10 ms·

Welcome to OpenBSD [pdf]

133 points by fcambus 12y ago

bch 12y ago
> Proactive security ●64-bit long long time_t (NetBSD technically did it first) The best kind of first. Joking aside -- why is so much OpenBSD advocacy backhanded like this ? Do the writers not think that OpenBSD can stand on it's own ?
- dwc 12y ago
  You left off the following bullet point: * NetBSD technically did it first * But OpenBSD is the one who engaged with the rest of the software community to fix bugs that were uncovered Now it doesn't seem so backhanded.
  - justincormack 12y ago
    Well I think actually NetBSD just made less noise about it. You can call that "engaging with the community", and it can be helpful but since NetBSD switched in 2012 it was not the case that there was no engagement in making software work if it needed fixing.
    - calvin_ 12y ago
      The thing is to ask and poke pre-emptively before problems actually occur.
- mhurron 12y ago
  And if they didn't mention it others would be here complaining that NetBSD did it first and OpenBSD is just trying to take credit.
  - OpenBaSeD 12y ago
    And they will copy UBC, uvm locks, WAPBL, device abstraction layer. Just diff their kernel source to 4.3BSD and compare how close they are still. Their kernel is still stuck in the 80s.
    - cssmoo 12y ago
      I was born in the 80s. I'm not stuck there...
- OpenBaSeD 12y ago
  Actually this is not quite right. Pkgsrc pushes fixes upstream for all breakage, including the 64bit long long time_t. We just weren't born on third base thinking we scored a triple.
carlesfe 12y ago
Slightly off topic, but does anybody know why the OpenBSD community has started using Comic Sans in all their material? Is it some kind of inside joke? I don't find it neither good nor wrong, but there must be some reason behind it.
- sigzero 12y ago
  It's the only truly secure by default font.
- bch 12y ago
  https://twitter.com/michaeldexter/status/489515383682920448 https://twitter.com/michaeldexter/status/489515383682920448 Like wearing a SPAM[1] shirt to a vegan potluck, I guess. [1] http://www.spam.com/ http://www.spam.com/
- tedunangst 12y ago
  Started?
  - Crito 12y ago
    Didn't it only start during that fundraising drive a year or two ago? Or is it older than that?
    - tedunangst 12y ago
      You can scroll through http://www.openbsd.org/papers/ http://www.openbsd.org/papers/ if you're curious. Mostly depends on author (or if they're using magicpoint, really). http://www.openbsd.org/papers/pacsec03/e/index.html http://www.openbsd.org/papers/pacsec03/e/index.html was 2003.
- ma2rten 12y ago
  There was another discussion about it recently on HN, which linked to this: http://www.openbsd.org/papers/bsdcan14-libressl/mgp00025.html http://www.openbsd.org/papers/bsdcan14-libressl/mgp00025.htm...
MartinMond 12y ago
> Random PIDs > Eliminates race conditions > Say you have a root daemon that forks then the child drops privileges. If you can beat the child you can inherit root privileges Can someone explain this? I don't see what this has to do with the randomness of pids.
- Someone 12y ago
  The best I can find on this is https://books.google.nl/books?id=gqKwaHmXp4YC&pg=PA50&lpg=PA50&dq=random+pid+bsd&source=bl&ots=jkiBlXLN1P&sig=uLQToYRJB8_SJAjLOj9ewF3595k&hl=en&sa=X&ei=5aoMVYzVOsvuaJulgIAG&ved=0CB8Q6AEwAA https://books.google.nl/books?id=gqKwaHmXp4YC&pg=PA50&lpg=PA.... Seems an extra layer in defence in depth, making it harder to attack a process between the time it is forked and the time it has dropped privileges by making it harder to find it.
- OpenBaSeD 12y ago
  Being the most secure OS, these days, is like being valedictorian of summer school. The reality is as soon as you install a dynamic language behind a webserver all their memory tricks are for not. They are still focusing on exploitation from 2002.
- grkvlt 12y ago
  Something like after the parent forks, the child opens a file called "/tmp/log.$$" with its PID in the name as root. If you can guess the PID of the child, you could create a link with that name, pointing at a file of your choice that is owned by root, such as "/etc/passwd". Then, you need to make the child do something predictable to that file, such as ensuring that the user supplied data being logged contains text like "\npwn::0:0::/:/bin/sh\n" giving you a valid password file entry for "pwn" with no password and root privileges.
  - xorcist 12y ago
