OpenBSD. It was easy to understand the entire system, and secure-by-default (everything disabled) is the right posture for servers. Pledge and unveil worked brilliantly to restrict our Go processes to specific syscall sets and files. The firewall on OpenBSD is miles better to configure than iptables. I never had challenges upgrading them--they just kept working for years.
- thomashabets2 11mo ago
  Finally Linux has something that approaches pledge/unveil: landlock. Seccomp was never actually usable: https://blog.habets.se/2022/03/seccomp-unsafe-at-any-speed.html https://blog.habets.se/2022/03/seccomp-unsafe-at-any-speed.h...
  - shiomiru 11mo ago
    > Seccomp was never actually usable It's barely usable by itself but I don't think it's an inherent problem of seccomp-bpf, rather the lack of libc support. Surely the task of "determine which syscalls are used for feature X" belongs in the software that decides which syscalls to use for feature X. In fact, Cosmopolitan libc implements pledge on Linux on top of seccomp-bpf: https://justine.lol/pledge/ https://justine.lol/pledge/
    - thomashabets2 11mo ago
      Well, kinda. The "what does the equivalent of pledge(stdio) actually mean?" doesn't have to actually be on the kernel side. But it's complicated by the fact that on Linux, syscalls can be made from anywhere. On OpenBSD syscalls are now only allowed from libc code. So even if one uses Cosmopolitan libc, if you link to some other library that library may also do direct syscalls. And which syscalls is does, and under which circumstances, is generally not part of the ABI promise. So this can still break between semver patch version upgrades. Like if a library used to just not write debug logs by default, but then changed so that they are written, but to /dev/null, then there's no way to inform application code for that library, much less update it. If you ONLY link to libc, then what you said will work. But if you link to anything else (including using LD_PRELOAD), then all bets are off. And at the very least you'll also be linking to libseccomp. :-) If libc were the only library in existence, then I'd agree with your 100%.
matt-p 11mo ago
I adore openbsd and have been using it since 4.x however it is still slow, not slow to boot or anything like that but if you run it as a web server it manages about half the req/s of Debian. Network performance is also slower than Debian if you're using it as a firewall (but I still prefer it as the syntax of PF is just perfect).
- dijit 11mo ago
  there's a lot of optimisations they don't engage with because it makes the code "ugly" but there's a larger one here, where they disable hyperthreading outright due to side-channel attacks. Might be a leading cause of what you're seeing.
  - thelastgallon 11mo ago
    So, spin up lots of single-core VMs?
    - dijit 11mo ago
      for I/O intensive applications, it's always been true that VMs are a decent chunk of overhead: https://sites.cc.gatech.edu/systems/projects/Elba/pub/JackLiBigdata13.pdf https://sites.cc.gatech.edu/systems/projects/Elba/pub/JackLi... Also, it's likely already in a VM.
  - basscomm 11mo ago
    > where they disable hyperthreading outright due to side-channel attacks. You can turn on hyperthreading if you need/want it: https://www.openbsd.org/faq/faq10.html#SMT https://www.openbsd.org/faq/faq10.html#SMT
- throwaway270925 11mo ago
  It's gotten a lot faster with 7.6 (lots of work on the TCP stack iirc). We saw huge improvements in throughput after updating. The new 7.8 release should bring some more performance, haven't tested it yet though.
lol_catz 11mo ago
If you can tolerate poor performance then by all means use OpenBSD. Debian stable FTW.
- ectospheno 11mo ago
  You do have to buy more powerful hardware than you otherwise would. I find it worth it to run code I can more easily understand. I agree on Debian as well. My router and laptop are OpenBSD but most vms on my proxmox are Debian.
  - hyperpl 11mo ago
    Agreed. I run my OpenBSD firewall on my odroid h4 - it's relatively cheap and plenty powerful to route gigabit+. I prefer pf and the simplicity of OpenBSD over Debian for such a purpose-built application. For my other "home servers" I simply run Debian as I believe it to be one of the more sane Linux choices for a server-type application.
secwang 11mo ago
I tried using OpenBSD, but the support for some specific things isn't very good. For example, J language support is always missing some packages. I also don't want to, and very much do not want to, use systemd. I finally chose FreeBSD, but I'm using some things from OpenBSD as much as possible, like obhttpd, etc. It feels good now.
Guestmodinfo 11mo ago
I hope people here keep donating to the OpenBSD project. I have myself not yet but I'm waiting yo do that
dilippkumar 11mo ago
Long time OpenBSD fan. Used it as my daily driver for years before standardizing all computers at home to macOS. I still think about going back to openBSD one day, but it's no longer very practical as a daily driver. I want to use OpenBSD for the next project I'm building. However, I can't wrap my head around the old way of doing deployments (before containers). People who've built production grade systems with OpenBSD: 1. How do you deploy software? 2. How do you manage fleets of servers? 3. How do you spin up/turn down servers from cloud providers? (I only know of Vultr who provided an OpenBSD option out of the box).
- hylaride 11mo ago
  > Long time OpenBSD fan. Used it as my daily driver for years before standardizing all computers at home to macOS. I still think about going back to openBSD one day, but it's no longer very practical as a daily driver. It's only practical for hobbyists. I used OpenBSD as a daily driver between 2001-2005. I fought, I suffered, I conquered, and I got tired of not being able to watch video on the web reliably and MacOS in those days was so clean and refreshing. I learned so much, though. > I want to use OpenBSD for the next project I'm building. I admire your open-mindedness. But ask yourself: 1. Do you want to have to upgrade fleets of servers every year with no exceptions for extended security support instead of 5 (or more if you're willing to pay) for LTS versions of Linux? 2. Who else will need to support it? 3. You will likely have worse performance if that matters. > 1. How do you deploy software? Honestly, not many people create their own services that run on OpenBSD. Those that do use old-school packaging and scripting. Tooling like ansible works. > 2. How do you manage fleets of servers? Ansible would be my go-to for classic fleets of servers. > How do you spin up/turn down servers from cloud providers? There are ports of cloud-init for OpenBSD. Creating images for third party OSes can be different levels of painful, depending on the cloud provider.
- SoftTalker 11mo ago
  OpenBSD has virtualization out of the box now. Most of the benefit of containers you can get with chroot. I don't know if any of the developers are working on a true container/jail capability. I'd like to see a more modern performant filesystem with OpenBSD but ffs has never really let me down. Capability for logical volumes and/or live resizing of partitions would be welcome as well.
reilly3000 11mo ago
Why isn’t it used more often at BigCorp? Or as a base container image?
JCattheATM 11mo ago
I feel like people user it either due to fixation/hobby reasons, or because they've heard it's secure and good for routers so they just use it as a router, assuming the rumors are true. Honestly myself, I prefer NetBSD approaches to many things, or for Linux Alpine, which is perfectly small, minimal and secure by default.
1vuio0pswjnm7 11mo ago
Why use BSD Single source tree for kernel and userland "BSD from scratch" is less work than Linux from scratch

