OpenBSD 6.7(marc.info)
marc.info
OpenBSD 6.7
https://marc.info/?l=openbsd-announce&m=158989783626149&w=2
110 comments
That's an impressive changelog. I'm excited about the new ARM SBC drivers and seemingly improved RPKI flow for OpenBGPd. I should try running a toy route server on an RPi4 with OpenBSD/OpenBGPd, or a full DFZ router.
Here’s the download page and poster. https://www.openbsd.org/67.html
Looks like a great release, thank you.
OpenBSD is one of the last really good choices for an operating system, in my opinion. Redhat, the pretentious gnome developers, canonicals latest folly, proliferation of systemd cancer (homed being the latest abomination)... All these things take away from the user's freedom.
I hope OpenBSD continues for decades to come.
OpenBSD is one of the last really good choices for an operating system, in my opinion. Redhat, the pretentious gnome developers, canonicals latest folly, proliferation of systemd cancer (homed being the latest abomination)... All these things take away from the user's freedom.
I hope OpenBSD continues for decades to come.
Thank you! I installed OpenBSD again this year after I rage-quit Ubuntu. It is a delightfully clean OS where the important things just work.
Highly recommended for everyone to try out.
Highly recommended for everyone to try out.
I have a co-worker who describe OpenBSD as: "The least stupid operation system you can install".
Just curious, did he really say "operation system" or was that a typo/auto correct thing in your post?
I ask because I had a coworker/friend years ago from Ukraine and that's what he called it. My other friend and I who worked with him could not get him to say operating system no matter how much we poked at him. Anyway, just like the article itself you brought back a flood of memories so just curious like I said.
I ask because I had a coworker/friend years ago from Ukraine and that's what he called it. My other friend and I who worked with him could not get him to say operating system no matter how much we poked at him. Anyway, just like the article itself you brought back a flood of memories so just curious like I said.
I've played with OpenBSD on a VM a couple times and really liked it, but I'd like to use it on real hardware and try and force myself to use it as my main personal system at least for a while as an experiment.
I've often heard that Thinkpads make great OpenBSD laptops. Are there any models in particular the HN crowd would recommend? In terms of my hardware needs, I don't really care about graphics like you'd get with an Nvidia card, but I do need wi-fi since it'd be really hard to set up a wired connection to my router in my current apartment.
I've often heard that Thinkpads make great OpenBSD laptops. Are there any models in particular the HN crowd would recommend? In terms of my hardware needs, I don't really care about graphics like you'd get with an Nvidia card, but I do need wi-fi since it'd be really hard to set up a wired connection to my router in my current apartment.
I've had great luck with T-series ThinkPads. I'm using a T520 as a daily driver at the moment and I've had no real issues with it. I installed it on an E series laptop a while ago and had issues with sound (this was a few versions ago, probably 6.3, and I was just playing around at the time so I never figured out what the problem was).
Mind you I use this mainly for work so my needs are simple, an editor, a browser, a compiler and the like. The default window manager cwm makes for a simple "desktop" for me and the only thing I use at the moment for work that's not from base is mariadb, vim and firefox (plus dependencies of course). So I don't have a lot of splashy graphics to load or anything like that and don't do video or image editing very often. But even if you do need more, the package repository has a huge selection of programs and in my experience they all just work when installed.
On the other hand I put Battle for Wesnoth on it and although that's not really a very graphics intense game it runs great on the laptop.
Overall I really like using it day to day.
Mind you I use this mainly for work so my needs are simple, an editor, a browser, a compiler and the like. The default window manager cwm makes for a simple "desktop" for me and the only thing I use at the moment for work that's not from base is mariadb, vim and firefox (plus dependencies of course). So I don't have a lot of splashy graphics to load or anything like that and don't do video or image editing very often. But even if you do need more, the package repository has a huge selection of programs and in my experience they all just work when installed.
On the other hand I put Battle for Wesnoth on it and although that's not really a very graphics intense game it runs great on the laptop.
Overall I really like using it day to day.
> The default window manager cwm
Just a slight correction, if you meant the "default" as in the window manager that starts on a freshly installed system: It's not cwm but fvwm. With that said, OpenBSD ships with cwm and it's trivial to switch between the two, but they are very different.
Just a slight correction, if you meant the "default" as in the window manager that starts on a freshly installed system: It's not cwm but fvwm. With that said, OpenBSD ships with cwm and it's trivial to switch between the two, but they are very different.
Oh, you're right, I'd forgotten that. I think it's so ingrained in me to copy my dotfiles to a new machine before I do much else that I don't usually ever see fvwm. I always add myself to doas, move some public keys around, install a few packages and then copy my dotfiles before I ever launch X for the first time.
And yes, they are very different. I remember using fvwm fondly on Slackware Linux back in the mid 90's. I had hours of fun trying to configure it to look like Windows 95 and populating menus, all in a plain text file, no gui config available! I think I read somewhere recently that fvwm is still Theo's preferred WM and that's why it's the default...
