10 ms·
OpenBSD 5.6: What will be there
- peatmoss 12y agoCan anyone speak to SSD in OpenBSD? My understanding is that trim support is not supported in OpenBSD (http://daemonforums.org/showthread.php?p=51377 http://daemonforums.org/showthread.php?p=51377). That makes me a little worried about the potential to wear out an SSD drive in a workstation. The thread I linked discusses reducing some writes by using softdeps and the like, is that enough to make this a non-issue?
- dmm 12y agoIn general I wouldn't trust random forums for information about OpenBSD. People tend to repeat stuff long after its true. Send a message to misc@ or tech@openbsd.org and you'll hear directly from the devs. Just make sure your partitions are 4k aligned to minimized write amplification. Many openbsd devs use SSDs. I've used one with openbsd for years without problems. Honestly it's a requirement given the shortcomings of ffs.
- peatmoss 12y agoI've been away from OpenBSD for a while, and was just googling to try to get a starting basis. Thank you for pointing me to the 4k alignment issue. This thread (http://openbsd.7691.n7.nabble.com/SSD-disk-alignment-td75046.html http://openbsd.7691.n7.nabble.com/SSD-disk-alignment-td75046...) seems to suggest that OpenBSD will try to align to 4k boundaries by default. Is that correct?
- cylinder714 12y agoHere's a link to the FAQ section regarding flash memory: http://www.openbsd.org/faq/faq14.html#flashmem http://www.openbsd.org/faq/faq14.html#flashmem There's no mention of the 4K alignment issue, however.
- g047f4c3 12y agoSome info regarding TRIM, http://www.tedunangst.com/flak/post/lessons-learned-about-TRIM http://www.tedunangst.com/flak/post/lessons-learned-about-TR... For the moment, just make sure you leave a slice of the SSD unused. You could also on occasion backup the OpenBSD install, replace it with an empty ext4fs and fstrim it via a livecd, then restore the OpenBSD install.
- ancarda 12y ago>IPv6 is now turned off on new interfaces by default. Assigning an IPv6 address will enable IPv6 on an interface. Why?
- Zenst 12y agoOff by default makes much sense given it is another vector to attack. If not needed then why be on and more likely to just use IPv4 over even touching IPv6.
- andreasvc 12y agoNot just a vector of attack, it also causes performance and connectivity problems when misconfigured. As long as there is no critical mass for IPv6, it's not worth the headache. I know that if everyone had that attitude, IPv6 will never get critical mass, and that is exactly what I'm rooting for. I don't care for toasters with IP addresses.
- justincormack 12y agoWell I noticed today that some random hotel in Germany I was thinking of staying at was on ipv6, and it is way more popular than IE6... People want connected devices, in way more numbers than there are ipv4 addresses, and end to end connectivity is the internet.
- andreasvc 12y agoI'd say putting mobile devices behind carrier-grade NAT goes a long way. > end to end connectivity is the internet. It was definitely the original idea of the internet, but I'd say it no longer is the reality. People want to access Google and Facebook. The vast majority of users don't need or want their device to be directly reachable from the internet but communicate through cloud services.
- inopinatus 12y agoOn the contrary, the statement seems correct. End to end connectivity is the Internet.... and by contrast, privately addressed networks are not on the Internet but must reach it via gateways. Reaching one another via centralized services rather than distributed federation is a problem, not a solution, in communications protocol design. See also: Everyone Hates Facebook.
- chrissnell 12y agoI used to use OpenBSD extensively in my job because of the awesomeness of PF but later moved on to big iron F5 and Cisco gear. In this new age of NSA wiretaps and cloud based services built around advertising and tracking however, OpenBSD feels more relevant than ever. I'd like to give it a shot as a desktop again. So, who makes a modern laptop with good OpenBSD hardware compatability?