    Predictable file names in tmp is considered a security issue pretty much everywhere (hence mkstemp), so I would guess that's not what they mean.
- 12y ago
kijiki 12y ago
"OpenBSD's OpenBGPD responsible for 30% of worldwide BGP communication" Ummm. Citation needed?
- jethro_tell 12y ago
  With enough loops, anything is possible.
- jlgaddis 12y ago
  Yeah, that was my first thought, too. In all my years in networking, I've ran exactly one instance of OpenBGPD and that's used simply for real-time updates of (anti-spam) blacklists and whitelists [0,1]. [0]: http://bgp-spamd.net/ http://bgp-spamd.net/ [1]: http://www.openbsd.org/papers/asiabsdcon2013/phessler-bgp-spamd-presentation.pdf http://www.openbsd.org/papers/asiabsdcon2013/phessler-bgp-sp...
  - zdw 12y ago
    http://www.openbgpd.org/users.html http://www.openbgpd.org/users.html Also, most large service providers don't tend to talk about their internal implementations. Many in the networking field have been indoctrinated in a Cisco-only philosophy, and then get hired into that monoculture over and over to the point they don't know about anything else, other than if it's something viewed as a Cisco competitor.
    - jlgaddis 12y ago
      Sorry, I never doubted that there are large organizations that run OpenBGPD -- it's just that I, myself, have never personally encountered one (meaningless, I know). I do know that it's used quite often as a route server/reflector at various IXPs (and I may be standing up an instance to do just that in the near future as well) as well as a looking glass. I've managed routers from most of the large manufacturers (Cisco, Juniper, Brocade, HP/H3C, ALU, Mikrotik) and I took a good hard look at OpenBGPD a while back for a customer project so I am aware that it is quite feature-rich and capable and I certainly didn't intend to imply (if it came across that way) that it's not. Really, the thing that I took issue with was: > OpenBSD's OpenBGPD responsible for 30% of worldwide BGP communication It was followed up with: > Correction: 20% of ISPs using OpenBGPD That claim may very well be technically correct, but it strikes me as similar to, e.g., someone claiming that 90% of users on the Internet "use Linux" simply because their traffic may have {passed through|been directed to} a {router|server|firewall} that runs Linux.
BorisMelnik 12y ago
you are my hero, not just for all the awesome OpenBSD contributions and dedication but for the fact that you still maintain a GOPHER protocol'd site! gopher://gopher.anthrobsd.net/
- cssmoo 12y ago
  I still love Gopher. Its for people who give a shit about the content and structure, not oodles of CSS and JS cack wrapped around four square inches of content that looks like my teenage daughter fired up Word and set the font size to 18pt so she didn't have to write so much.
- iso8859-1 12y ago
  do you know what gopher server is in use?
  - jethro_tell 12y ago
    If I remember correctly it is The Gophernicus Project. http://gopherproxy.meulie.net/gophernicus.org/ http://gopherproxy.meulie.net/gophernicus.org/ or you can use the overbite extension for firefox.
    - BorisMelnik 12y ago
      yes that is one. I remember accessing txt files via gopher on university systems back in the 90's. It was similar to browsing an FTP directory via a web browser, with a few more features.
usaif 12y ago
Very useful, sans the font. Pardon the pun
walterbell 12y ago
Theo's opinion notwithstanding, what's the best virtualization platform to run OpenBSD? There's a project to improve AWS/Xen support, http://www.joelroberts.org/openbsd/ http://www.joelroberts.org/openbsd/
- cssmoo 12y ago
  Works fine in VMware ESX and HyperV. Need to run NTP though to combat clock drift. Not tried it on Xen but it has drivers for virtual NICs and storage etc.
- protomyth 12y ago
  If you watch the the ruBSD 2013 interview video with Theo de Raadt[1] at the 6:36, he states that they should take a shot at dealing with modern x86 VMs. That gives me quite a bit of hope along with the work on vmware related drivers in each release. I use VMware at work, seems to do ok. 1) https://www.youtube.com/watch?v=OXS8ljif9b8 https://www.youtube.com/watch?v=OXS8ljif9b8
legulere 12y ago
> strlcat() and strlcpy() > - Solves the problem of unterminated C strings Handling truncation correctly with those is just as much work as handling strcat and strcpy correctly. The only difference is that wrong handling of strcat and strcpy have worse effects usually.

