Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why use OpenBSD?

tumfatig.net

Post reply on HN
Print view View original

41–50 of 106 posts

Re: Why use OpenBSD?

#41

Post by Guestmodinfo »

shevy-java wrote: post #5

I appreciate that OpenBSD sold its course on security-everywhere. Unfortunately I also kind of lost faith in the BSD variants. There are a few minor things such as PC-BSD suddenly vanishing, or years before NetBSD on their mailing list admitting that Linux outperformed their "runs on any toaster and other gimmick" strategy. But one of the key issues I had was this: I installed it (FreeBSD) on my second computer. I we…

Just a few hours ago on the irc channel of OpenBSD someone said that OpenBSD is good at not letting a wonky hardware run compared to linux. So you could use the dmesg and ask it in the OpenBSD mailing list and they will point out which wonky hardware is causing trouble and you can replace that problematic part. I ran OpenBSD current for 6 years and never faced such issue

Re: Why use OpenBSD?

#42

Post by shiomiru »

thomashabets2 wrote: post #30
hellcow wrote: post #25

I built my last company on OpenBSD. It was easy to understand the entire system, and secure-by-default (everything disabled) is the right posture for servers. Pledge and unveil worked brilliantly to restrict our Go processes to specific syscall sets and files. The firewall on OpenBSD is miles better to configure than iptables. I never had challenges upgrading them--they just kept working for years.

Finally Linux has something that approaches pledge/unveil: landlock. Seccomp was never actually usable: https://blog.habets.se/2022/03/seccomp-unsafe-at-any-speed.h...

> Seccomp was never actually usable

It's barely usable by itself but I don't think it's an inherent problem of seccomp-bpf, rather the lack of libc support. Surely the task of "determine which syscalls are used for feature X" belongs in the software that decides which syscalls to use for feature X.

In fact, Cosmopolitan libc implements pledge on Linux on top of seccomp-bpf: https://justine.lol/pledge/

Re: Why use OpenBSD?

#43

Post by pjmlp »

GTP wrote: post #40
pjmlp wrote: post #29

Earlier quoted context omitted.

Which is what makes Linux kernel stand out, as we can see by Sony and Apple contributions upstream. Had BSD not been busy with AT&T lawsuit, all major UNIXes would probably still be around, consuming whatever was produced out of BSD like the networking code and OS IPC improvements over AT&T UNIX. Instead sponsoring Linux kernel became the plan B, as means to reduce their UNIX development costs. > Commercial use began…

Of course big corporations would rather not be obliged by the GPL. But my feeling is that, if we give them the option to grab the code without contributing back their improvements, they would just do that. In the long run, this risks harming the OSS community, as developers would feel like big corps are being leeches and profiting out of their work without giving anything back. After all, the GPL forces to contribute…

It is no accident that Google has removed everything GPL out of Android, falling short of the Linux kernel, and they haven't done the final step with Fuchsia/Zircon mostly due to what appears internal politics.

Re: Why use OpenBSD?

#44

Post by hyperpl »

ectospheno wrote: post #37
lol_catz wrote: post #32

If you can tolerate poor performance then by all means use OpenBSD. Debian stable FTW.

You do have to buy more powerful hardware than you otherwise would. I find it worth it to run code I can more easily understand. I agree on Debian as well. My router and laptop are OpenBSD but most vms on my proxmox are Debian.

Agreed. I run my OpenBSD firewall on my odroid h4 - it's relatively cheap and plenty powerful to route gigabit+. I prefer pf and the simplicity of OpenBSD over Debian for such a purpose-built application. For my other "home servers" I simply run Debian as I believe it to be one of the more sane Linux choices for a server-type application.

Re: Why use OpenBSD?

#45

Post by natebc »

PunchyHamster wrote: post #22
andai wrote: post #11

Earlier quoted context omitted.

GP is referring to the LLM crawler captcha thing. The one with the anime girls in it. It only took a few seconds on my phone, but it's slow on my old ThinkPad.

it took tens of seconds to load, once it loaded it was quick And the point of "why waste time for captcha for static file" still stands, it's not like there is comment section for bots to abuse

It's not about keeping spam out of comments, it's about keeping systems and content safe/operational for normal people and more costly or unavailable for the trillion dollar "AI" companies that are shitting all over everything.