And yes, they are very different. I remember using fvwm fondly on Slackware Linux back in the mid 90's. I had hours of fun trying to configure it to look like Windows 95 and populating menus, all in a plain text file, no gui config available! I think I read somewhere recently that fvwm is still Theo's preferred WM and that's why it's the default...
> I remember using fvwm fondly on Slackware Linux back in the mid 90's.
Same, well late 90s here, and yep that was my go-to on Slackware, mostly because it was quite usable out of the box. I eventually went to Blackbox, then Fluxbox, then Gnome about six months before Pat decided to stop shipping it. I went to Xfce from there and never looked back (I never liked KDE before Plasma, and 4.x is still the default in Slackware).
Same, well late 90s here, and yep that was my go-to on Slackware, mostly because it was quite usable out of the box. I eventually went to Blackbox, then Fluxbox, then Gnome about six months before Pat decided to stop shipping it. I went to Xfce from there and never looked back (I never liked KDE before Plasma, and 4.x is still the default in Slackware).
Thinkpad X series are very popular among openbsd devs.
I recommend a second-hand x210/x220/x230/x240... works great.
@jcs tests popular laptop models on his blog: jcs.org
@jcs tests popular laptop models on his blog: jcs.org
The lack of any kind of bluetooth support is an instant blocker for me - but it works great as a server OS.
I think bluetooth might work with a few specific adapters, pretty sure there was a comment saying as much in the “Carmack helping OpenBSD” thread yesterday. So I guess that, if you’re willing to sacrifice a USB port or two, it could work.
My reservations are more about sleep (even Linux still struggles with that) and power management (ditto). If my daily driver were a tower desktop, I’d probably use OpenBSD.
My reservations are more about sleep (even Linux still struggles with that) and power management (ditto). If my daily driver were a tower desktop, I’d probably use OpenBSD.
I've been using OpenBSD in my X230 for over a year now and everything works out of the box. Sleep never fails, power management needs one extra daemon up, integrated WWAN module just works with ifconfig...
I have a desktop computer with Linux just because there is certain software I need for my work. But hardware support with OpenBSD and ThinkPads will for sure be a smoother experience compared to many Linux distros.
I have a desktop computer with Linux just because there is certain software I need for my work. But hardware support with OpenBSD and ThinkPads will for sure be a smoother experience compared to many Linux distros.
Bluetooth will not work with OpenBSD because they trow the complete stack out of the operation-system (too buggy, too insecure)
T450s worked flawlessly. Any of the Thinkpads that you see on eBay being retired by corporations and refurbished for $200-$500USD would be great candidates.
My gen 5 X1 Carbon works quite well...
Yesterday, out of sheer coincidence, I thought, you know what "lets check out OpenBSD again". Went to the homepage, saw the last 6.6 release was 6 months ago, and thought Hmm thats kinda old. Trawled around on the mirror sites to download it, and found version 6.7 files were there - a full day early! Not even timezones could explain it. Release date: May 19. So I downloaded it.
I made my first router with OpenBSD back in 2001, for a job, it was great! But I got fired for it, because the boss didn't understand how to use a command line...
I really love the OpenBSD documentation myself though. And how the whole system is made a way that they want you to understand what its doing. And a certain nostalgia over all the familiar components that still feel the same. Its like a time machine. I was transported to the year 2001 when I made that first router all over again, or earlier. It has that familiar smell to it. Like a grandma cooking with the same recipe for 25 years. Initial Version 1.1 = 18 October 1995
Now I'm going to investigate using OpenBSD as a GUI desktop, but I have concerns about Xenocara/X11/Xorg/Xfree86, (idk what to call it) being insecure: root perms, keyloggers, etc. Can anyone speak on that ? Has OpenBSD been fixed itself, or is it still using the same flawed codebase. Are there plans to move to Wayland?
I made my first router with OpenBSD back in 2001, for a job, it was great! But I got fired for it, because the boss didn't understand how to use a command line...
I really love the OpenBSD documentation myself though. And how the whole system is made a way that they want you to understand what its doing. And a certain nostalgia over all the familiar components that still feel the same. Its like a time machine. I was transported to the year 2001 when I made that first router all over again, or earlier. It has that familiar smell to it. Like a grandma cooking with the same recipe for 25 years. Initial Version 1.1 = 18 October 1995
Now I'm going to investigate using OpenBSD as a GUI desktop, but I have concerns about Xenocara/X11/Xorg/Xfree86, (idk what to call it) being insecure: root perms, keyloggers, etc. Can anyone speak on that ? Has OpenBSD been fixed itself, or is it still using the same flawed codebase. Are there plans to move to Wayland?
> Are there plans to move to Wayland?
As far as I know, the difficulty on OpenBSD would be input. The Wayland world relies on evdev, so they either have to patch it to use their interfaces, or implement evdev.
On FreeBSD, we have a lot of devices supporting evdev :) Including the next generation HID stack: https://github.com/wulf7/iichid (currently external, but would be merged into the system eventually)
Also there's device discovery, for which we use https://github.com/FreeBSDDesktop/libudev-devd to pretend to be udev, but I suspect the OpenBSD people might not like solutions like that :D (Actually, does OpenBSD even have anything devd-like that provides hotplug notifications?)
