26 ms·

EU study recommends OpenBSD

352 points by fcambus 11y ago

s_dev 11y ago
Theo De Raadt always complained that many of the institutions that run and use OpenBSD don't contribute back. Good to see the EU at least acknowledging that its something that they should explore. They probably use it and its features more than they realise. I suspect there is a strong political motive as well behind being "technologically independent" after the NSA mass surveillance revelations. I like the sound of an EU BSD fork - hopefully they fund one. We've always been lacking in the Operating Systems dev department over here in Europe. Linux is our main contribution but we can do more.
- jkyle 11y ago
  > Theo De Raadt always complained that many of the institutions that run and use OpenBSD don't contribute back. Sounds like he needs a different license then.
  - deleted 11y ago
    [deleted]
  - joshuapants 11y ago
    I don't think that would make them likely to contribute back, they'd just use something else. He'd rather have selfish people using good software than choosing to use something inferior.
    - jkyle 11y ago
      Maybe, maybe not. They'd all do the same sort of cost/benefit assessment and if they deemed the benefit to outweigh the cost of contributing back they would do it. There'd be some who would change their options and some that would become contributors. Hard to say how it would pan out. But, when you select a license like BSD (which I've done myself) you shouldn't complain when users don't contribute back. You selected a license that formally declares your intent and expectations; the user has formally agreed to them.
      - clarry 11y ago
        Actually one's expectation can very well be that people be nice to you even if you're not using legalese to require that of them.
      - s73v3r 11y ago
        I wonder how much of an actual analysis is done in these cases, and how much it's just a boss saying that he doesn't want people "wasting their time" working on something that isn't directly related to their stuff.
    - zanny 11y ago
      Somehow Google, Samsung, and Intel are sticking the Linux kernel in everything despite it being GPL'd and them having to release their modifications. Might have something to do with how reengineering the Linux kernel would cost on the order of billions of dollars in engineer time.
      - mschuster91 11y ago
        Just look at how many Android vendors actually honor the GPL. Even the major vendors tend to mess up their source code dumps, and lots of the Chinese (hi Mediatek) vendors don't even react on emails. Google should require in the vendor license terms for the Android brand and the Play Store that the sources be released on Github.
  - tbrownaw 11y ago
    I don't think any of the free/open licenses require users to contribute to the parent project. I don't think any even require that people distributing modified versions, send those modifications back upstream.
    - SixSigma 11y ago
      In fact there was a shitstorm when some licences had "all modifications must be sent upstream" clauses e.g. Plan9's original license had that clause. And then the "tick this box if you don't make nuclear weapons" clause was lambasted in Theo's colourful style [1]. There was a time when OpenBSD were considering moving to the plan9 tool chain - which is now available under both GPL and MIT licensing. That sad part was, most everyone in the plan9 community agreed with him but had their hands tied by Alacatel/Lucent legal and US law. [1] https://groups.google.com/forum/?_escaped_fragment_=topic/comp.os.plan9/0j5Xa_Bu_fs#!topic/comp.os.plan9/0j5Xa_Bu_fs https://groups.google.com/forum/?_escaped_fragment_=topic/co...
    - Someone1234 11y ago
      The GPL kinda-sorta does. I guess it depends on your definition of "contribute back." People that derive from GPL source have to release those changes to the public, which could just be a zip archive on their web-site rather than a git pull request. I guess what I mean is, the company can try to be as unhelpful as possible (e.g. strip comments, place all code into a giant .cpp file, etc) but it does technically have to publish source code regardless.
      - debacle 11y ago
        > People that derive from GPL source have to release those changes to the public This is entirely not true. If I take a GPLed application, download it, modify it, and never distribute it, then I am under no obligation to release the source.
      - cwyers 11y ago
        The GPL requires you to distribute source code in addition to binaries. If you don't distribute binaries (i.e. if you're running the code on your server farm only), then you don't have to distribute anything.
  - weland 11y ago
    More often than not, he wasn't referring to contributions in the FSF sense (i.e. people modifying code that they don't send back to the original authors). He simply meant that many of the institutions that run and use OpenBSD, which is available entirely for free, don't give anything in return - be it in the form of code, money, documentation or promotion. Another free license solves only a small proportion of this problem.
    - jkyle 11y ago
      Another free license solves only a small proportion of this problem. True, but with BSD I'm not sure you can view it as a problem to begin with since the license is explicitly designed to legally absolve the user of all obligation to do just that. If you desire monetary contributions be made, some kind of commercial license is the solution. If you desire modifications be contributed back, there are other licenses that cover that expectation. And there's nothing stopping you from creating your own license. If you don't require or expect any contributions back or monetary contributions under any scenarios, then BSD is a great license for that. I'm sure when confronted with a lack of contribution (monetary, labor, code modifications), most companies would reply "Well, yes. That's why we chose software with a BSD license."
      - edejong 11y ago
        There is definitely business value in contributing to these projects. First of all, by contributing, you show a mutual interest in the increased quality of the solution. This in turn will motivate the maintainers to better understand the business concerns of the new contributor. By contributing, the contributor will gain insights in the workings of the solution, thus increasing the quality of the product itself. (As an analogy: by taking apart an amplifier, you increase your understanding of the way the product satisfies your needs). Last but not least, contributing generates good-will, subsequently increasing the probability of adequate answers to support questions.