Don't blame this on site operators, this is the fault of careless LLM operators knocking down everybody's walls doors and windows to "learn" from their content.

Re: Why use OpenBSD?

#46

Post by jorvi »

hellcow wrote: post #25

I built my last company on OpenBSD. It was easy to understand the entire system, and secure-by-default (everything disabled) is the right posture for servers. Pledge and unveil worked brilliantly to restrict our Go processes to specific syscall sets and files. The firewall on OpenBSD is miles better to configure than iptables. I never had challenges upgrading them--they just kept working for years.

> I built my last company on OpenBSD. It was easy to understand the entire system, and secure-by-default (everything disabled) is the right posture for servers.

That really depends. You could argue a router is a server. OpenWRT has the default of WiFi off for security, which means that if the config is somehow hosed and you have to hard reset the router, you now have an inaccessible brick unless you happen to have a USB-Ethernet adapter on you.

Sensible defaults are much, much better than the absolutionist approach of "disable everything".

Edit: it's so funny to know that all the people slamming the downvote have never hit the brick wall of a dumb default. I hope you stay blessed like that!

Re: Why use OpenBSD?

#47

Post by 01HNNWZ0MV43FF »

Guestmodinfo wrote: post #38
PunchyHamster wrote: post #20

Earlier quoted context omitted.

You are not....it's Ubuntu. Not Linux, not Debian, Ubuntu. Debian (provided you don't just dump a bunch of 3rd party repos) just upgrades cleanly, we have hundreds of servers that just run unattended-upgrade and get upgraded to new Debian version every 2 years. The few Ubuntus we had had more problems.

How to upgrade Debian unattended if it's not a rolling release

Maybe they run Debian Testing. Testing and Unstable (sid) are rolling, and the stable release cut from the testing branch (through some process)

Re: Why use OpenBSD?

#48

Post by idoubtit »

Guestmodinfo wrote: post #38
PunchyHamster wrote: post #20

Earlier quoted context omitted.

You are not....it's Ubuntu. Not Linux, not Debian, Ubuntu. Debian (provided you don't just dump a bunch of 3rd party repos) just upgrades cleanly, we have hundreds of servers that just run unattended-upgrade and get upgraded to new Debian version every 2 years. The few Ubuntus we had had more problems.

How to upgrade Debian unattended if it's not a rolling release

Not the Grand Poster, but we use the Debian package "unattended-upgrades" to install security updates automatically on our servers, and send an email if a reboot is required to complete the process (kernel upgrade).

Unattended upgrades could be configured to install more than the security release. Even with the stable release, one can add the official APT source for the Debian backports.

Re: Why use OpenBSD?

#49

Post by abenga »

pjmlp wrote: post #43
GTP wrote: post #40

Earlier quoted context omitted.

Of course big corporations would rather not be obliged by the GPL. But my feeling is that, if we give them the option to grab the code without contributing back their improvements, they would just do that. In the long run, this risks harming the OSS community, as developers would feel like big corps are being leeches and profiting out of their work without giving anything back. After all, the GPL forces to contribute…

It is no accident that Google has removed everything GPL out of Android, falling short of the Linux kernel, and they haven't done the final step with Fuchsia/Zircon mostly due to what appears internal politics.

It is good for Google, not Android users.

Re: Why use OpenBSD?

#50

Post by Milpotel »

PunchyHamster wrote: post #24
scatbot wrote: post #10

One of the reasons why I'm using OpenBSD is because it passes what I think of as a litmus test for FLOSS software: can I build the whole thing from scratch, in a short time and with minimal fuss? In the case of OpenBSD, the answer is yes. I can install it on a new machine, fetch the source code from mirrors, do some edits to the source, build a fresh release, write it to a USB stick and boot it on another machine. On…

Buildroot does exactly that and it gives you big TUI menu to pick what you want included in your linux image

There is also T2 SDE.
Post reply on HN