- peatmoss 12y agoWas thinking the same thing myself. I keep thinking recent MacBook Airs would make a good candidate--reasonably standard Intel hardware, decent components, tons of systems in the wild. Hence my comment about trim support for SSDs.
- sudowhodoido 12y agoTry FreeBSD if you want TRIM. Also has LLVM, PF and ZFS out of the box.
- pantalaimon 12y agoMight as well use Linux.
- sudowhodoido 12y agoThat's like comparing a Volvo to a Trabant. FreeBSD is the Volvo for reference.
- dmm 12y agoAll of the openbsd devs use thinkpads and they have good compatibility in my experience. The newest ones might have UEFI and they might not work well.
- CoconutPilot 12y agoI heard this and installed OpenBSD on my thinkpad only to find out there is no support for nVidia. I suppose you need ATI or Intel video to get a working X. There is a brief warning about nVidia here: http://www.openbsd.org/amd64.html http://www.openbsd.org/amd64.html
- jingo 12y ago"IPv6 is now turned off on new interfaces by default." I have had to remove the IPv6 option from my kernels because enabling IPv6 by default (which to me seems like a "policy" decision) has become so pervasive. Nice to see this change; here's hoping other OS's follow suit.
- cbd1984 12y agoI can understand not supporting tape installation (although aren't tapes still used in large, serious, high-power businesses as backup media?), but why remove FTP? Granted, it's objectively a horrible protocol, but is the FTP client code more likely to be an attack surface than the HTTP client code? If you're after security, isn't it more secure to remove all network installation and force people to use only physical media which they obtained from a secure and trusted source? http://mywiki.wooledge.org/FtpMustDie http://mywiki.wooledge.org/FtpMustDie
- danielweber 12y agoThat surprised me, too, because in 2013 I was installing from FTP. But mostly from habit. I'm hoping it's because they are going to be using HTTPS with pinned certs to ensure you are downloading from a proper mirror. But that's hope, not actual knowledge.
- cbd1984 12y ago> HTTPS with pinned certs Is there an FTP equivalent of this?
- kjs3 12y agoThere's FTP/S (and RFC-4217, and not SFTP), which uses an SSL session negotiated inside of an FTP session. I don't know if there's a client/server combo that supports pinning, but this much at least exists. Frankly, if I was looking to implement this, I'd start with SFTP/SCP. FTP/S is, at best, a rarely implemented kludge.
- justin66 12y ago> I can understand not supporting tape installation (although aren't tapes still used in large, serious, high-power businesses as backup media?) How does removing tape installation as a feature affect businesses who use tape as a backup method?
- cbd1984 12y ago
- itwontdie 12y ago"Major internal refactoring to begin to make part of OpenSSH usable as a library. So far the wire parsing, key handling and KRL code has been refactored. Please note that we do not consider the API stable yet, nor do we offer the library in separable form." This is intriguing. I would certainly like to know more about what is happening with this.
- ams6110 12y agoMS-CHAPv1 (RFC2433) support has been removed from pppd(8). This is sensible but means I can't use OpenBSD to connect to one of my client's VPNs. Unless there's another way?
- inopinatus 12y agoUntried, but you may be able to just recompile pppd with different options; the diff seems small. http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/pppd/Makefile.diff?r1=1.17&r2=1.18 http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/pppd/M... Worst case scenario you'd have to restore some bits of old source (chap_ms.c and maybe the necessary md4 routines).
- s800 12y agoEverything 68k is gone?
- ams6110 12y agoWhere does it say that? Edit: If you mean mac68k then yes, but that platform was dropped after the 5.1 release. http://www.openbsd.org/mac68k.html http://www.openbsd.org/mac68k.html
- kjs3 12y agoHP300 and MVME68K are 68K. I occasionally crank up the latter for shits and grins, but support is far more a labor of love than for any utility these platforms might have left. See also: VAX.