        cwyers 11y ago
        There's also a lot of business value in freeriding when the software license explicitly allows you to do so.
  - giovannibajo1 11y ago
    TBH a single organization adopting and customizing a GPL software for internal usage isn't forced to contribute back, as GPL affects redistribution not adoption.
  - istvan__ 11y ago
    Easy like that?
  - pyre 11y ago
    As we've seen with GPL'd code, many companies are happy to skirt the license restrictions if they feel that they can get away with it. How much money and effort would then need to be expended to enforcement of said new license for OpenBSD? How many companies would do a cost/benefit analysis of the likelihood of OpenBSD lawyers suing them, and even then ignore the license if they thought that it would be less expensive to risk a lawsuit? "Change the license" isn't a silver bullet. Companies aren't machines that are fed licenses that they then obey like punch cards into an old IBM machine.
  - zkhalique 11y ago
    Actually what he said was: GPL fans said the great problem we would face is that companies would take our BSD code, modify it, and not give back. Nope—the great problem we face is that people would wrap the GPL around our code, and lock us out in the same way that these supposed companies would lock us out. Just like the Linux community, we have many companies giving us code back, all the time. But once the code is GPL'd, we cannot get it back.
  - hobarrera 11y ago
    The only licence that will fix this is one that requires payment from users, and that's never going to happen. Things like GPL don't force users to send back contributions unless you redistribute a derivate product (which is not usually the case). Theo is talking about giving something back (an acknowledgement, or even better, money).
- belorn 11y ago
  "said the great problem we would face is that companies would take our BSD code, modify it, and not give back. − Nope. We have many companies giving us code back, all the time." - Theo De Raadt
  - dimitar 11y ago
    If so, then the issue is they don't contribute money?
    - nayden 11y ago
      That used to be a case for a very long time but it is _slowly_ changing. We still mostly rely on contributions by individuals.
  - s_dev 11y ago
    You could have easily taken the full quote -- it's not quite the contradiction you're trying to make: "GPL fans said the great problem we would face is that companies would take our BSD code, modify it, and not give back. Nope—the great problem we face is that people would wrap the GPL around our code, and lock us out in the same way that these supposed companies would lock us out. Just like the Linux community, we have many companies giving us code back, all the time. But once the code is GPL'd, we cannot get it back."
    - gillianseed 11y ago
      >Nope—the great problem we face is that people would wrap the GPL around our code, and lock us out in the same way that these supposed companies would lock us out. Does he offer any examples of this happening ?
      - s_dev 11y ago
        The point I think Theo is trying to make is in the open source world you simply have to expect that people will take code - put it under a different licence and modify it - restricting their ability to take back the modified code into OpenBSD. Typically OSS licences allow and tolerate "selfish" behaviour. I don't think I or he needs to back up this claim with examples.
- th0br0 11y ago
  In general, the EU is _very_ strong on open source commitments. Almost all projects that I know of and some of which I'm working on funded as part of FP7 (Seventh Framework Programme) will eventually end up open-sourced.
  - ersii 11y ago
    Interesting! Could you elaborate some more and perhaps list a few projects, if you're allowed to?
    - th0br0 11y ago
      I primarily know about the projects listed at https://www.fokus.fraunhofer.de/809f10db25eddf3e/projects https://www.fokus.fraunhofer.de/809f10db25eddf3e/projects A personal observation is that, nowadays, gitlab seems to be preferred to github as part of a push to rely more on software developed inside the EU (guess it's an aftermath of the whole NSA story). PolicyCompass, for example, lives at https://github.com/policycompass https://github.com/policycompass Carneades lives at http://github.com/carneades http://github.com/carneades MARKOS is up on SF http://markosproject.sourceforge.net/ http://markosproject.sourceforge.net/
      - chupy 11y ago
        Just curious, is that software developed by consultants or by actual EU employees?
        th0br0 11y ago
        Consultants essentially. There's also some IT development going on by actual EU employees, but the projects I listed above are usually won through tenders often submitted as a joint project by multiple companies/organisations (research partners - i.e. universities -, development partners - i.e. big companies - + public partners - often for demo purposes) although the EU also funds some purely research oriented projects of course.
- javert 11y ago
  > an EU BSD fork Why fork it? That is completely stupid. Do you want to have the EU version of North Korea's Red Star Linux? Do you want to make it so Google doesn't work properly on EU BSD?
  - madez 11y ago
    The EU is not North Korea. A fork would make sense if the EU puts enough man-power into the project and they don't agree with the current leadership.
- reddotX 11y ago
  minix is/was sponsored by EU http://wiki.minix3.org/doku.php?id=www:documentation:read-more http://wiki.minix3.org/doku.php?id=www:documentation:read-mo...
- DasIch 11y ago
  The idea of a EU BSD fork sounds terrible. What needs to happen is government funding for key open source infrastructure projects that require it like OpenSSL, OpenBSD, GnuPG, etc.
- hobarrera 11y ago
  > I like the sound of an EU BSD fork - hopefully they fund one. We've always been lacking in the Operating Systems dev department over here in Europe. There's no need to fork and split manpower, you can contribute to OpenBSD being in Europe.
tormeh 11y ago
The EU also funds Minix 3 development, though that is more about reliability than security.
- masklinn 11y ago
  The pypy project also benefited from EU grants early in its history.
- cbd1984 11y ago
