Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenBSD 7.9

openbsd.org

Post reply on HN
Print view View original

161–170 of 314 posts

Re: OpenBSD 7.9

#161

Post by mxuribe »

nelsonic wrote: post #85
mxuribe wrote: post #68

Earlier quoted context omitted.

Yeah, thanks that helps! Its the old convenience vs security balancing act :-)

100%. I put off learning/using OpenBSD for a decade until a breach at a client (we weren’t responsible for DevOps/SysAdmin) made me pick it up because I don’t have time to be a full-time Linux Sysadmin anymore. Just want the servers to run without having to think about them. Wish I’d done it sooner. Lost at lot of time on Linux, Docker, K8s, etc. that I could have skipped completely with OpenBSD. Our servers are an o…

> ...I don’t have time to be a full-time Linux Sysadmin anymore. Just want the servers to run without having to think about them...

Very salient comment there! And, while not the only reason for me, but what you noted is sort of one reason that's triggering the itch in me to go back to playing with the BSDs. Don't get me wrong, I still do love fiddling around with some areas of linux once in a while....but then, there are other uses/areas where i just want a server to do its thing, and for my maintenance to be a little less (at least less than some linux distros require). So maybe i'm not the only one? :-)

Re: OpenBSD 7.9

#162

Post by fmajid »

clbrmbr wrote: post #10

Anyone here using OpenBSD? If so, for what purpose? I’ve always wanted to use NetBSD for an application for an embedded system / IoT device but never had the pleasure (yet!).

My home router, firewall and VPN gateway is an OpenBSD box, Intel N100 with quad 2.5G Ethernet. To be frank, Linux has better support for fighting bufferbloat with FC-CoDel, but pf is so much saner than Linux firewalls it's not even close.

WiFi is handled separately by a Ubiquiti UniFi system, but I don't trust Ubiquiti not to exfiltrate data after their underhanded attempt to turn telemetry on a few years ago. OpenBSD WiFI is somewhat mediocre, but it has improved in this release with experimental support for WiFi 6 after years of being stuck at 802.11n.

The closest you will get to the OpenBSD experience on Linux is with Alpine Linux.

Re: OpenBSD 7.9

#163

Post by SmirkingRevenge »

866-RON-0-FEZ wrote: post #36
rs_rs_rs_rs_rs wrote: post #29

Earlier quoted context omitted.

>it’s time everyone considers OpenBSD https://x.com/ortegaalfredo/status/2055362910415671459 When your super secure feature gets defeated by a symlink maybe it's not really time to consider it... Sure, things are not better in the linux world but at least there's more eyes to fix issues there just because of the market share.

Your "evidence" for him to reconsider is a sandbox "bypass" that requires you to be root to set up the environment? For my next trick I will demonstrate how to break into my own house to open the blinds by using my keys. Security researcher theatrics will never not be funny.

The parents tone wasn't warranted, but bugs like this could be more serious if combined with privilege escalation bugs in the sandbox.

Ideally, sandboxes should be like Vegas - what happens in the sandbox stays in the sandbox.

(I'm just speaking hypothetically here, I'm not knowledgeable about OpenBSD or it's sandboxes)

Re: OpenBSD 7.9

#164

Post by accrual »

foofyter wrote: post #146
maxall4 wrote: post #90

Earlier quoted context omitted.

Is OpenBSD actually more secure than Linux? I have not been able to find any data to support this—only some vague opinions.

macOS is BSD roots on top of Darwin

While true it doesn't answer why OpenBSD is considered more secure by default than Linux. Despite its BSD roots, macOS has had its share of CVEs:

https://www.cvedetails.com/version-list/49/70318/1/Apple-Mac...

Re: OpenBSD 7.9

#165

Post by tredre3 »

nelsonic wrote: post #133
maxall4 wrote: post #90

Earlier quoted context omitted.

Is OpenBSD actually more secure than Linux? I have not been able to find any data to support this—only some vague opinions.

The Data: Compare the number of CVE vulnerability trends over time between Linux: https://www.cvedetails.com/vendor/33 and OpenBSD: https://www.cvedetails.com/vendor/97 It's not even close! It's nearly two orders of magnitude higher for Linux. This isn't anecdotal or “vague opinion” CVEs are facts. You can ask the follow-up question: Why is that? And there are many reasons. It could just be that Linux having more use…

> And there are many reasons. It could just be that Linux having more users/eyes means more bugs are surfaced

You really brushed that one off, uh? The ratio of linux devices to openbsd is quite literally a million to one. The ratio of tech companies invested in linux to companies invested in openbsd is roughly 50,000 to 1. The ratio of professional security researchers paid to find flaws in Linux vs OpenBSD is harder to quantify at the moment, but I think we can guess a trend here.