As far as I know, the difficulty on OpenBSD would be input. The Wayland world relies on evdev, so they either have to patch it to use their interfaces, or implement evdev.
On FreeBSD, we have a lot of devices supporting evdev :) Including the next generation HID stack: https://github.com/wulf7/iichid (currently external, but would be merged into the system eventually)
Also there's device discovery, for which we use https://github.com/FreeBSDDesktop/libudev-devd to pretend to be udev, but I suspect the OpenBSD people might not like solutions like that :D (Actually, does OpenBSD even have anything devd-like that provides hotplug notifications?)
Very helpful thank you. I believe you are correct on all fronts. Does anyone know if "their interfaces" prevent the Xorg/Xinput keylogger "bug" as is, even without EVdev or Udev? The man page seems like it does use Xinput, but it also mentions Xwayland https://man.openbsd.org/xinput.1
So I think that if Wayland does work, that interface would take care of the issue.
I am in the middle of something else or I would try and figure it out myself, but it would take a long time.
No, the "xorg keylogger" issue has nothing to do with the low level stuff (evdev is how the windowing system gets info from the kernel, udev is how the windowing system enumerates devices and gets hotplug notifications). The "xorg keylogger" issue is a fundamental property of the X11 protocol, it's between the server and clients — all clients get enormous amounts of access to all kinds of global state over the X11 socket.
> Went to the homepage, saw the last 6.6 release was 6 months ago, and thought Hmm thats kinda old.
OpenBSD has done a release every 6 months for ~23 years.
I really don't understand comments around here where they look at a repo and say "hmmm, no updates in a while, it must be bad". There is really crappy software that updates frequently. It isn't evidence of anything. Many people are capable of committing total garbage every week, and this would satisfy your check. OpenBSD with its 6 month release schedule does pretty well by comparison with a lot of other projects.
> but I have concerns about Xenocara/X11/Xorg/Xfree86, (idk what to call it) being insecure: root perms
Pretty sure that X doesn't run as root on OpenBSD.
OpenBSD has done a release every 6 months for ~23 years.
I really don't understand comments around here where they look at a repo and say "hmmm, no updates in a while, it must be bad". There is really crappy software that updates frequently. It isn't evidence of anything. Many people are capable of committing total garbage every week, and this would satisfy your check. OpenBSD with its 6 month release schedule does pretty well by comparison with a lot of other projects.
> but I have concerns about Xenocara/X11/Xorg/Xfree86, (idk what to call it) being insecure: root perms
Pretty sure that X doesn't run as root on OpenBSD.
I didnt say it was bad... I said, I was surprised given there is a 6 month schedule, that I randomly decided to check exactly 1 day before said schedule, and yet it was still secretly available.
I don't think it runs as root either, I'm more concerned about xinput and keyloggers running as my normal user being able to snoop on even sudo/su prompts running as root in a GUI terminal window running as my user. You know about this right? https://theinvisiblethings.blogspot.com/2011/04/linux-securi... Wayland was supposed to prevent this, but I don't think its going well on OpenBSD. Does OpenBSD have a solution for this?
Ah ok. I misunderstood for a common comment trope I see around here. Apologies.
Yes I am aware that it's relatively easy to write a keylogger for X.
Yes I am aware that it's relatively easy to write a keylogger for X.
>root perms
My X server under OBSD is currently running as the _x11 user.
>keyloggers
I haven't heard about anything like that for X. Wouldn't any attempts to sandbox the ttys mess things that used them up in various ways? X is at heart a terminal oriented system. What are you trying to accomplish here? Normally it turns out that it is fairly futile to attempt to isolate tasks running as the same user from one another under the Unix security model.
My X server under OBSD is currently running as the _x11 user.
>keyloggers
I haven't heard about anything like that for X. Wouldn't any attempts to sandbox the ttys mess things that used them up in various ways? X is at heart a terminal oriented system. What are you trying to accomplish here? Normally it turns out that it is fairly futile to attempt to isolate tasks running as the same user from one another under the Unix security model.
I can’t really speak to the security of the desktop components, but I just wanted to chime in and say that I tried the same thing recently. I use KDE, and the version that ships on OpenBSD is old. From what I get, if you want KDE you use FreeBSD, and if you want Gnome you use OpenBSD.
>I have concerns about Xenocara/X11/Xorg/Xfree86, (idk what to call it) being insecure: root perms, keyloggers, etc. Can anyone speak on that ? Has OpenBSD been fixed itself, or is it still using the same flawed codebase. Are there plans to move to Wayland?
No, of course not. At this point no implementation is secure enough to compete with Xenocara anyway. OpenBSD isn't shooting to be a Linux desktop OS, so if you want Wayland, Pulse, SystemD, and the like you'll simply just have to stick with the fast-moving experimental OS's where they test new, unproven things like those listed above.
Is there even any software for Wayland yet?
No, of course not. At this point no implementation is secure enough to compete with Xenocara anyway. OpenBSD isn't shooting to be a Linux desktop OS, so if you want Wayland, Pulse, SystemD, and the like you'll simply just have to stick with the fast-moving experimental OS's where they test new, unproven things like those listed above.