  The thing about security is that it touches everything. Ease of use? If something's hard to use, it's easy to confuse people into doing insecure things. Security issue. Unreliable? Security depends on predictable behavior, and failure modes are often unpredictable. Security issue. Proprietary protocol? Even if it wasn't intentionally backdoored, you don't know its real attack surface, because you don't know all of the verbs it contains. Verbs imply actions, actions imply changes of state, changes of state imply the Dark Side... uh, security concerns. Security issue. Performance? Even aside from timing attacks and simple DoSing, things often behave oddly when pushed to a limit, especially if that limit involves otherwise-hidden race conditions. Security issue.
- carussell 11y ago
  Not anymore. The money from those grants is gone.
andrewstuart2 11y ago
Didn't everyone recommend Linux and Mac OS back when vulnerabilities on these systems just hadn't been discovered (or possibly written) yet? Make OpenBSD popular, add a ton of devs, and attack value, and I'm pretty sure these problems will repeat themselves. I think the second study, which briefly names OpenBSD, does a good job of pointing out that technological changes alone are insufficient.
- masklinn 11y ago
  Well there's the difference that security is basically the core focus of OpenBSD's development, and the project actively researches and updates development practices with that in mind.
- cbd1984 11y ago
  Yes, and a Brinks armored truck is just as vulnerable to carjackings as a Ford Pinto, we just don't know about the vulnerability because nobody drives them. People were saying the same things about Linux. In the late 1990s and early 2000s. By which time Linux had already become the de-facto go-to OS for web servers around the world. It was, in short, already a high-value target, and yet the apocalypse didn't occur.
  - andrewstuart2 11y ago
    Of course that's true. I'm just not convinced that OpenBSD : Linux :: Armored truck : Pinto. In fact, the point of a good portion of the second study [1], p.17-25 is pointing out the flaws that have occurred in the Linux operating system and other existing technologies. [1]http://www.europarl.europa.eu/RegData/etudes/STUD/2015/527409/EPRS_STU(2015)527409_REV1_EN.pdf http://www.europarl.europa.eu/RegData/etudes/STUD/2015/52740...
    - cbd1984 11y ago
      I never claimed Linux was a Pinto. My point is, some things are just built well, and even if they're not used very often we can expect a certain level of quality, as opposed to saying that the only reason we don't see them stolen is because so few people drive them. Especially if they're used all the damn time, just not in places people see a lot. So some bugs will be found in OpenBSD. That's a given. However, it isn't like OpenBSD is never used, or that the people who made it are bad programmers.
brudgers 11y ago
Link to Part 1 of the study (wherein the recommendation lies): http://www.europarl.europa.eu/RegData/etudes/STUD/2015/527409/EPRS_STU(2015)527409_REV1_EN.pdf http://www.europarl.europa.eu/RegData/etudes/STUD/2015/52740... Part 2 of the study recommends government funding of Open Source Projects: http://www.europarl.europa.eu/RegData/etudes/STUD/2015/527410/EPRS_STU(2015)527410_REV1_EN.pdf http://www.europarl.europa.eu/RegData/etudes/STUD/2015/52741... Potential and actual conflicts of interest between governments and citizens in regard to privacy are not addressed.
- k-mcgrady 11y ago
  They don't address conflicts of interest but it seems like they're fine with privacy: "[...] the use of open source computer operating systems and applications reduces the risk of privacy intrusion by mass surveillance. They seem to be touting that as a benefit, not a drawback.
  - brudgers 11y ago
    When the same governments are funding signals intelligence gathering with one hand and open source software development with the other, there is potential conflict of interest, if not actual conflict. The NSA's role in weakening open source encryption standards was the result of the internal logic by which all intelligence organs typically operate irrespective of sponsoring state. The differences between the politics of some EU states and the politics of the US or Russia or the UK don't change that internal logic of intelligence organs. Their job remains to maintain data collection capability.
    - k-mcgrady 11y ago
      And with OSS we can see when the create back doors or modify the code. We can see what the modifications do. And if they are doing anything wrong we can revert the changes and publicise it. Following on from your thinking, what is their angle here? On the surface it seems more difficult to exploit OSS but is there something they can do with it that users won't know about and is easier to exploit?
corv 11y ago
The study also recommends Qubes and Tails.
_lce0 11y ago
Nice to see recognition from the trenches of bureaucracy. It's really nice that they can write such statement. Kudos to the OpenBSD team!
nbevans 11y ago
"[...] the use of open source computer operating systems and applications reduces the risk of privacy intrusion by mass surveillance. Open source software is not error free, or less prone to errors than proprietary software, the experts write. But proprietary software does not allow constant inspection and scrutiny by a large community of experts." That worked great for OpenSSL didn't it? ;)
- th0waway 11y ago
  Yep, the issue was fixed (even though it took a while).
  - yellowapple 11y ago
    And by "a while", one means "a few days after discovery" (a few months after it was introduced, but that's actually not terrible, all things considered).
    - nbevans 11y ago
      Fact check: It was introduced years priors to discovery, not mere months.
      - yellowapple 11y ago
        Thanks for the fact check! Looks like it was indeed committed to OpenSSL about 2 1/2 years prior.
- higherpurpose 11y ago
  Microsoft has had 2 Heartbleed-level vulnerabilities in its Windows code so far, that were not just 2-3 years old but 10+ years old, leaving systems vulnerable to them for much longer. The "advantage" of proprietary code here was that Microsoft got to downplay them (surprise surprise, no scary logo made by Microsoft for them!), and that's how proprietary code owners deal with security issues in general - they try to hide that they exist to keep the illusion that the software is (more) secure.
dijit 11y ago
I love openBSD, it's implementation of certain things is slower (like networking), but it's so clean and well implemented. even if it doesnt' get to play with all the toys (like ZFS) it's what I'd love to default to for application servers/bastion server/firewalls etc; my only qualm with it currently is it's reliance of X11 for ports to work- I don't like install X11 libs on my servers wherever I can avoid it. :\
- adamrt 11y ago