133 points by fcambus 12y ago

bch 12y ago

> Proactive security ●64-bit long long time_t (NetBSD technically did it first) The best kind of first. Joking aside -- why is so much OpenBSD advocacy backhanded like this ? Do the writers not think that OpenBSD can stand on it's own ?

dwc 12y ago
You left off the following bullet point: * NetBSD technically did it first * But OpenBSD is the one who engaged with the rest of the software community to fix bugs that were uncovered Now it doesn't seem so backhanded.
- justincormack 12y ago
  Well I think actually NetBSD just made less noise about it. You can call that "engaging with the community", and it can be helpful but since NetBSD switched in 2012 it was not the case that there was no engagement in making software work if it needed fixing.
  - calvin_ 12y ago
    The thing is to ask and poke pre-emptively before problems actually occur.
mhurron 12y ago
And if they didn't mention it others would be here complaining that NetBSD did it first and OpenBSD is just trying to take credit.
- OpenBaSeD 12y ago
  And they will copy UBC, uvm locks, WAPBL, device abstraction layer. Just diff their kernel source to 4.3BSD and compare how close they are still. Their kernel is still stuck in the 80s.
  - cssmoo 12y ago
    I was born in the 80s. I'm not stuck there...
OpenBaSeD 12y ago
Actually this is not quite right. Pkgsrc pushes fixes upstream for all breakage, including the 64bit long long time_t. We just weren't born on third base thinking we scored a triple.

carlesfe 12y ago

Slightly off topic, but does anybody know why the OpenBSD community has started using Comic Sans in all their material? Is it some kind of inside joke? I don't find it neither good nor wrong, but there must be some reason behind it.

sigzero 12y ago
It's the only truly secure by default font.
bch 12y ago
https://twitter.com/michaeldexter/status/489515383682920448 https://twitter.com/michaeldexter/status/489515383682920448 Like wearing a SPAM[1] shirt to a vegan potluck, I guess. [1] http://www.spam.com/ http://www.spam.com/
tedunangst 12y ago
Started?
- Crito 12y ago
  Didn't it only start during that fundraising drive a year or two ago? Or is it older than that?
  - tedunangst 12y ago
    You can scroll through http://www.openbsd.org/papers/ http://www.openbsd.org/papers/ if you're curious. Mostly depends on author (or if they're using magicpoint, really). http://www.openbsd.org/papers/pacsec03/e/index.html http://www.openbsd.org/papers/pacsec03/e/index.html was 2003.
ma2rten 12y ago
There was another discussion about it recently on HN, which linked to this: http://www.openbsd.org/papers/bsdcan14-libressl/mgp00025.html http://www.openbsd.org/papers/bsdcan14-libressl/mgp00025.htm...

MartinMond 12y ago

> Random PIDs > Eliminates race conditions > Say you have a root daemon that forks then the child drops privileges. If you can beat the child you can inherit root privileges Can someone explain this? I don't see what this has to do with the randomness of pids.

Someone 12y ago
The best I can find on this is https://books.google.nl/books?id=gqKwaHmXp4YC&pg=PA50&lpg=PA50&dq=random+pid+bsd&source=bl&ots=jkiBlXLN1P&sig=uLQToYRJB8_SJAjLOj9ewF3595k&hl=en&sa=X&ei=5aoMVYzVOsvuaJulgIAG&ved=0CB8Q6AEwAA https://books.google.nl/books?id=gqKwaHmXp4YC&pg=PA50&lpg=PA.... Seems an extra layer in defence in depth, making it harder to attack a process between the time it is forked and the time it has dropped privileges by making it harder to find it.
OpenBaSeD 12y ago
Being the most secure OS, these days, is like being valedictorian of summer school. The reality is as soon as you install a dynamic language behind a webserver all their memory tricks are for not. They are still focusing on exploitation from 2002.
grkvlt 12y ago
Something like after the parent forks, the child opens a file called "/tmp/log.$$" with its PID in the name as root. If you can guess the PID of the child, you could create a link with that name, pointing at a file of your choice that is owned by root, such as "/etc/passwd". Then, you need to make the child do something predictable to that file, such as ensuring that the user supplied data being logged contains text like "\npwn::0:0::/:/bin/sh\n" giving you a valid password file entry for "pwn" with no password and root privileges.
- xorcist 12y ago
  Predictable file names in tmp is considered a security issue pretty much everywhere (hence mkstemp), so I would guess that's not what they mean.
12y ago

kijiki 12y ago

"OpenBSD's OpenBGPD responsible for 30% of worldwide BGP communication" Ummm. Citation needed?

