Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Stopped Using OpenBSD

dataswamp.org

Post reply on HN
Print view View original

21–30 of 81 posts

Re: I Stopped Using OpenBSD

#21

Post by microtonal »

cenamus wrote: post #20
johnklos wrote: post #7

This points out something we forget at times: being a fan of a thing shouldn't mean we have to suffer for it. NetBSD doesn't have GPU compute capabilities, plus browser DRM is a PITA, so I run macOS, too. If I have to choose between not doing a thing at all and doing it in a less enjoyable environment, it's only my own foot that suffers were I to choose not doing it at all. What really matters here is that systems sh…

I suspect a lot just comes down to manpower... While extremely important the FS currently works "good" enough (although there were/are efforts to port HAMMER2). But I share the frustrations, all these little papercuts really add up and I only use OpenBSD in server settings nowadays

Good enough? As far as I could gather, they never implemented FFS/UFS journaling and removed support for soft updates. If that’s incorrect, I apologize for this comment.

So, they basically have a filesystem that operates like it did in the ninetees, unclean shutdown and you have to go through a full fsck and hope for the best. Most people who used some Unix before journaling would never want to go back.

Re: I Stopped Using OpenBSD

#22

Post by p_l »

nicce wrote: post #10
regularfry wrote: post #4

Earlier quoted context omitted.

Sounds like it's not great as a server either, if the virtualisation support still isn't up to scratch.

Usually you use it as firewall or router in bare metal.

And it was starting to stupidly lag for those use cases by 2007, because after some point you start care about firewall/router performance too...

Re: I Stopped Using OpenBSD

#23

Post by mrweasel »

maximilianburke wrote: post #9

Journaling filesystems have been around for decades now; I don't think I've had a data loss incident since I stopped using Windows 98? I know it's volunteer driven but it seems like working on data integrity might be more of a benefit for security than some of the gimmicks like TRAPSLED.

OpenBSD had Soft Updates, which isn't really journaling but sort of similar. It was suppose to help with with file system integrity, in the case of crashes. OpenBSD removed it last year because it got in the way of VFS updates, and was hard for the team to maintain[1].

I love OpenBSD, but it really does need a modern filesystem. The current team might be to small or just not have the right people to do a new filesystem. HammerFS2 could maybe be ported (and one has to wonder if that's not one of the thing that would requires VFS layer updates). Much of the current work on filesystems are being poured into GPL licensed code or ZFS, which also have an unfortunate license, so OpenBSD either has to borrow HammerFS, or do their own thing, which they probably don't have the resources for.

1) https://undeadly.org/cgi?action=article;sid=20230706044554

Re: I Stopped Using OpenBSD

#24

Post by 1oooqooq »

jms703 wrote: post #11

Makes sense. I've always assumed that OpenBSD has a very narrow use case anyway. I love it for a network firewall because the configuration files are sane and easy to understand (stares at systemd networkd). I set it and forget it.

it is easier to setup a openbsd vm and have it handle all the network routing and wireguard stuff, than it is to simply disable the unrequested zeroconf stuff included in systemd-networkd/resolvd.

Re: I Stopped Using OpenBSD

#25

Post by 1oooqooq »

eyberg wrote: post #18

> flatpak: I really like software distribution done with flatpak, packages are all running in their own namespace, they can't access all the file system, you can roll back to a previous version, and do some interesting stuff As of today flatpak still has holes you can drive a truck through.

flatpack for isolation is a joke. All the file duplication, none of the security. Not to mention nothing that depends on camera, screen cap, etc will ever get close to working.

Just accepting there's no easy solution, and do aparmour+firejail. It's awful user experience, but at least only once per application. Then it is perfect. There should be a distro like qubes but where everything must have either a firejail profile or a hardened systemd unit file (which is the worse designed/documented thing in the universe, taking the place of X11). That would be the ideal world.

Re: I Stopped Using OpenBSD

#26

Post by mrweasel »

paulnpace wrote: post #14
regularfry wrote: post #4

Earlier quoted context omitted.

Sounds like it's not great as a server either, if the virtualisation support still isn't up to scratch.

She states in that post she had issues running virtual machines on OpenBSD. This isn't the same running OpenBSD in a virtual environment.

I think the reference was to VMM, OpenBSDs own hypervisor.

Re: I Stopped Using OpenBSD

#27

Post by burnt-resistor »

eyberg wrote: post #18

> flatpak: I really like software distribution done with flatpak, packages are all running in their own namespace, they can't access all the file system, you can roll back to a previous version, and do some interesting stuff As of today flatpak still has holes you can drive a truck through.

I still don't understand the slapdash approach the desktop Linux crowd took, Qubes is a much better approach. Such unprofessional software engineering pervades FLOSS with the worn and tired "but it's a hobby project" when it's a core dependency necessary for international corporate, government, and military strategic systems. (I also don't understand the lack of appropriate support for critical projects either, but it makes sense because of decline, entitlement, corruption, and greed.)

I had to shout and scream at docker early on for container image integrity, but that fell on deaf ears. Heck, Python even threw away GPG to roll their own sketchy setup and Ruby doesn't even care about package integrity or supply chain attacks.

Re: I Stopped Using OpenBSD

#28

Post by 1oooqooq »

maximilianburke wrote: post #9

Journaling filesystems have been around for decades now; I don't think I've had a data loss incident since I stopped using Windows 98? I know it's volunteer driven but it seems like working on data integrity might be more of a benefit for security than some of the gimmicks like TRAPSLED.

Most setups nowadays do full disk encryption outside of the FS, so the journal doesn't help much.

If you have SSD->LUKS->GPT->LVM->Ext4, then a bug on any of the (newer, buggier) components before your journaled FS means you lost data.

Re: I Stopped Using OpenBSD

#29

Post by technofiend »

p_l wrote: post #22
nicce wrote: post #10

Earlier quoted context omitted.

Usually you use it as firewall or router in bare metal.

And it was starting to stupidly lag for those use cases by 2007, because after some point you start care about firewall/router performance too...

I adore OpenBSD because it's so lightweight, but I dropped it for FreeBSD when the same hardware couldn't max out a 1 gigabit connection running OpenBSD but could with Free. Since then they have made network changes so I'll probably try again even though the bar's moved and now I need 2.5 gigabit connections to be saturated. Happy to give it a chance anyway.

Re: I Stopped Using OpenBSD

#30

Post by znpy »

1oooqooq wrote: post #25
eyberg wrote: post #18

> flatpak: I really like software distribution done with flatpak, packages are all running in their own namespace, they can't access all the file system, you can roll back to a previous version, and do some interesting stuff As of today flatpak still has holes you can drive a truck through.

flatpack for isolation is a joke. All the file duplication, none of the security. Not to mention nothing that depends on camera, screen cap, etc will ever get close to working. Just accepting there's no easy solution, and do aparmour+firejail. It's awful user experience, but at least only once per application. Then it is perfect. There should be a distro like qubes but where everything must have either a firejail pro…

To be hones I appreciate flatpak for software distribution. Afaik (correct me if I’m wrong) some degree of security is implemented through selinux (i’m on fedora).
Post reply on HN