  > my only qualm with it currently is it's reliance of X11 for ports to work- I don't like install X11 libs on my servers wherever I can avoid it. :\ Can you give a reference to this? I'm not doubting you, as I always install x11 anyway, I just didn't know this was still the case. I remember an issue with a lib in xbase.tgz a few years back that was required by lots of ports, but I thought they moved it to base.tgz. Thanks!
  - dijit 11y ago
    http://comments.gmane.org/gmane.os.openbsd.ports/54692 http://comments.gmane.org/gmane.os.openbsd.ports/54692 http://www.openbsd.org/faq/faq15.html#NoFun http://www.openbsd.org/faq/faq15.html#NoFun (at the bottom of this section)
    - adamrt 11y ago
      Good call. I was thinking packages in my head despite you specifically referring to ports. Thanks for following up!
- yellowapple 11y ago
  At least with packages, there are "no-X" versions of most packages available (useful if you don't have X on a machine).
  - dijit 11y ago
    the problem isn't that it's dependant for X11 on packages.. moreso that the port system requires X11 to function.. http://comments.gmane.org/gmane.os.openbsd.ports/54692 http://comments.gmane.org/gmane.os.openbsd.ports/54692 http://www.openbsd.org/faq/faq15.html#NoFun http://www.openbsd.org/faq/faq15.html#NoFun (at the bottom of this section)
dash2 11y ago
For those that know more about OpenBSD than the EU (and I salute you for it), the EU parliament is a fairly powerless institution. Eurocrats show it little respect; one described it as "just one big fucking NGO". Update after reading it: this isn't even an official parliament document or recommendation. It's something by the parliament's research service.
- makeitsuckless 11y ago
  On HN, "the EU" is a fictional European entity which can be anything people want it to be depending on the argument they're trying to make. Excuse the snark, but the wilful ignorance concerning the EU and Europe in favour of ideological posturing makes it near impossible to discuss most relevant topics. Starting with a somewhat misleading headline doesn't help.
- higherpurpose 11y ago
  I don't know about that. It's the EU Parliament that comes up with most of the new EU-wide directives. It's the EU Parliament that defeated ACTA, while the EU Commission was trying its best to pass it. The Commission is generally much more prone to lobbying influence, and perhaps unsurprisingly it also tends to be less democratic as a consequence. The new Commission might not be as bad as the previous one, but it's still too early to decide.
- madez 11y ago
  Between the lines of your comment is a lot of disregard against the EU and the EU parliament. How come so?
- pXMzR2A 11y ago
  Politicians in EU and US call various institutions a "NGO" when they disagree with it and want to ridicule it to intentionally reduce its public reputation. EP is a high reputation organization and has force within the EU structure. Calling an EPRS study "something by the parliament's research service" is not only redundant (EPRS = European Parliament Research Service) but also short-sighted (do you do the same thing to the deliverables by your R&D department?). So, this is an EP study that you can cite in order to support your arguments for switching to free software in your government / school / workplace / home / hobby group.
nagaiah 11y ago
Impetus for BSD
erhardm 11y ago
I like OpenBSD. I like the spirit of the developers, which don't compromise on security. I like the simplicity of the OS, very good documented and very robust. They are prepared to break a ton of software to advance the state of security/correct code. I would like to have OpenBSD on all my machines, but unfortunately their license don't have the "infectious" effect of GPL. From my limited understanding, their license[0] is not a philosophical license like GPL. Linux popularity spread because of the distributed development style(everyone developed in their own tree, Linus decided if it had enough value to get in his tree) and GPL. Even if you don't care on the philosophy of GPL, you can't deny that it helped make a lot of vendors to publish(even if half-hearted) their code which eventually after some cleanup(3rd party or themselves) got into the Linus tree. If OpenBSD would be GPL licensed, I could see a BSD which would be have all the bleeding edge features, but Theo's tree was separate, conservative on features but not lacking on drivers. Men can only dream. I realize that FreeBSD is the bleeding edge of BSD land and I'm not trying to start a license flamewar, but a lot of companies, i.e. graphics, wireless cards, laptop manufactures don't have (good) working drivers for BSD land, at least not published code which goes back to the community. [0] - http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/share/misc/license.template?rev=HEAD http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/share/misc/lice...
- feld 11y ago
  It depends on what you're after, but in some respects I think Dragonfly and NetBSD are bleeding edge in their own ways (filesystem, VM subsystem, networking)
- yellowapple 11y ago
  While it's true that the GPL and the distributed nature of Linux development helped GNU/Linux proliferate, that isn't the reason why the BSDs didn't. In reality, they were encumbered by legal problems due to being derivative works of AT&T's Unix; the ensuing legal war of attrition caused a lot of folks to be unsure of whether or not they could legally use any of the BSDs without having to pony up for Unix licenses. As a result, Linux was created (Linus Torvalds has said that if Hurd existed or if the BSD legality issues were resolved, he wouldn't have felt the need to develop the Linux kernel), and folks jumped onto that as the preferred free Unix due to it being unencumbered by the massive legal warfare taking place in BSD Land (of course, SCO would eventually bring the battle to the GNU/Linux world, but by that point, Linux was already well-entrenched).
lkjsadflkljdsaf 11y ago
Support OpenBSD, but NEVER fork it.. http://www.openbsdfoundation.org/ http://www.openbsdfoundation.org/ http://www.openbsd.org/want.html http://www.openbsd.org/want.html http://www.openbsd.org/donations.html http://www.openbsd.org/donations.html https://www.openbsdstore.com https://www.openbsdstore.com
hackuser 11y ago
> "It is recommended that users install ..." OpenBSD? The EU isn't serious if that's what they mean. It's not really an option for end users. My impression is that even technical users who are new to *nix should start with something more accessible. Does the OpenBSD community even want to deal with a flood of nubes?