jethro_tell 12y ago
With enough loops, anything is possible.
jlgaddis 12y ago
Yeah, that was my first thought, too. In all my years in networking, I've ran exactly one instance of OpenBGPD and that's used simply for real-time updates of (anti-spam) blacklists and whitelists [0,1]. [0]: http://bgp-spamd.net/ http://bgp-spamd.net/ [1]: http://www.openbsd.org/papers/asiabsdcon2013/phessler-bgp-spamd-presentation.pdf http://www.openbsd.org/papers/asiabsdcon2013/phessler-bgp-sp...
- zdw 12y ago
  http://www.openbgpd.org/users.html http://www.openbgpd.org/users.html Also, most large service providers don't tend to talk about their internal implementations. Many in the networking field have been indoctrinated in a Cisco-only philosophy, and then get hired into that monoculture over and over to the point they don't know about anything else, other than if it's something viewed as a Cisco competitor.
  - jlgaddis 12y ago
    Sorry, I never doubted that there are large organizations that run OpenBGPD -- it's just that I, myself, have never personally encountered one (meaningless, I know). I do know that it's used quite often as a route server/reflector at various IXPs (and I may be standing up an instance to do just that in the near future as well) as well as a looking glass. I've managed routers from most of the large manufacturers (Cisco, Juniper, Brocade, HP/H3C, ALU, Mikrotik) and I took a good hard look at OpenBGPD a while back for a customer project so I am aware that it is quite feature-rich and capable and I certainly didn't intend to imply (if it came across that way) that it's not. Really, the thing that I took issue with was: > OpenBSD's OpenBGPD responsible for 30% of worldwide BGP communication It was followed up with: > Correction: 20% of ISPs using OpenBGPD That claim may very well be technically correct, but it strikes me as similar to, e.g., someone claiming that 90% of users on the Internet "use Linux" simply because their traffic may have {passed through|been directed to} a {router|server|firewall} that runs Linux.

BorisMelnik 12y ago

you are my hero, not just for all the awesome OpenBSD contributions and dedication but for the fact that you still maintain a GOPHER protocol'd site! gopher://gopher.anthrobsd.net/

cssmoo 12y ago
I still love Gopher. Its for people who give a shit about the content and structure, not oodles of CSS and JS cack wrapped around four square inches of content that looks like my teenage daughter fired up Word and set the font size to 18pt so she didn't have to write so much.
iso8859-1 12y ago
do you know what gopher server is in use?
- jethro_tell 12y ago
  If I remember correctly it is The Gophernicus Project. http://gopherproxy.meulie.net/gophernicus.org/ http://gopherproxy.meulie.net/gophernicus.org/ or you can use the overbite extension for firefox.
  - BorisMelnik 12y ago
    yes that is one. I remember accessing txt files via gopher on university systems back in the 90's. It was similar to browsing an FTP directory via a web browser, with a few more features.

usaif 12y ago

Very useful, sans the font. Pardon the pun

walterbell 12y ago

Theo's opinion notwithstanding, what's the best virtualization platform to run OpenBSD? There's a project to improve AWS/Xen support, http://www.joelroberts.org/openbsd/ http://www.joelroberts.org/openbsd/

cssmoo 12y ago
Works fine in VMware ESX and HyperV. Need to run NTP though to combat clock drift. Not tried it on Xen but it has drivers for virtual NICs and storage etc.
protomyth 12y ago
If you watch the the ruBSD 2013 interview video with Theo de Raadt[1] at the 6:36, he states that they should take a shot at dealing with modern x86 VMs. That gives me quite a bit of hope along with the work on vmware related drivers in each release. I use VMware at work, seems to do ok. 1) https://www.youtube.com/watch?v=OXS8ljif9b8 https://www.youtube.com/watch?v=OXS8ljif9b8

legulere 12y ago

> strlcat() and strlcpy() > - Solves the problem of unterminated C strings Handling truncation correctly with those is just as much work as handling strcat and strcpy correctly. The only difference is that wrong handling of strcat and strcpy have worse effects usually.