Is there even any software for Wayland yet?
Will OpenBSD 6.5 from this day no longer receive security patches?
Yes. Only the two most recent OpenBSD releases receive security and reliability fixes for the base system. [1]
[1] - https://www.openbsd.org/faq/faq5.html#Flavors
[1] - https://www.openbsd.org/faq/faq5.html#Flavors
If you like the OpenBSD artwork poster - you can support future OpenBSD artists through the merch shop at https://openbsdstore.com/
Just another OpenBSD developer chiming in that this is the official store link; profits from the sales go towards paying artists for the next release.
The artwork for 6.7 was done by Jonni Phillips!
The artwork for 6.7 was done by Jonni Phillips!
I wish I knew about this for 6.5!
They have BSD music!!
I just upgraded. What is this 'dt'? The mail linked here says there should be a bt(5), but https://www.openbsd.org/67.html says dt(5). In either case neither exists on my new 6.7 system. Nor does btrace(5), which dt(4) references.
The phrasing is a little odd but only the driver dt(4) is part of the 6.7 release. The language bt(5) and userland tool btrace(8), whilst in tree, are not part of this release. The following mailing list posts give an introduction to these components.
https://marc.info/?l=openbsd-tech&m=157920008000433&w=2
https://marc.info/?l=openbsd-tech&m=157920081500935&w=2
https://marc.info/?l=openbsd-tech&m=157920008000433&w=2
https://marc.info/?l=openbsd-tech&m=157920081500935&w=2
This is the kernel part of the dynamic profiling/tracing framework created by Martin Pieuchot (mpi@), unfortunately the userland parts btrace(8) (and the bt(5) manual) were not linked to the build for the 6.7 release, so those manuals are not available online.
Besides mailing list postings, there isn't too much available for now. But btrace(8) & bt(5) together describe a utility and language that's supposed to be compatible with Linux bpftrace (but an entirely different implementation).
Besides mailing list postings, there isn't too much available for now. But btrace(8) & bt(5) together describe a utility and language that's supposed to be compatible with Linux bpftrace (but an entirely different implementation).
Does anyone know if IPsec IKEv2 daemon can send multiple certificates (chain)? I tried to setup IPsec VPN with Letsencrypt certificate, but ultimately failed, because OpenBSD only sent leaf certificate and Windows failed to recognize it without intermediate. It works for me with strongswan in Linux.
Related to this, it doesn't appear that you can set up traffic selectors with this daemon with as much flexibility as you can with StrongSwan.
For example, I need traffic selectors that look like this (StrongSwan ipsec.conf):
[0] https://man.openbsd.org/iked.conf.5
For example, I need traffic selectors that look like this (StrongSwan ipsec.conf):
leftsubnet=192.168.11.0/24,192.168.10.0/24
rightsubnet=10.0.2.0/24,10.0.1.0/24,10.0.3.0/24
[0] https://man.openbsd.org/iked.conf.5
havent tried this - but is your iked(8) cert file the full chain or just the leaf?
if just leaf, maybe try with full?
also haven't tried, but looks like the built in acme-client(1) can be configured to save the full chain if you're using that for the cert issuing stuff (acme-client.conf(5))
if just leaf, maybe try with full?
also haven't tried, but looks like the built in acme-client(1) can be configured to save the full chain if you're using that for the cert issuing stuff (acme-client.conf(5))
Yes, I tried different variations and even tried to dig into sources, it seemed at that moment, that it only sends a single certificate. That was 2-3 years ago, I think, so may be that changed.
If you have already 6.6, you can upgrade by running:
doas sysupgrade
I miss not having new release songs.
if you want to record one for the project, let me know! :)
prgmr.com has updated it's openbsd installer version to 6.7.
We were a bit surprised to see "Fixed softraid(4) CRYPTO volumes on 4K-sector disks" in the release notes. We don't have any 4k logical sector drives but for some reason I thought that was reasonably common in consumer drives these days.
We were a bit surprised to see "Fixed softraid(4) CRYPTO volumes on 4K-sector disks" in the release notes. We don't have any 4k logical sector drives but for some reason I thought that was reasonably common in consumer drives these days.
Probably opening Pandora‘s box here, but I‘ve been wondering for a long time: why do people still use BSD? If memory serves me right, the *BSDs descend from the original Berkeley Unix from the 70s - but why stick to that „line of descent“ rather than going with the newer, Linux, line?
Why did Apple choose BSD and not Linux?
Why did Netflix choose BSD and not Linux?
Licensing is often a factor.
The reasons however will not be the same for everyone.
There are more similarities than differences between the two, however one difference IMO is that BSD has a level of "quality control", especially over the userland, that Linux does not. I find that my own sensibilities as a user align better with the relatively small number of people doing "quality control" and development for BSD projects than with the enormous number of people who work on Linux -- for me, the number of Linux contributors is too many to keep track of and I find it difficult to understand what all of their sensibilities are.
Why did Netflix choose BSD and not Linux?
Licensing is often a factor.
The reasons however will not be the same for everyone.