352 points by fcambus 11y ago

s_dev 11y ago

Theo De Raadt always complained that many of the institutions that run and use OpenBSD don't contribute back. Good to see the EU at least acknowledging that its something that they should explore. They probably use it and its features more than they realise. I suspect there is a strong political motive as well behind being "technologically independent" after the NSA mass surveillance revelations. I like the sound of an EU BSD fork - hopefully they fund one. We've always been lacking in the Operating Systems dev department over here in Europe. Linux is our main contribution but we can do more.

jkyle 11y ago
> Theo De Raadt always complained that many of the institutions that run and use OpenBSD don't contribute back. Sounds like he needs a different license then.
- deleted 11y ago
  [deleted]
- joshuapants 11y ago
  I don't think that would make them likely to contribute back, they'd just use something else. He'd rather have selfish people using good software than choosing to use something inferior.
  - jkyle 11y ago
    Maybe, maybe not. They'd all do the same sort of cost/benefit assessment and if they deemed the benefit to outweigh the cost of contributing back they would do it. There'd be some who would change their options and some that would become contributors. Hard to say how it would pan out. But, when you select a license like BSD (which I've done myself) you shouldn't complain when users don't contribute back. You selected a license that formally declares your intent and expectations; the user has formally agreed to them.
    - clarry 11y ago
      Actually one's expectation can very well be that people be nice to you even if you're not using legalese to require that of them.
    - s73v3r 11y ago
      I wonder how much of an actual analysis is done in these cases, and how much it's just a boss saying that he doesn't want people "wasting their time" working on something that isn't directly related to their stuff.
  - zanny 11y ago
    Somehow Google, Samsung, and Intel are sticking the Linux kernel in everything despite it being GPL'd and them having to release their modifications. Might have something to do with how reengineering the Linux kernel would cost on the order of billions of dollars in engineer time.
    - mschuster91 11y ago
      Just look at how many Android vendors actually honor the GPL. Even the major vendors tend to mess up their source code dumps, and lots of the Chinese (hi Mediatek) vendors don't even react on emails. Google should require in the vendor license terms for the Android brand and the Play Store that the sources be released on Github.
- tbrownaw 11y ago
  I don't think any of the free/open licenses require users to contribute to the parent project. I don't think any even require that people distributing modified versions, send those modifications back upstream.
  - SixSigma 11y ago
    In fact there was a shitstorm when some licences had "all modifications must be sent upstream" clauses e.g. Plan9's original license had that clause. And then the "tick this box if you don't make nuclear weapons" clause was lambasted in Theo's colourful style [1]. There was a time when OpenBSD were considering moving to the plan9 tool chain - which is now available under both GPL and MIT licensing. That sad part was, most everyone in the plan9 community agreed with him but had their hands tied by Alacatel/Lucent legal and US law. [1] https://groups.google.com/forum/?_escaped_fragment_=topic/comp.os.plan9/0j5Xa_Bu_fs#!topic/comp.os.plan9/0j5Xa_Bu_fs https://groups.google.com/forum/?_escaped_fragment_=topic/co...
  - Someone1234 11y ago
    The GPL kinda-sorta does. I guess it depends on your definition of "contribute back." People that derive from GPL source have to release those changes to the public, which could just be a zip archive on their web-site rather than a git pull request. I guess what I mean is, the company can try to be as unhelpful as possible (e.g. strip comments, place all code into a giant .cpp file, etc) but it does technically have to publish source code regardless.
    - debacle 11y ago
      > People that derive from GPL source have to release those changes to the public This is entirely not true. If I take a GPLed application, download it, modify it, and never distribute it, then I am under no obligation to release the source.
    - cwyers 11y ago
      The GPL requires you to distribute source code in addition to binaries. If you don't distribute binaries (i.e. if you're running the code on your server farm only), then you don't have to distribute anything.
- weland 11y ago
  More often than not, he wasn't referring to contributions in the FSF sense (i.e. people modifying code that they don't send back to the original authors). He simply meant that many of the institutions that run and use OpenBSD, which is available entirely for free, don't give anything in return - be it in the form of code, money, documentation or promotion. Another free license solves only a small proportion of this problem.
  - jkyle 11y ago
    Another free license solves only a small proportion of this problem. True, but with BSD I'm not sure you can view it as a problem to begin with since the license is explicitly designed to legally absolve the user of all obligation to do just that. If you desire monetary contributions be made, some kind of commercial license is the solution. If you desire modifications be contributed back, there are other licenses that cover that expectation. And there's nothing stopping you from creating your own license. If you don't require or expect any contributions back or monetary contributions under any scenarios, then BSD is a great license for that. I'm sure when confronted with a lack of contribution (monetary, labor, code modifications), most companies would reply "Well, yes. That's why we chose software with a BSD license."
    - edejong 11y ago
      There is definitely business value in contributing to these projects. First of all, by contributing, you show a mutual interest in the increased quality of the solution. This in turn will motivate the maintainers to better understand the business concerns of the new contributor. By contributing, the contributor will gain insights in the workings of the solution, thus increasing the quality of the product itself. (As an analogy: by taking apart an amplifier, you increase your understanding of the way the product satisfies your needs). Last but not least, contributing generates good-will, subsequently increasing the probability of adequate answers to support questions.