Why use OpenBSD?

146 points by akagusu 11mo ago

detourdog 11mo ago

The list is missing the fact that the documentation is consistent and centralized.

mrweasel 11mo ago
> is consistent and centralized complete, useful, well written and contently at hand.
idoubtit 11mo ago
The post has many links to OpenBSD's man pages, FAQ and manual. But I thought it was quite unsatisfying, even common tasks are missing. Or at least I couldn't find them. I had a test case in mind while reading the documentation: running a custom web service with Nginx as a reverse-proxy. In the documentation, I couldn't find anything about creating a service. Are we supposed to write a frontend script (in ksh) that accepts various arguments (ie start/reload/...)? And what about the logs of this wrapper? And if I want an auto-restart when my program crashes, I have to find another tool that will wrap and monitor the process? I've done all this tedious work in Linux long ago, and I'm not willing to do it again. If the question was "Why OpenBSD instead of Linux", I don't think documentation is a good argument. In fact, the only strong response I've read is "to try something a bit different and more niche".
- detourdog 11mo ago
  This is the page I was thinking of…. https://www.openbsd.org/faq/index.html https://www.openbsd.org/faq/index.html
- skydhash 11mo ago
  The documentation you need is: https://man.openbsd.org/intro.8 https://man.openbsd.org/intro.8 https://man.openbsd.org/rcctl https://man.openbsd.org/rcctl https://man.openbsd.org/rc.conf.local.8 https://man.openbsd.org/rc.conf.local.8 https://man.openbsd.org/rc.d.8 https://man.openbsd.org/rc.d.8

brobdingnagians 11mo ago

Servers I setup in openbsd just keep working, and are an easy patch/upgrade process. Servers I setup in Ubuntu break and have weird patching issues. Maybe it's something I'm doing, but I sure do like that OpenBSD seems a lot easier to just have solid and work indefinitely.