There are more similarities than differences between the two, however one difference IMO is that BSD has a level of "quality control", especially over the userland, that Linux does not. I find that my own sensibilities as a user align better with the relatively small number of people doing "quality control" and development for BSD projects than with the enormous number of people who work on Linux -- for me, the number of Linux contributors is too many to keep track of and I find it difficult to understand what all of their sensibilities are.
Well the answer why Apple chose BSD is pretty simple...license and maturity.
But Netflix chose it because of that: https://www.youtube.com/watch?v=KP_bKvXkoC4
But Netflix chose it because of that: https://www.youtube.com/watch?v=KP_bKvXkoC4
Whatsapp chose BSD too
Good example. There are so many, not all of them are made public.
Use it for what? What does Netflix use bsd for?
For the CDN (the thing that streams the Contend to You):
https://openconnect.netflix.com/en/appliances/
Because it's stable, it works all the time, no systemd, no surprises, no bullshit.
Not that Linux (the kernel) is any worse, but userspace is developed separately and it's not as slick. We're also using openSuSE Leap, Debian and Ubuntu on the desktop. Probably going to ditch the last one in favour of Debian thanks to the snap ecosystem.
Not that Linux (the kernel) is any worse, but userspace is developed separately and it's not as slick. We're also using openSuSE Leap, Debian and Ubuntu on the desktop. Probably going to ditch the last one in favour of Debian thanks to the snap ecosystem.
Why go for the unproven, when the old, reliable also is freely available :-) ?
I think part of the reason is non-technical.
Some companies won’t use Linux in their hardware because of its license.
Similarly, some developers prefer working on BSD-licensed over working on GPL-licensed software. Some may also like working on systems with fewer developers, so that they can have greater impact on the direction of development.
I think part of the reason is non-technical.
Some companies won’t use Linux in their hardware because of its license.
Similarly, some developers prefer working on BSD-licensed over working on GPL-licensed software. Some may also like working on systems with fewer developers, so that they can have greater impact on the direction of development.
This is a classic that may help you understand better why some people choose BSDs: http://www.over-yonder.net/~fullermd/rants/bsd4linux/01
Also, there are still new things being invented for BSDs (and Illumos) that aren't available in Linux. E.g. FreeBSD has Jails and Illumos has Zones which provide a complete solution for "containers" which are put together from different components in Linux which overall may not be as secure as Illumos Zones. Another one is the PF firewall. In OpenBSD they introduced security features like pledge and unveil.
Another thing is ZFS:
- on Linux there are legal problems with shipping it out of the box;
- it's far more popular on FreeBSD and Illumos than on Linux, so it wouldn't surprise me if there are bugs that will show up on Linux, but not on the other two.
Also, there are still new things being invented for BSDs (and Illumos) that aren't available in Linux. E.g. FreeBSD has Jails and Illumos has Zones which provide a complete solution for "containers" which are put together from different components in Linux which overall may not be as secure as Illumos Zones. Another one is the PF firewall. In OpenBSD they introduced security features like pledge and unveil.
Another thing is ZFS:
- on Linux there are legal problems with shipping it out of the box;
- it's far more popular on FreeBSD and Illumos than on Linux, so it wouldn't surprise me if there are bugs that will show up on Linux, but not on the other two.
I'm posting this as someone who runs and enjoys both FreeBSD/OpenBSD: there are good reasons for running *BSD these days, but the ones you listed have lost a lot of their value.
Regarding the Illumos/FreeBSD "trifecta" of zones/jails, ZFS, and DTrace - I prefer LXC, I treat laptops/workstations like cattle and only run FreeBSD+ZFS where its needed, and I don't need DTrace.
Brendan Gregg can elaborate on these topics much better than I can, and his words probably carry more weight, given his involvement with Illumos: http://www.brendangregg.com/blog/2017-09-05/solaris-to-linux...
Regarding the Illumos/FreeBSD "trifecta" of zones/jails, ZFS, and DTrace - I prefer LXC, I treat laptops/workstations like cattle and only run FreeBSD+ZFS where its needed, and I don't need DTrace.
Brendan Gregg can elaborate on these topics much better than I can, and his words probably carry more weight, given his involvement with Illumos: http://www.brendangregg.com/blog/2017-09-05/solaris-to-linux...
I'm sorry you're being downvoted - it seems to be a question in good faith, there isn't a singular, obvious answer, and I think you'll get some good answers.
For me, I use it for things that I want to be simple or unencumbered from licensing. Any sort of storage server in my house gets FreeBSD almost automatically. OpenBSD, I keep around mainly as a learning experience - it's really a simple, well-documented operating system, and it works flawlessly on a number of different Thinkpads. There are also plenty of opportunities to participate in the development of the OS itself or its packages.
For me, I use it for things that I want to be simple or unencumbered from licensing. Any sort of storage server in my house gets FreeBSD almost automatically. OpenBSD, I keep around mainly as a learning experience - it's really a simple, well-documented operating system, and it works flawlessly on a number of different Thinkpads. There are also plenty of opportunities to participate in the development of the OS itself or its packages.
This was not meant derogatorily, to whoever downvoted me... I‘m honestly interested. Obviously there has to be some advantage, otherwise it would have died out by now. I just don‘t know what that advantage is, never having used it myself.