- sigjuice 12y agoShould information like this be provided over an insecure HTTP connection? signify(1) pubkeys for this release: base: RWR0EANmo9nqhpPbPUZDIBcRtrVcRwQxZ8UKGWY8Ui4RHi229KFL84wV fw: RWT4e3jpYgSeLYs62aDsUkcvHR7+so5S/Fz/++B859j61rfNVcQTRxMw pkg: RWSPEf7Vpp2j0PTDG+eLs5L700nlqBFzEcSmHuv3ypVUEOYwso+UucXb
- vinceguidry 12y agoPublic keys are intended to be public. So long as you're not transmitting them over the same connection as the one you're using them in, you're golden.
- dbpatterson 12y agoThe point of HTTPS is not to hide things, it's to prevent tampering... Which seems relevant when transmitting checksums.
- vinceguidry 12y agoThat problem can be solved by retrieving the key out of band. If you're that worried about it, use a VPN to verify that the key you're seeing is the right key. That will vastly increase the difficulty of pulling off a successful attack. They'd have to MitM both connections, as well as the connection you're using to download the software, in order to compromise it.
- Sir_Cmpwn 12y agoEh, I think it's fine. I advocate for HTTPS everywhere but I don't think this particular bit of information is so sensitive as to demand encryption.
- marktangotango 12y agohttp://en.wikipedia.org/wiki/Public-key_cryptography http://en.wikipedia.org/wiki/Public-key_cryptography
- lern_too_spel 12y ago
- brunoqc 12y agoI wonder if I should wait for usb storage support on Octeon or if I should just buy a Soekris. It's for home, nothing big.
- bluehazed 12y agoLove the release song for this one.
- tedunangst 12y agoWhy submit this now? The fact that the top item is "..." wasn't a hint it's not done?
- jamesaguilar 12y agoFascinating that they removed the agp driver.
- skz 12y agoDoes anyone know off the top of their head how OpenBSD performs on a Samsung 900X?
- tbrock 12y agoOrder a CD rom? Talk about out of touch, ouch.
- doomrobo 12y agoI think for companies that still do this, they acknowledge that the impetus for buying a CD is more for collection/novelty purpose than actual usefulness. My question is whether there are any more effective ways of generating some kind of profit that actually involves giving something extra to the user, whether physically or digitally.
- g047f4c3 12y agohttp://www.openbsd.org/faq/faq3.html#BuyCD http://www.openbsd.org/faq/faq3.html#BuyCD Not to mention another verifiable source for the signify keys.
- rakoo 12y agoThey do need money, that's a way to give them some.
- deleted 12y ago[deleted]
- cylinder714 12y agoNo FTP access, but I expect HTTP will remain.
- enjoy-your-stay 12y agoDoes anybody know why they are dropping support for kerberos? I didn't even know there was support for Kerberos in OpenSSl, but it's also under the LibreSSL bullet points as well.
- clarry 12y agoNobody uses it and it's a lot of code to audit. Log message: Remove SRP and Kerberos support from libssl. These are complex protocols all on their own and we can't effectively maintain them without using them, which we don't. If the need arises, the code can be resurrected. Or in Theo's words: It is crap. Eventually we recognize the risk is to high. Another relevant commit message, with a fun quote: Log message: The complexity and quality of kerberosV and the fact that almost nobody is using it doesn't justify to have it in base - disable and remove it. If the 2 two people who use it still want it, they can make a port or recompile OpenBSD on their own. There is a quote in theo.c from August 2010: "basically, dung beetles fucking. that's what kerberosV + openssl is like". Discussed with many. Tests by henning@ reyk@ and others. ok deraadt@ henning@ I recommend you take a look at the whole message, it'll give you a vague idea of how big the code base was. Keep in mind that this particular commit was followed by a lot of smaller commits removing remnants of kerberos that had kinda spread all over the system... http://marc.info/?l=openbsd-cvs&m=139816103911227&w=2 http://marc.info/?l=openbsd-cvs&m=139816103911227&w=2