4 ms·

I've used OpenBSD for years in my router. Something that has given me a bit of pause recently, is that with all the various espionage revelations coming out in

by Quequau 12y ago

I've used OpenBSD for years in my router. Something that has given me a bit of pause recently, is that with all the various espionage revelations coming out in the past 14-16 months, I had expected the OpenBSD crowd to be out in force talking up the operating system but they've been surprisingly subdued. Just makes me wonder...

gaius 12y ago
Those who know don't talk and those who talk don't know.
- pferde 12y ago
  Now, if we could only get the latter to shut up and listen, and the former to start talking. Wouldn't that be wonderful?
glass- 12y ago
> I had expected the OpenBSD crowd to be out in force talking up the operating system but they've been surprisingly subdued The OpenBSD motto is "shut up and hack". Look at the work that is being done recently with libressl, openssh, the new httpd, signify, static PIE, xorg privilege separation etc. etc. They're letting the code do the talking.
- Quequau 12y ago
  I don't think that the OpenBSD crowd's response to the OpenSSH vulnerabilities are an example of some motto of "shut up and hack" at all. In fact, I find their response to demonstrate the difference in reactions that got my attention. Heartbleed provoked substantial discussion as well as the LibreSSL project.
  - tedunangst 12y ago
    What OpenSSH vulnerabilities?
  - wtetzner 12y ago
    You mean the OpenSSL vulnerabilities?
  - yellowapple 12y ago
    If by "OpenSSH" you actually meant "OpenSSL" (I'm a seasoned sysadmin and I still get those mixed up in conversation, so don't worry), then yes, the crowd's response was certainly an example of "shut up and hack": the OpenBSD devs wrote libressl to replace it, cutting out as much of the insecure cruft as they physically could.
jlgaddis 12y ago
You reminded me of "Allegations regarding OpenBSD IPSEC" [0] which, WRT the recent news of the NSA (attempting to) compromise encrypted VPNs, makes me wonder a bit (although I don't believe the allegations in the linked e-mail). [0]: http://marc.info/?l=openbsd-tech&m=129236621626462 http://marc.info/?l=openbsd-tech&m=129236621626462
- Quequau 12y ago
  Yeah, I remember that controversy. As I recall those allegations prompted the OpenBSD to team do a full code audit of the IPSEC stack and, while they did find a few bugs, the conclusion was that there was no backdoor and that the bugs they found were not intentional. I think it's really hard to respond these sorts of allegations and I'm not sure we could honestly expect more than that. I'm really not trying to insinuate that OpenBSD is compromised or untrustworthy. I guess I'm just musing that, even though I've used OpenBSD for ages & ages and I do try to keep up with things in the OpenBSD world, I just don't grok the OpenBSD community... and that makes me feel uneasy sometimes.
  - jlgaddis 12y ago
    Yes, sorry, I wasn't intending to make any accusations or insinuations either. I've been following the Snowden/NSA stuff pretty closely, however, and even after reading the recent revelations WRT VPNs, I had forgotten about this OpenBSD IPSec controversy until you reminded me. (JFTR, I run OpenBSD in production, trust it greatly, and never believed the allegations of FBI/NSA/etc. "tampering".)

by Quequau 12y ago

gaius 12y ago

Those who know don't talk and those who talk don't know.

pferde 12y ago
Now, if we could only get the latter to shut up and listen, and the former to start talking. Wouldn't that be wonderful?

glass- 12y ago

> I had expected the OpenBSD crowd to be out in force talking up the operating system but they've been surprisingly subdued The OpenBSD motto is "shut up and hack". Look at the work that is being done recently with libressl, openssh, the new httpd, signify, static PIE, xorg privilege separation etc. etc. They're letting the code do the talking.

Quequau 12y ago
I don't think that the OpenBSD crowd's response to the OpenSSH vulnerabilities are an example of some motto of "shut up and hack" at all. In fact, I find their response to demonstrate the difference in reactions that got my attention. Heartbleed provoked substantial discussion as well as the LibreSSL project.
- tedunangst 12y ago
  What OpenSSH vulnerabilities?
- wtetzner 12y ago
  You mean the OpenSSL vulnerabilities?
- yellowapple 12y ago
  If by "OpenSSH" you actually meant "OpenSSL" (I'm a seasoned sysadmin and I still get those mixed up in conversation, so don't worry), then yes, the crowd's response was certainly an example of "shut up and hack": the OpenBSD devs wrote libressl to replace it, cutting out as much of the insecure cruft as they physically could.

jlgaddis 12y ago

You reminded me of "Allegations regarding OpenBSD IPSEC" [0] which, WRT the recent news of the NSA (attempting to) compromise encrypted VPNs, makes me wonder a bit (although I don't believe the allegations in the linked e-mail). [0]: http://marc.info/?l=openbsd-tech&m=129236621626462 http://marc.info/?l=openbsd-tech&m=129236621626462

Quequau 12y ago
Yeah, I remember that controversy. As I recall those allegations prompted the OpenBSD to team do a full code audit of the IPSEC stack and, while they did find a few bugs, the conclusion was that there was no backdoor and that the bugs they found were not intentional. I think it's really hard to respond these sorts of allegations and I'm not sure we could honestly expect more than that. I'm really not trying to insinuate that OpenBSD is compromised or untrustworthy. I guess I'm just musing that, even though I've used OpenBSD for ages & ages and I do try to keep up with things in the OpenBSD world, I just don't grok the OpenBSD community... and that makes me feel uneasy sometimes.
- jlgaddis 12y ago
  Yes, sorry, I wasn't intending to make any accusations or insinuations either. I've been following the Snowden/NSA stuff pretty closely, however, and even after reading the recent revelations WRT VPNs, I had forgotten about this OpenBSD IPSec controversy until you reminded me. (JFTR, I run OpenBSD in production, trust it greatly, and never believed the allegations of FBI/NSA/etc. "tampering".)