OpenBSD specifically has a very strong focus on security features - not just bolt-ons like containers and cgroups, but a code and development style which reduces the change of security-related bugs, and things like pledge(2) and unveil(2) which allow applications to reduce their privileges drastically through a far simpler interface than Linux's equivalents.
Alternatives always exist and should exist. Monocultures are bad! :P
The community has existed for ages and it's not dying out because.. why would it? People just want to work on it for various reasons.
From my perspective: it's easy to modify FreeBSD and contribute to upstream, the "monorepo" thing with keeping libc and the basic utilities developed together with the kernel is nice (no stupid "glibc devs don't want to make new syscall wrappers" situations lol), the kernel is less complex than Linux, and has made different (better) technical decisions in many cases (kqueue got pretty much everything right around 2000 while it took epoll and friends years to not suck; ALSA is.. baffling while FreeBSD's sound system is good; Capsicum is the right model for app self-sandboxing; "udev populates /dev by symlinking stuff from /sys" is nuts; jails are really hard to screw up, unlike the overly flexible linux namespaces; …)
From my perspective: it's easy to modify FreeBSD and contribute to upstream, the "monorepo" thing with keeping libc and the basic utilities developed together with the kernel is nice (no stupid "glibc devs don't want to make new syscall wrappers" situations lol), the kernel is less complex than Linux, and has made different (better) technical decisions in many cases (kqueue got pretty much everything right around 2000 while it took epoll and friends years to not suck; ALSA is.. baffling while FreeBSD's sound system is good; Capsicum is the right model for app self-sandboxing; "udev populates /dev by symlinking stuff from /sys" is nuts; jails are really hard to screw up, unlike the overly flexible linux namespaces; …)
The lines of descent are not etched as deep as you suggest.
> BSDs descend from the original Berkeley Unix from the 70s
But they continue to be worked on. To wit, this announcement.
> the newer, Linux, line
Linux did not pop into existence. It traces its heritage too all the way back to Unix, which traces its way to MULTICS, which traces...
"The success of UNIX lies not so much in new inventions but rather in the full exploitation of a carefully selected set of fertile ideas..." --- Dennis Ritchie and Ken Thompson
> BSDs descend from the original Berkeley Unix from the 70s
But they continue to be worked on. To wit, this announcement.
> the newer, Linux, line
Linux did not pop into existence. It traces its heritage too all the way back to Unix, which traces its way to MULTICS, which traces...
"The success of UNIX lies not so much in new inventions but rather in the full exploitation of a carefully selected set of fertile ideas..." --- Dennis Ritchie and Ken Thompson
[deleted]
Where can I find a recent unbiased analysis of OpenBSD vs Debian security?
Here's a recent talk evaluating OpenBSD's security mitigations: https://www.youtube.com/watch?v=3E9ga-CylWQ
The objectivity of it is up to debate though, some argue that it is biased/unfair.
The objectivity of it is up to debate though, some argue that it is biased/unfair.
Thanks!
How does security of OpenBSD compare to modern hardened cloud OS kernels?
Sort of depends on how you look at it. A shitty, misconfigured install of MySQL on an OpenBSD box won't automatically become secure. And the default install is pretty spartan-- you're not likely to use an OpenBSD machine without installing outside software, which is not going to be developed by the OpenBSD guys. So you're only as secure as your weakest public-facing program.
I tend to look at OpenBSD as a sort of "security incubator" program, where good security ideas and practices have the chance to grow. I think that the biggest impact of OpenBSD tends to be felt in OTHER operating systems and on the internet at large.
One of the big areas where OpenBSD has pushed things forward, in my opinion, is defense-in-depth for software. They put a lot of effort into maintaining high coding standards and an emphasis on correctness. They've been active in the area of exploit prevention and detection-- they were the first to really do W^X, they've been using ProPolice by default since forever, they randomize memory addresses, etc. But they're also very active in exploit mitigation-- that is, if we start by assuming that a program IS going to have a security bug, how do we limit the damage? OpenBSD has invented or popularized techniques like privilege separation, their "pledge" and "reveal" systems, and various other forms of sandboxing.
There's also the crypt side-- their work on cleaning up OpenSSL to create LibreSSL has been an incredible service. OpenSSH has been adopted EVERYWHERE. Their work has done a LOT to reduce the amount of unencrypted traffic going across the internet generally.
I tend to look at OpenBSD as a sort of "security incubator" program, where good security ideas and practices have the chance to grow. I think that the biggest impact of OpenBSD tends to be felt in OTHER operating systems and on the internet at large.
One of the big areas where OpenBSD has pushed things forward, in my opinion, is defense-in-depth for software. They put a lot of effort into maintaining high coding standards and an emphasis on correctness. They've been active in the area of exploit prevention and detection-- they were the first to really do W^X, they've been using ProPolice by default since forever, they randomize memory addresses, etc. But they're also very active in exploit mitigation-- that is, if we start by assuming that a program IS going to have a security bug, how do we limit the damage? OpenBSD has invented or popularized techniques like privilege separation, their "pledge" and "reveal" systems, and various other forms of sandboxing.