shevy-java 11mo ago
Well - I would recommend using a better linux distribution than Ubuntu. I run just lighttpd these days; used to run httpd before they decided the configuration must become even more complicated. I don't have any issues with lighttpd (admittedly only few people use it; most seem to now use nginx).
- loloquwowndueo 11mo ago
  And which distribution would that be?
  - igtztorrero 11mo ago
    Debian
    - loloquwowndueo 11mo ago
      I agree but you could have just said it :)
  - dokyun 11mo ago
    Slackware
- PunchyHamster 11mo ago
  Ubuntu seems to have a trend of taking something that works under Debian and somehow messing that up. Upgrades are one thing but for a while we had separate instruction on how to make Yubikey tokens work under each version of Ubuntu (we used them as smartcards for SSH key auth), while Debian instructions stayed the same... Update was also hit and miss on user's desktop machines, for a while ubuntu had a nasty habit of installing new kernel upgrades... without removing old ones, which eventually made boot run out of space and poor user usually had to give it to helpdesk to fix. Tho tbh most of the problems in any distro with packages is "an user installed 3rd party repo that don't have well structured packages and it got messy".

PunchyHamster 11mo ago

[flagged]

shevy-java 11mo ago
AI? I may be missing something. You are talking about whom here? The blog author?
- andai 11mo ago
  GP is referring to the LLM crawler captcha thing. The one with the anime girls in it. It only took a few seconds on my phone, but it's slow on my old ThinkPad.
  - PunchyHamster 11mo ago
    it took tens of seconds to load, once it loaded it was quick And the point of "why waste time for captcha for static file" still stands, it's not like there is comment section for bots to abuse
    - natebc 11mo ago
      It's not about keeping spam out of comments, it's about keeping systems and content safe/operational for normal people and more costly or unavailable for the trillion dollar "AI" companies that are shitting all over everything. Don't blame this on site operators, this is the fault of careless LLM operators knocking down everybody's walls doors and windows to "learn" from their content.
prmoustache 11mo ago
Are you calling Anubis an AI trashcan? Are you opening their website with an i286 for it to take 40s to load?
- PunchyHamster 11mo ago
  it took 30s to even load the trashcan

shevy-java 11mo ago

I appreciate that OpenBSD sold its course on security-everywhere. Unfortunately I also kind of lost faith in the BSD variants. There are a few minor things such as PC-BSD suddenly vanishing, or years before NetBSD on their mailing list admitting that Linux outperformed their "runs on any toaster and other gimmick" strategy. But one of the key issues I had was this: I installed it (FreeBSD) on my second computer. I went out of my apartment and returned hours later. Well, the FreeBSD machine was no longer running; my linux machine on the other hand is running non-stop for months, literally. This may be a fluke, perhaps the computer had a problem - I am not saying this is really what the BSDs are all about, as I also had them installed before. But then I also asked myself "why would I want to bother with the BSDs, if Linux simply runs better?". And I haven't found a good, convincing answer to that for me to rationalise why I'd still be using the BSDs. Note: I also use Linux in a non-standard way, e. g. versioned AppDirs, but essentially Linux is simply more flexible than the BSDs (that is my opinion) and there are more users too. There will be always some BSD users, but to me they are like a dying breed. They would need to market themselves as a "runs outside the nerd bubble as well"; even Linux is still stuck in its own nerd bubble. You have to break out of it if you want to really dominate (Linux semi-does it indirectly, e. g. we can count many smartphones as Linux-driven, but I am still using a desktop computer system here, so to me this is what really counts, even if the total number is less than the smartphone users numbers).

prmoustache 11mo ago
What Linux has is mostly better hardware support and on gnome and some distributions they have a software installation tool that look like an app store but that's about it... Everything else is pretty much the same, random people wouldn't figure out a system is freebsd instead of Linux when running same desktop (like plasma).
- sekh60 11mo ago
  The license makes it very different philosophically.
  - pjmlp 11mo ago

scatbot 11mo ago

One of the reasons why I'm using OpenBSD is because it passes what I think of as a litmus test for FLOSS software: can I build the whole thing from scratch, in a short time and with minimal fuss? In the case of OpenBSD, the answer is yes. I can install it on a new machine, fetch the source code from mirrors, do some edits to the source, build a fresh release, write it to a USB stick and boot it on another machine. On my machine, the whole process takes about 10 minutes for the kernel, additional 20 minutes for base and maybe an hour if you add Xenocara. Compare that to Linux distros like Ubuntu or Arch where building from scratch is either discouraged or some fringe activity that requires skimming through wiki articles, forum posts or old Websites on the Wayback Machine.

sekh60 11mo ago
Gentoo is a Linux rolling release built from source (just recently they gave the option of using binary packages as well). I've ran it on my desktop for years.
PunchyHamster 11mo ago
Buildroot does exactly that and it gives you big TUI menu to pick what you want included in your linux image
- Milpotel 11mo ago
  There is also T2 SDE.
pabs3 11mo ago
Does OpenBSD have Bootstrappable Builds from source without any binaries? I'm guessing not yet, since GNU Guix (Linux distro) pioneered that, and I haven't seen any BSD distro interested in the related Reproducible Builds project. https://bootstrappable.org/ https://bootstrappable.org/ https://reproducible-builds.org/ https://reproducible-builds.org/

mono442 11mo ago

To be honest I don't really see a reason to use a *BSD system myself other than just for the sake of using something different and less mainstream. FreeBSD had some advantages in the past but nowadays Linux has caught up in features.

