Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FreeBSD – a lesson in poor defaults

vez.mrsk.me

Post reply on HN
Print view View original

41–50 of 72 posts

Re: FreeBSD – a lesson in poor defaults

#41

Post by boomboomsubban »

na85 wrote: post #36
tachion wrote: post #31

While you're here, have you donated[0][1] yet? :) You may or may not be aware, but FreeBSD runs your movies on Netflix, your games on PlayStation and Nitendo Switch, your files on FreeNAS and ZFS, your friends on WhatsApp and OpenBSD runs everything else on OpenSSH. ;) So, you may or may not know that, but you need FreeBSD and OpenBSD and they also need you! Every cent counts and so does every contributor, that helps…

Seems to me that Netflix, Sony, et al should be paying FreeBSD, not the users. Why would I subsidize FreeBSD so that mega corps can leech off the hard work of volunteers, and by extension leech off my donation?

They do pay, both in code and donations.

Re: FreeBSD – a lesson in poor defaults

#42

Post by Arelius »

tachion wrote: post #31

While you're here, have you donated[0][1] yet? :) You may or may not be aware, but FreeBSD runs your movies on Netflix, your games on PlayStation and Nitendo Switch, your files on FreeNAS and ZFS, your friends on WhatsApp and OpenBSD runs everything else on OpenSSH. ;) So, you may or may not know that, but you need FreeBSD and OpenBSD and they also need you! Every cent counts and so does every contributor, that helps…

Any citations about Switch using FreeBSD by chance?

Re: FreeBSD – a lesson in poor defaults

#43

Post by xuejie »

secret_island wrote: post #18
vog wrote: post #5

I wonder how this compares to other unix systems, such as OpenBSD or various Linux Distros.

Long-time OpenBSD user here. OpenBSD has sane, secure defaults with nothing enabled in a fresh install. This is a desired default, as everyone uses OSes for different reasons. OpenBSD makes a phenomenal firewall, a pretty good Web server, and a super nice, secure file server. OpenBSD shines because of the ongoing code audit, the minimalism, and the ability to easily make it into whatever you want. I don't care for an…

Can you elaborate more on the CentOS/RedHat choice? I'm curious about how other Linux distros are handling in this space.

Re: FreeBSD – a lesson in poor defaults

#44

Post by na85 »

boomboomsubban wrote: post #41
na85 wrote: post #36

Earlier quoted context omitted.

Seems to me that Netflix, Sony, et al should be paying FreeBSD, not the users. Why would I subsidize FreeBSD so that mega corps can leech off the hard work of volunteers, and by extension leech off my donation?

They do pay, both in code and donations.

Obviously these hugely profitable companies don't pay enough. Otherwise I should not need to donate.

Re: FreeBSD – a lesson in poor defaults

#45

Post by kingofhdds »

0xcde4c3db wrote: post #4

> I think swap should always be encrypted. FreeBSD developers disagree. It's surprising just how much private data in memory gets written to disk. Someone I know has run hexdump on his swap partition and found PGP private keys in plain view. Your SSH key might be password-protected on disk, but it could end up in swap sooner or later... with no password needed. GnuPG and a few other security-conscious programs try to…

FreeBSD is a tune-it-yourself OS. You think your swap should be encrypted? Fine, append ".eli" to the name of your swap GEOM (partition, slice, whatever) in fstab, and you're done. Some may not require this at all, because FreeBSD may be used in a lot of different situations. Your needs - your choice.

Re: FreeBSD – a lesson in poor defaults

#46

Post by Twirrim »

Arelius wrote: post #42
tachion wrote: post #31

While you're here, have you donated[0][1] yet? :) You may or may not be aware, but FreeBSD runs your movies on Netflix, your games on PlayStation and Nitendo Switch, your files on FreeNAS and ZFS, your friends on WhatsApp and OpenBSD runs everything else on OpenSSH. ;) So, you may or may not know that, but you need FreeBSD and OpenBSD and they also need you! Every cent counts and so does every contributor, that helps…

Any citations about Switch using FreeBSD by chance?

http://www.osnews.com/story/29698/Nintendo_Switch_runs_FreeB...

Re: FreeBSD – a lesson in poor defaults

#47

Post by secret_island »

xuejie wrote: post #43
secret_island wrote: post #18

Earlier quoted context omitted.