There's also the crypt side-- their work on cleaning up OpenSSL to create LibreSSL has been an incredible service. OpenSSH has been adopted EVERYWHERE. Their work has done a LOT to reduce the amount of unencrypted traffic going across the internet generally.
> Sort of depends on how you look at it. A shitty, misconfigured install of MySQL on an OpenBSD box won't automatically become secure. And the default install is pretty spartan-- you're not likely to use an OpenBSD machine without installing outside software, which is not going to be developed by the OpenBSD guys
Depends on what you're doing with it -- but the base system ships with many things that you would want to use, and it's definitely concievable that you'd only run with OpenBSD software.
Web servers? OpenHTTPd. Mail wervers? OpenSMTPd. Proxies? Relayd Firewalls? pf Routing? Depends on what you need, but there's probably a daemon for that.
Depends on what you're doing with it -- but the base system ships with many things that you would want to use, and it's definitely concievable that you'd only run with OpenBSD software.
Web servers? OpenHTTPd. Mail wervers? OpenSMTPd. Proxies? Relayd Firewalls? pf Routing? Depends on what you need, but there's probably a daemon for that.
The OpenBSD base image includes a web server, dhcp client/server, a dns server, X11, a compiler, a (basic, for now) hypervisor, and so on.
You can get a lot done without relying on ports. (Also, the ports are somewhat vetted, as far as I can tell.)
You can get a lot done without relying on ports. (Also, the ports are somewhat vetted, as far as I can tell.)
Late reply, adding onto port vetting. They do try to incorporate their security mitigations into ports. E.g. they have `pledge`d chromium in ports.[0]
[0] https://undeadly.org/cgi?action=article&sid=20160107075227
[0] https://undeadly.org/cgi?action=article&sid=20160107075227
Arguably OpenBSD is a "modern hardened cloud OS"; they're pretty aggressive at pushing kernel and userland hardening (in combination, ex. adding pledge, then patching the base system and some ports to use it).
Disclaimer: Not an expert on the topic by any means, just my take as a someone running this release on a few boxes. Have less experience with the latter portion of your question, more with OpenBSD.
I think it's comparable in terms of features, and many of those features even originated or have canonical implementations that started under the umbrella of OpenBSD. Also some of the most sane defaults, and simple install process, of any OS I've ever used.
I think where OpenBSD really shines though is the documentation. Most issues I run into can be solved by reading the man pages included with the default install.
Also the video linked by q3k elsewhere in this thread is a great watch.
I think it's comparable in terms of features, and many of those features even originated or have canonical implementations that started under the umbrella of OpenBSD. Also some of the most sane defaults, and simple install process, of any OS I've ever used.
I think where OpenBSD really shines though is the documentation. Most issues I run into can be solved by reading the man pages included with the default install.
Also the video linked by q3k elsewhere in this thread is a great watch.
You'd have to be more specific!
For a long time OpenBSD was focussed on security through correctness and code review, so that portion is not necessarily reflected in any of the grsecurity/pax type hardened linuxes.
But OpenBSD does have things like ASLR and kernel address randomization, advanced memory protection (W^X etc) and while it doesn't have ACLs or PAM it has pledge which is a great way of restricting system call access at the program level.
For a long time OpenBSD was focussed on security through correctness and code review, so that portion is not necessarily reflected in any of the grsecurity/pax type hardened linuxes.
But OpenBSD does have things like ASLR and kernel address randomization, advanced memory protection (W^X etc) and while it doesn't have ACLs or PAM it has pledge which is a great way of restricting system call access at the program level.
OpenBSD definitely has a longer track record with a lower rate of remote exploits in the default install.
Since they keep userspace stable, they generally have more stable programs running there as well.
For instance, systemd has has multiple remote exploits in a time window when the default OpenBSD base install has had zero.
Moving up the stack, OpenBSD often rewrites or simplifies important daemons (like httpd), and those tend to have closed or mitigated security holes before upstream exploits are discovered.
Since they keep userspace stable, they generally have more stable programs running there as well.
For instance, systemd has has multiple remote exploits in a time window when the default OpenBSD base install has had zero.
Moving up the stack, OpenBSD often rewrites or simplifies important daemons (like httpd), and those tend to have closed or mitigated security holes before upstream exploits are discovered.
My impression is that Linux tries to give sysadmins tools to secure existing binaries with containers, secomp, syscall filters etc.
OpenBSD focuses on securing things at the source level. Hence all the compiler tricks to mitigate memory safety bugs, API for programmers to limit syscall exposure, privilege separation within individual programs, drive to avoid unnecessary complexity so the source is readable etc.
OpenBSD focuses on securing things at the source level. Hence all the compiler tricks to mitigate memory safety bugs, API for programmers to limit syscall exposure, privilege separation within individual programs, drive to avoid unnecessary complexity so the source is readable etc.
What "hardened cloud OS kernels" are you talking about? I'm not aware of anything under that description in use.
Isn't OpenBSD a modern hardened cloud OS kernel? Could you provide a couple examples of the kinds of hardened kernels you're thinking of?