PunchyHamster 11mo ago
BSD license so you don't have to upstream your stuff would be one. Tho it's not an advantage to *BSD systems, Linux near-forcing vendors to go mainline (as keeping separate kernel tree is PITA) did a lot of good in hardware support.
- graemep 11mo ago
  Not really a problem for users. Only for people who want to redistribute a fork. It matters if you are Apple or Sony, but not for most people. incidentally, the requirement of the GPL is not to upstream your stuff, but to offer to make the modified source available to anyone you distribute the code to. Often the same in practice, but does not have to be.
Gualdrapo 11mo ago
I feel like DragonflyBSD is really cool if you want to look at some BSD that offers some advantages and something unique to your day-to-day desktop usage. And I feel like their community is not as toxic as that of FreeBSD and OpenBSD with their holier-than-thou attitude towards Linux. I'd love it if Gentoo/BSD were a thing once again, I like the BSD concepts but there's nothing like Portage on BSD so far - afaik pkgsrc is nowhere close to it.
rixed 11mo ago
When I switched to FreeBSD, it was because of the quality of the documentation. In Linux manpages are a patchwork from various sources, and it shows; it's not rare for a manpage to be missing, obsolete, or to document another similar tool, or to be inacurrate... Much better than in many other OSes, but still nowhere as good as in FreeBSD. Now that I think of it, when I switched from DOS to Linux it was already because I found manpages amazing. Maybe I've just a soft spot for documentation.

hellcow 11mo ago

I built my last company on OpenBSD. It was easy to understand the entire system, and secure-by-default (everything disabled) is the right posture for servers. Pledge and unveil worked brilliantly to restrict our Go processes to specific syscall sets and files. The firewall on OpenBSD is miles better to configure than iptables. I never had challenges upgrading them--they just kept working for years.

thomashabets2 11mo ago
Finally Linux has something that approaches pledge/unveil: landlock. Seccomp was never actually usable: https://blog.habets.se/2022/03/seccomp-unsafe-at-any-speed.html https://blog.habets.se/2022/03/seccomp-unsafe-at-any-speed.h...
- shiomiru 11mo ago
  > Seccomp was never actually usable It's barely usable by itself but I don't think it's an inherent problem of seccomp-bpf, rather the lack of libc support. Surely the task of "determine which syscalls are used for feature X" belongs in the software that decides which syscalls to use for feature X. In fact, Cosmopolitan libc implements pledge on Linux on top of seccomp-bpf: https://justine.lol/pledge/ https://justine.lol/pledge/
  - thomashabets2 11mo ago
    Well, kinda. The "what does the equivalent of pledge(stdio) actually mean?" doesn't have to actually be on the kernel side. But it's complicated by the fact that on Linux, syscalls can be made from anywhere. On OpenBSD syscalls are now only allowed from libc code. So even if one uses Cosmopolitan libc, if you link to some other library that library may also do direct syscalls. And which syscalls is does, and under which circumstances, is generally not part of the ABI promise. So this can still break between semver patch version upgrades. Like if a library used to just not write debug logs by default, but then changed so that they are written, but to /dev/null, then there's no way to inform application code for that library, much less update it. If you ONLY link to libc, then what you said will work. But if you link to anything else (including using LD_PRELOAD), then all bets are off. And at the very least you'll also be linking to libseccomp. :-) If libc were the only library in existence, then I'd agree with your 100%.

matt-p 11mo ago

I adore openbsd and have been using it since 4.x however it is still slow, not slow to boot or anything like that but if you run it as a web server it manages about half the req/s of Debian. Network performance is also slower than Debian if you're using it as a firewall (but I still prefer it as the syntax of PF is just perfect).