      - cwyers 11y ago
        There's also a lot of business value in freeriding when the software license explicitly allows you to do so.
- giovannibajo1 11y ago
  TBH a single organization adopting and customizing a GPL software for internal usage isn't forced to contribute back, as GPL affects redistribution not adoption.
- istvan__ 11y ago
  Easy like that?
- pyre 11y ago
  As we've seen with GPL'd code, many companies are happy to skirt the license restrictions if they feel that they can get away with it. How much money and effort would then need to be expended to enforcement of said new license for OpenBSD? How many companies would do a cost/benefit analysis of the likelihood of OpenBSD lawyers suing them, and even then ignore the license if they thought that it would be less expensive to risk a lawsuit? "Change the license" isn't a silver bullet. Companies aren't machines that are fed licenses that they then obey like punch cards into an old IBM machine.
- zkhalique 11y ago
  Actually what he said was: GPL fans said the great problem we would face is that companies would take our BSD code, modify it, and not give back. Nope—the great problem we face is that people would wrap the GPL around our code, and lock us out in the same way that these supposed companies would lock us out. Just like the Linux community, we have many companies giving us code back, all the time. But once the code is GPL'd, we cannot get it back.
- hobarrera 11y ago
  The only licence that will fix this is one that requires payment from users, and that's never going to happen. Things like GPL don't force users to send back contributions unless you redistribute a derivate product (which is not usually the case). Theo is talking about giving something back (an acknowledgement, or even better, money).
belorn 11y ago
"said the great problem we would face is that companies would take our BSD code, modify it, and not give back. − Nope. We have many companies giving us code back, all the time." - Theo De Raadt
- dimitar 11y ago
  If so, then the issue is they don't contribute money?
  - nayden 11y ago
    That used to be a case for a very long time but it is _slowly_ changing. We still mostly rely on contributions by individuals.
- s_dev 11y ago
  You could have easily taken the full quote -- it's not quite the contradiction you're trying to make: "GPL fans said the great problem we would face is that companies would take our BSD code, modify it, and not give back. Nope—the great problem we face is that people would wrap the GPL around our code, and lock us out in the same way that these supposed companies would lock us out. Just like the Linux community, we have many companies giving us code back, all the time. But once the code is GPL'd, we cannot get it back."
  - gillianseed 11y ago
    >Nope—the great problem we face is that people would wrap the GPL around our code, and lock us out in the same way that these supposed companies would lock us out. Does he offer any examples of this happening ?
    - s_dev 11y ago
      The point I think Theo is trying to make is in the open source world you simply have to expect that people will take code - put it under a different licence and modify it - restricting their ability to take back the modified code into OpenBSD. Typically OSS licences allow and tolerate "selfish" behaviour. I don't think I or he needs to back up this claim with examples.
th0br0 11y ago
In general, the EU is _very_ strong on open source commitments. Almost all projects that I know of and some of which I'm working on funded as part of FP7 (Seventh Framework Programme) will eventually end up open-sourced.
- ersii 11y ago
  Interesting! Could you elaborate some more and perhaps list a few projects, if you're allowed to?
  - th0br0 11y ago
    I primarily know about the projects listed at https://www.fokus.fraunhofer.de/809f10db25eddf3e/projects https://www.fokus.fraunhofer.de/809f10db25eddf3e/projects A personal observation is that, nowadays, gitlab seems to be preferred to github as part of a push to rely more on software developed inside the EU (guess it's an aftermath of the whole NSA story). PolicyCompass, for example, lives at https://github.com/policycompass https://github.com/policycompass Carneades lives at http://github.com/carneades http://github.com/carneades MARKOS is up on SF http://markosproject.sourceforge.net/ http://markosproject.sourceforge.net/
    - chupy 11y ago
      Just curious, is that software developed by consultants or by actual EU employees?
      - th0br0 11y ago
        Consultants essentially. There's also some IT development going on by actual EU employees, but the projects I listed above are usually won through tenders often submitted as a joint project by multiple companies/organisations (research partners - i.e. universities -, development partners - i.e. big companies - + public partners - often for demo purposes) although the EU also funds some purely research oriented projects of course.
javert 11y ago
> an EU BSD fork Why fork it? That is completely stupid. Do you want to have the EU version of North Korea's Red Star Linux? Do you want to make it so Google doesn't work properly on EU BSD?
- madez 11y ago
  The EU is not North Korea. A fork would make sense if the EU puts enough man-power into the project and they don't agree with the current leadership.
reddotX 11y ago
minix is/was sponsored by EU http://wiki.minix3.org/doku.php?id=www:documentation:read-more http://wiki.minix3.org/doku.php?id=www:documentation:read-mo...
DasIch 11y ago
The idea of a EU BSD fork sounds terrible. What needs to happen is government funding for key open source infrastructure projects that require it like OpenSSL, OpenBSD, GnuPG, etc.
hobarrera 11y ago
> I like the sound of an EU BSD fork - hopefully they fund one. We've always been lacking in the Operating Systems dev department over here in Europe. There's no need to fork and split manpower, you can contribute to OpenBSD being in Europe.