It all depends on the modern hardened cloud OS hacker.
What is a "modern hardened cloud OS kernel"?
It's an operating system kernel that can apparently provoke a response from a number of people in spite of having two buzzwords prefacing it.
Presumably something like CoreOS which makes extensive use of containers and any security feature it can get its hands on.
If I personally put my own opinion on it, I don't like unnecessary use of containers because the model gives you a lot of outdated dependencies, and I'm not sure whether containing a vulnerability once it happens is that noteworthy.
Old skool "use good, secure code. update dependencies" and not focusing on containing a vulnerability produces a much safer system IMO.
If I personally put my own opinion on it, I don't like unnecessary use of containers because the model gives you a lot of outdated dependencies, and I'm not sure whether containing a vulnerability once it happens is that noteworthy.
Old skool "use good, secure code. update dependencies" and not focusing on containing a vulnerability produces a much safer system IMO.
The cloud part makes much more sense when combining it with the user land. I think that's also where OpenBSD (or *BSD in general) really shines, everything is very coherent. Regarding Linux, I'd probably see CentOS/RHEL as "modern hardened cloud OS" with all it's measures in place. But even as a complete BSD beginner, I find OpenBSD or FreeBSD easier to configure than CentOS, which IIRC requires a lot of manual whitelisting of capabilities for server daemons.
Why provide that antique gcc? Better to not provide gcc at all, and an ability to install a recent GCC at user's discretion, than to provide a 12 year old gcc in the base system.
Why is their clang/llvm stale in a new release?
Why is their clang/llvm stale in a new release?
In OpenBSD, "base builds base". That is to say, one must be able to build the system using the compiler provided in the compXX.tgz set.
gcc moved to GPLv3 and OpenBSD doesn't ship GPLv3 code. For a long time, that's the reason why it was stuck on an ancient gcc.
OpenBSD moved to clang/llvm because it has a more acceptable licence. However, clang/llvm does not support all architectures OpenBSD supports, so that's why there's stil gcc.
Users can install a newer gcc (v8.3) from packages/ports.
Newer LLVM releases are licensed with APL2.0, and that doesn't sit well with OpenBSD:
http://lists.llvm.org/pipermail/llvm-dev/2017-April/112300.h... https://marc.info/?l=openbsd-misc&m=147503691302850&w=2
So they're using the last LLVM release with an acceptable licence.
Users can install a newer gcc (v8.3) from packages/ports.
Newer LLVM releases are licensed with APL2.0, and that doesn't sit well with OpenBSD:
http://lists.llvm.org/pipermail/llvm-dev/2017-April/112300.h... https://marc.info/?l=openbsd-misc&m=147503691302850&w=2
So they're using the last LLVM release with an acceptable licence.
How long will they eschew both major compilers? This can't possibly be sustainable.
Why not? This isn't the 90s anymore. Clang 8 is a very usable c compiler with excellent optimizations and excellent diagnostics. (OpenBSD doesn't use c++, so they don't need newer standards of that anyway.) And newer versions of both clang and gcc are available as packages.
Provide isn't the the right word. GCC is in the base system because some architectures haven't yet switched to clang, either because clang doesn't support the architecture, or because the work of switching the toolchain (which is not trivial) has not been done yet. The system must be able to build itself, so "better to not provide gcc at all" doesn't make sense.
In the cases where OpenBSD (and FreeBSD) don't yet use clang, they use the most recent GCC version that was still GPLv2 licensed. GPLv3 is not acceptable to OpenBSD in the base system.
More recent versions of GCC are provided in the ports system, for users to install. Those are not used by the base system. The system compilers are (mostly) for building the system. They don't even search in regular paths users might expect, like /usr/local. If users need a general purpose compiler, they can install one from ports.
The situation with clang is similar. OpenBSD uses the last version of clang/LLVM that was still BSD-licensed. Now LLVM uses the Apache license, which is not acceptable to OpenBSD in the base system. (However, FreeBSD is okay with it.)
In the cases where OpenBSD (and FreeBSD) don't yet use clang, they use the most recent GCC version that was still GPLv2 licensed. GPLv3 is not acceptable to OpenBSD in the base system.
More recent versions of GCC are provided in the ports system, for users to install. Those are not used by the base system. The system compilers are (mostly) for building the system. They don't even search in regular paths users might expect, like /usr/local. If users need a general purpose compiler, they can install one from ports.
The situation with clang is similar. OpenBSD uses the last version of clang/LLVM that was still BSD-licensed. Now LLVM uses the Apache license, which is not acceptable to OpenBSD in the base system. (However, FreeBSD is okay with it.)
Is never getting a newer version of gcc or llvm as default sustainable so long as developers can install a new version for their own use?
What happens in 2030 or 2040?
What happens in 2030 or 2040?
How is the user supposed to navigate all the logistics and technical ramafications of ethical/political dev / package choices ?
Everything has alternative versions, its hard for me to keep track of who forked what and why.
Generally speaking they don't need to. If you are developing C code and need some particular compiler version, you just install a package (ie "pkg install gcc9") and make sure to set CC=gcc9, and that's it.