dijit 11mo ago
there's a lot of optimisations they don't engage with because it makes the code "ugly" but there's a larger one here, where they disable hyperthreading outright due to side-channel attacks. Might be a leading cause of what you're seeing.
- thelastgallon 11mo ago
  So, spin up lots of single-core VMs?
  - dijit 11mo ago
    for I/O intensive applications, it's always been true that VMs are a decent chunk of overhead: https://sites.cc.gatech.edu/systems/projects/Elba/pub/JackLiBigdata13.pdf https://sites.cc.gatech.edu/systems/projects/Elba/pub/JackLi... Also, it's likely already in a VM.
- basscomm 11mo ago
  > where they disable hyperthreading outright due to side-channel attacks. You can turn on hyperthreading if you need/want it: https://www.openbsd.org/faq/faq10.html#SMT https://www.openbsd.org/faq/faq10.html#SMT
throwaway270925 11mo ago
It's gotten a lot faster with 7.6 (lots of work on the TCP stack iirc). We saw huge improvements in throughput after updating. The new 7.8 release should bring some more performance, haven't tested it yet though.

lol_catz 11mo ago

If you can tolerate poor performance then by all means use OpenBSD. Debian stable FTW.

ectospheno 11mo ago
You do have to buy more powerful hardware than you otherwise would. I find it worth it to run code I can more easily understand. I agree on Debian as well. My router and laptop are OpenBSD but most vms on my proxmox are Debian.
- hyperpl 11mo ago
  Agreed. I run my OpenBSD firewall on my odroid h4 - it's relatively cheap and plenty powerful to route gigabit+. I prefer pf and the simplicity of OpenBSD over Debian for such a purpose-built application. For my other "home servers" I simply run Debian as I believe it to be one of the more sane Linux choices for a server-type application.

secwang 11mo ago

I tried using OpenBSD, but the support for some specific things isn't very good. For example, J language support is always missing some packages. I also don't want to, and very much do not want to, use systemd. I finally chose FreeBSD, but I'm using some things from OpenBSD as much as possible, like obhttpd, etc. It feels good now.

Guestmodinfo 11mo ago

I hope people here keep donating to the OpenBSD project. I have myself not yet but I'm waiting yo do that

dilippkumar 11mo ago

Long time OpenBSD fan. Used it as my daily driver for years before standardizing all computers at home to macOS. I still think about going back to openBSD one day, but it's no longer very practical as a daily driver. I want to use OpenBSD for the next project I'm building. However, I can't wrap my head around the old way of doing deployments (before containers). People who've built production grade systems with OpenBSD: 1. How do you deploy software? 2. How do you manage fleets of servers? 3. How do you spin up/turn down servers from cloud providers? (I only know of Vultr who provided an OpenBSD option out of the box).

hylaride 11mo ago
> Long time OpenBSD fan. Used it as my daily driver for years before standardizing all computers at home to macOS. I still think about going back to openBSD one day, but it's no longer very practical as a daily driver. It's only practical for hobbyists. I used OpenBSD as a daily driver between 2001-2005. I fought, I suffered, I conquered, and I got tired of not being able to watch video on the web reliably and MacOS in those days was so clean and refreshing. I learned so much, though. > I want to use OpenBSD for the next project I'm building. I admire your open-mindedness. But ask yourself: 1. Do you want to have to upgrade fleets of servers every year with no exceptions for extended security support instead of 5 (or more if you're willing to pay) for LTS versions of Linux? 2. Who else will need to support it? 3. You will likely have worse performance if that matters. > 1. How do you deploy software? Honestly, not many people create their own services that run on OpenBSD. Those that do use old-school packaging and scripting. Tooling like ansible works. > 2. How do you manage fleets of servers? Ansible would be my go-to for classic fleets of servers. > How do you spin up/turn down servers from cloud providers? There are ports of cloud-init for OpenBSD. Creating images for third party OSes can be different levels of painful, depending on the cloud provider.
SoftTalker 11mo ago
OpenBSD has virtualization out of the box now. Most of the benefit of containers you can get with chroot. I don't know if any of the developers are working on a true container/jail capability. I'd like to see a more modern performant filesystem with OpenBSD but ffs has never really let me down. Capability for logical volumes and/or live resizing of partitions would be welcome as well.

reilly3000 11mo ago

Why isn’t it used more often at BigCorp? Or as a base container image?

JCattheATM 11mo ago

I feel like people user it either due to fixation/hobby reasons, or because they've heard it's secure and good for routers so they just use it as a router, assuming the rumors are true. Honestly myself, I prefer NetBSD approaches to many things, or for Linux Alpine, which is perfectly small, minimal and secure by default.

1vuio0pswjnm7 11mo ago

Why use BSD Single source tree for kernel and userland "BSD from scratch" is less work than Linux from scratch