tormeh 11y ago

The EU also funds Minix 3 development, though that is more about reliability than security.

masklinn 11y ago
The pypy project also benefited from EU grants early in its history.
cbd1984 11y ago
The thing about security is that it touches everything. Ease of use? If something's hard to use, it's easy to confuse people into doing insecure things. Security issue. Unreliable? Security depends on predictable behavior, and failure modes are often unpredictable. Security issue. Proprietary protocol? Even if it wasn't intentionally backdoored, you don't know its real attack surface, because you don't know all of the verbs it contains. Verbs imply actions, actions imply changes of state, changes of state imply the Dark Side... uh, security concerns. Security issue. Performance? Even aside from timing attacks and simple DoSing, things often behave oddly when pushed to a limit, especially if that limit involves otherwise-hidden race conditions. Security issue.
carussell 11y ago
Not anymore. The money from those grants is gone.

andrewstuart2 11y ago

Didn't everyone recommend Linux and Mac OS back when vulnerabilities on these systems just hadn't been discovered (or possibly written) yet? Make OpenBSD popular, add a ton of devs, and attack value, and I'm pretty sure these problems will repeat themselves. I think the second study, which briefly names OpenBSD, does a good job of pointing out that technological changes alone are insufficient.

masklinn 11y ago
Well there's the difference that security is basically the core focus of OpenBSD's development, and the project actively researches and updates development practices with that in mind.
cbd1984 11y ago
Yes, and a Brinks armored truck is just as vulnerable to carjackings as a Ford Pinto, we just don't know about the vulnerability because nobody drives them. People were saying the same things about Linux. In the late 1990s and early 2000s. By which time Linux had already become the de-facto go-to OS for web servers around the world. It was, in short, already a high-value target, and yet the apocalypse didn't occur.
- andrewstuart2 11y ago
  Of course that's true. I'm just not convinced that OpenBSD : Linux :: Armored truck : Pinto. In fact, the point of a good portion of the second study [1], p.17-25 is pointing out the flaws that have occurred in the Linux operating system and other existing technologies. [1]http://www.europarl.europa.eu/RegData/etudes/STUD/2015/527409/EPRS_STU(2015)527409_REV1_EN.pdf http://www.europarl.europa.eu/RegData/etudes/STUD/2015/52740...
  - cbd1984 11y ago
    I never claimed Linux was a Pinto. My point is, some things are just built well, and even if they're not used very often we can expect a certain level of quality, as opposed to saying that the only reason we don't see them stolen is because so few people drive them. Especially if they're used all the damn time, just not in places people see a lot. So some bugs will be found in OpenBSD. That's a given. However, it isn't like OpenBSD is never used, or that the people who made it are bad programmers.

brudgers 11y ago

Link to Part 1 of the study (wherein the recommendation lies): http://www.europarl.europa.eu/RegData/etudes/STUD/2015/527409/EPRS_STU(2015)527409_REV1_EN.pdf http://www.europarl.europa.eu/RegData/etudes/STUD/2015/52740... Part 2 of the study recommends government funding of Open Source Projects: http://www.europarl.europa.eu/RegData/etudes/STUD/2015/527410/EPRS_STU(2015)527410_REV1_EN.pdf http://www.europarl.europa.eu/RegData/etudes/STUD/2015/52741... Potential and actual conflicts of interest between governments and citizens in regard to privacy are not addressed.

k-mcgrady 11y ago
They don't address conflicts of interest but it seems like they're fine with privacy: "[...] the use of open source computer operating systems and applications reduces the risk of privacy intrusion by mass surveillance. They seem to be touting that as a benefit, not a drawback.
- brudgers 11y ago
  When the same governments are funding signals intelligence gathering with one hand and open source software development with the other, there is potential conflict of interest, if not actual conflict. The NSA's role in weakening open source encryption standards was the result of the internal logic by which all intelligence organs typically operate irrespective of sponsoring state. The differences between the politics of some EU states and the politics of the US or Russia or the UK don't change that internal logic of intelligence organs. Their job remains to maintain data collection capability.
  - k-mcgrady 11y ago
    And with OSS we can see when the create back doors or modify the code. We can see what the modifications do. And if they are doing anything wrong we can revert the changes and publicise it. Following on from your thinking, what is their angle here? On the surface it seems more difficult to exploit OSS but is there something they can do with it that users won't know about and is easier to exploit?

corv 11y ago

The study also recommends Qubes and Tails.

_lce0 11y ago

Nice to see recognition from the trenches of bureaucracy. It's really nice that they can write such statement. Kudos to the OpenBSD team!

nbevans 11y ago

"[...] the use of open source computer operating systems and applications reduces the risk of privacy intrusion by mass surveillance. Open source software is not error free, or less prone to errors than proprietary software, the experts write. But proprietary software does not allow constant inspection and scrutiny by a large community of experts." That worked great for OpenSSL didn't it? ;)

th0waway 11y ago
Yep, the issue was fixed (even though it took a while).
- yellowapple 11y ago
  And by "a while", one means "a few days after discovery" (a few months after it was introduced, but that's actually not terrible, all things considered).
  - nbevans 11y ago
    Fact check: It was introduced years priors to discovery, not mere months.
    - yellowapple 11y ago
      Thanks for the fact check! Looks like it was indeed committed to OpenSSL about 2 1/2 years prior.
higherpurpose 11y ago
Microsoft has had 2 Heartbleed-level vulnerabilities in its Windows code so far, that were not just 2-3 years old but 10+ years old, leaving systems vulnerable to them for much longer. The "advantage" of proprietary code here was that Microsoft got to downplay them (surprise surprise, no scary logo made by Microsoft for them!), and that's how proprietary code owners deal with security issues in general - they try to hide that they exist to keep the illusion that the software is (more) secure.