Long-time OpenBSD user here. OpenBSD has sane, secure defaults with nothing enabled in a fresh install. This is a desired default, as everyone uses OSes for different reasons. OpenBSD makes a phenomenal firewall, a pretty good Web server, and a super nice, secure file server. OpenBSD shines because of the ongoing code audit, the minimalism, and the ability to easily make it into whatever you want. I don't care for an…

Can you elaborate more on the CentOS/RedHat choice? I'm curious about how other Linux distros are handling in this space.

Sure. Some clients prefer us to use Linux, since their teams large or small are comfortable with it. OpenBSD is still a rather esoteric OS for most. I've been using both since 1998, so I can go either way. RedHat/CentOS offer support for 10 years is high up on the totem pole for me and plenty of others. OpenBSD releases every 6 months like most Linux distros, so some mission-critical users are uncomfortable with this pace, and I cannot say I blame them.

SELinux is great for areas that are into DAC/MAC/RBAC, plus the aforementioned lengthy support. I see more and more customers wanting Red Hat/CentOS than any other Linux distro and for good reason. It just works. Things like CPanel only run on these distros. Red Hat/CentOS are also very predictable and they offer superb documentation. More and more people are uncomfortable with things like Debian because there is no throat to choke if they need support or if something goes pear shaped.

I have worked on Linux for 20 years now and I have never, ever seen Debian or Slackware or even Ubuntu in a TRULY mission-critical role. People may disagree, but there are reasons why Red Hat/CentOS are chosen. They are typically very stable, use tested software, and are well documented for the use cases they excel in. Red Hat runs some truly mission critical stuff like power grids, and more and more SCADA systems, now that they are being upgraded due to threats.

Re: FreeBSD – a lesson in poor defaults

#48

Post by boomboomsubban »

na85 wrote: post #44
boomboomsubban wrote: post #41

Earlier quoted context omitted.

They do pay, both in code and donations.

Obviously these hugely profitable companies don't pay enough. Otherwise I should not need to donate.

Obviously Windows should be free, with all the huge companies that use that. The logic makes no sense.

Re: FreeBSD – a lesson in poor defaults

#49

Post by Neeek »

boomboomsubban wrote: post #48
na85 wrote: post #44

Earlier quoted context omitted.

Obviously these hugely profitable companies don't pay enough. Otherwise I should not need to donate.

Obviously Windows should be free, with all the huge companies that use that. The logic makes no sense.

It makes perfect sense if you don't personally own or use Windows. I don't pay Microsoft again to play TitanFall just because their servers are hosted on Azure.

I understand we all probably use tools everyday that can be attributed to these projects and I don't mean to imply that you shouldn't give them money. Just that the Netflix/WhatsApp comments seem a little disingenuous. That shouldn't be in the "reasons you need BSD", those are just reasons Neflix and WhatsApp need BSD.

Re: FreeBSD – a lesson in poor defaults

#50

Post by ploxiln »

ilammy wrote: post #16
vog wrote: post #8

Earlier quoted context omitted.

Moreover, you have stuff like password managers going though the clipboard. Relying on all tools correctly identifying their sensitive datasets and protecting them though mlock() is doomed to fail. If anything, a proper security concept should whitelist insensitive datasets, instead of blacklisting sensitive datasets. I don't get why any modern OS would use unencrypted SWAP. The default should be either encrypted SWA…

> encrypted SWAP When I was setting up dm-crypt for my Linux dev box at work I opted for using an encrypted swap as it really made sense: why keep on-disk stuff encrypted if swapped memory is in plain sight. It turned out to be a somewhat bad decision, because when the system did run out of memory (thank you, Firefox and Skype) and began swapping, the whole box just freezes as the kernel was too busy encrypting more…

In my experience, swap usually does not actually work out helpfully. The system slows down so much it's unusable, and you wish the OOM killer killed something so you can recover some processes/state, but it takes way too long to do so, many minutes while the system is effectively frozen and you are helpless. (Some people think the OOM killer kicks in too soon. They're crazy ;)

I also ran into this when setting memory limits on docker containers. It basically made them freeze for entire minutes when they hit the limit instead of killing them. So instead I wrote my own script to check and signal them to gracefully exit before memory runs out (and after a few more seconds SIGKILL them).

Post reply on HN