dijit 11y ago

I love openBSD, it's implementation of certain things is slower (like networking), but it's so clean and well implemented. even if it doesnt' get to play with all the toys (like ZFS) it's what I'd love to default to for application servers/bastion server/firewalls etc; my only qualm with it currently is it's reliance of X11 for ports to work- I don't like install X11 libs on my servers wherever I can avoid it. :\

adamrt 11y ago
> my only qualm with it currently is it's reliance of X11 for ports to work- I don't like install X11 libs on my servers wherever I can avoid it. :\ Can you give a reference to this? I'm not doubting you, as I always install x11 anyway, I just didn't know this was still the case. I remember an issue with a lib in xbase.tgz a few years back that was required by lots of ports, but I thought they moved it to base.tgz. Thanks!
- dijit 11y ago
  http://comments.gmane.org/gmane.os.openbsd.ports/54692 http://comments.gmane.org/gmane.os.openbsd.ports/54692 http://www.openbsd.org/faq/faq15.html#NoFun http://www.openbsd.org/faq/faq15.html#NoFun (at the bottom of this section)
  - adamrt 11y ago
    Good call. I was thinking packages in my head despite you specifically referring to ports. Thanks for following up!
yellowapple 11y ago
At least with packages, there are "no-X" versions of most packages available (useful if you don't have X on a machine).
- dijit 11y ago
  the problem isn't that it's dependant for X11 on packages.. moreso that the port system requires X11 to function.. http://comments.gmane.org/gmane.os.openbsd.ports/54692 http://comments.gmane.org/gmane.os.openbsd.ports/54692 http://www.openbsd.org/faq/faq15.html#NoFun http://www.openbsd.org/faq/faq15.html#NoFun (at the bottom of this section)

dash2 11y ago

For those that know more about OpenBSD than the EU (and I salute you for it), the EU parliament is a fairly powerless institution. Eurocrats show it little respect; one described it as "just one big fucking NGO". Update after reading it: this isn't even an official parliament document or recommendation. It's something by the parliament's research service.

makeitsuckless 11y ago
On HN, "the EU" is a fictional European entity which can be anything people want it to be depending on the argument they're trying to make. Excuse the snark, but the wilful ignorance concerning the EU and Europe in favour of ideological posturing makes it near impossible to discuss most relevant topics. Starting with a somewhat misleading headline doesn't help.
higherpurpose 11y ago
I don't know about that. It's the EU Parliament that comes up with most of the new EU-wide directives. It's the EU Parliament that defeated ACTA, while the EU Commission was trying its best to pass it. The Commission is generally much more prone to lobbying influence, and perhaps unsurprisingly it also tends to be less democratic as a consequence. The new Commission might not be as bad as the previous one, but it's still too early to decide.
madez 11y ago
Between the lines of your comment is a lot of disregard against the EU and the EU parliament. How come so?
pXMzR2A 11y ago
Politicians in EU and US call various institutions a "NGO" when they disagree with it and want to ridicule it to intentionally reduce its public reputation. EP is a high reputation organization and has force within the EU structure. Calling an EPRS study "something by the parliament's research service" is not only redundant (EPRS = European Parliament Research Service) but also short-sighted (do you do the same thing to the deliverables by your R&D department?). So, this is an EP study that you can cite in order to support your arguments for switching to free software in your government / school / workplace / home / hobby group.

nagaiah 11y ago

Impetus for BSD

erhardm 11y ago

I like OpenBSD. I like the spirit of the developers, which don't compromise on security. I like the simplicity of the OS, very good documented and very robust. They are prepared to break a ton of software to advance the state of security/correct code. I would like to have OpenBSD on all my machines, but unfortunately their license don't have the "infectious" effect of GPL. From my limited understanding, their license[0] is not a philosophical license like GPL. Linux popularity spread because of the distributed development style(everyone developed in their own tree, Linus decided if it had enough value to get in his tree) and GPL. Even if you don't care on the philosophy of GPL, you can't deny that it helped make a lot of vendors to publish(even if half-hearted) their code which eventually after some cleanup(3rd party or themselves) got into the Linus tree. If OpenBSD would be GPL licensed, I could see a BSD which would be have all the bleeding edge features, but Theo's tree was separate, conservative on features but not lacking on drivers. Men can only dream. I realize that FreeBSD is the bleeding edge of BSD land and I'm not trying to start a license flamewar, but a lot of companies, i.e. graphics, wireless cards, laptop manufactures don't have (good) working drivers for BSD land, at least not published code which goes back to the community. [0] - http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/share/misc/license.template?rev=HEAD http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/share/misc/lice...

feld 11y ago
It depends on what you're after, but in some respects I think Dragonfly and NetBSD are bleeding edge in their own ways (filesystem, VM subsystem, networking)
yellowapple 11y ago
While it's true that the GPL and the distributed nature of Linux development helped GNU/Linux proliferate, that isn't the reason why the BSDs didn't. In reality, they were encumbered by legal problems due to being derivative works of AT&T's Unix; the ensuing legal war of attrition caused a lot of folks to be unsure of whether or not they could legally use any of the BSDs without having to pony up for Unix licenses. As a result, Linux was created (Linus Torvalds has said that if Hurd existed or if the BSD legality issues were resolved, he wouldn't have felt the need to develop the Linux kernel), and folks jumped onto that as the preferred free Unix due to it being unencumbered by the massive legal warfare taking place in BSD Land (of course, SCO would eventually bring the battle to the GNU/Linux world, but by that point, Linux was already well-entrenched).

lkjsadflkljdsaf 11y ago

Support OpenBSD, but NEVER fork it.. http://www.openbsdfoundation.org/ http://www.openbsdfoundation.org/ http://www.openbsd.org/want.html http://www.openbsd.org/want.html http://www.openbsd.org/donations.html http://www.openbsd.org/donations.html https://www.openbsdstore.com https://www.openbsdstore.com

hackuser 11y ago

> "It is recommended that users install ..." OpenBSD? The EU isn't serious if that's what they mean. It's not really an option for end users. My impression is that even technical users who are new to *nix should start with something more accessible. Does the OpenBSD community even want to deal with a flood of nubes?