I can agree to a degree that OpenBSD takes security more seriously, and they have made very interesting design decisions to enforce their security model. But I entirely disagree that the number of "CVEs are facts" to back your opinion that it is superior.

Re: OpenBSD 7.9

#166

Post by stackghost »

maxall4 wrote: post #90
nelsonic wrote: post #11

With all the security issues constantly being uncovered in other Operating Systems - which will only accelerate with Ai - it’s time everyone considers OpenBSD. Their decades-long security-focus is second to none. We have fully converted from Ubuntu/Debian to OpenBSD. No looking back.

Is OpenBSD actually more secure than Linux? I have not been able to find any data to support this—only some vague opinions.

It's not meaningfully more secure than e.g. Debian.

Their claim to fame ("only two remote holes in the default install in X number of years") is definitionally only valid for the default install in its default configuration which means: no httpd, no smtpd, no unbound, etc. etc. etc.

The default install isn't very useful, because it doesn't do a lot, and so "only two remote holes" or whatever isn't really saying much.

For example: there are still CVEs popping up: https://nvd.nist.gov/vuln/detail/CVE-2024-11148

Linux has more CVEs because it's orders of magnitude more popular. OpenBSD has appalling performance, and more or less nobody uses it, so there just isn't a large focus on auditing and fixing it.

It's a great research project, but I would not run it on my personal devices. Not because it's "insecure" but because the putative security benefits do not merit the shockingly poor performance.

Re: OpenBSD 7.9

#167

Post by SoftTalker »

hedora wrote: post #155
SoftTalker wrote: post #102

Earlier quoted context omitted.

Backup, do a fresh install with new partitions, restore. You have to do this every once in a while especially if your partition sizing is from nearly a decade ago. My one complaint about OpenBSD would probably be lack of resizable partitions. You can expand them, but only if you have free contiguous space and most of the time one partition starts where the prior one ends. It's rarely a problem in practice, as only /h…

My point is that you shouldn't have to do this! I've already done this twice for this box. Its disk is half empty, and the used space is 75% compounding useless bloat: - 50% of the used space are package sets I never asked for. - The stuff I did ask for is somehow 2x larger than it needs to be, since they don't randomize binaries in place. - If they'd actually follow their own filesystem hierarchy standards, and stop…

Yeah it sucks when partitions that were sized 8-10 years ago are no longer adequate. I've hit the "/usr is too small to complete an upgrade" trap myself. When that happened I rejected the installer's partition suggestions and made /usr substantially larger (this is also necessary if you're going to be building large ports, which also happens under /usr).

So far that has worked for me.

Some people would also argue that using an 8 year old device as a critical path in your LAN is a risk in itself. Taking routers down to do upgrades is pretty common in the enterprise IT world.

Re: OpenBSD 7.9

#168

Post by terry_hc »

tptacek wrote: post #124
nelsonic wrote: post #75

Earlier quoted context omitted.

Qubes OS uses the Linux kernel. Without wanting to start a flame-war and with all respect to Linux, it’s not even close. See: https://en.wikipedia.org/wiki/OpenBSD_security_features

https://isopenbsdsecu.re/ (This site is extremely good and has fairly recent coverage, point-by-point, of all OpenBSD's mitigations. An important subtext to take to this is that OpenBSD has a reputation for introducing mitigations that exploit developers make fun of. Some of them are great, some of them less so.)

The slides are over 6 years old. The developers' attitudes haven't changed much, but are all of the arguments still valid?

I've followed this discussion here and there over the years and it always goes like this:

1) everyone makes fun of the mitigations

2) many even outright assert they can easily defeat and exploit OpenBSD

3) nobody provides a working PoC when asked to demonstrate how insecure the OS is

And somewhere in the mix there's also you and your usual blabber, also without any substantial examples of how insecure and exploitable the OS is. Always.

Re: OpenBSD 7.9

#169

Post by seniorThrowaway »

fmajid wrote: post #162
clbrmbr wrote: post #10

Anyone here using OpenBSD? If so, for what purpose? I’ve always wanted to use NetBSD for an application for an embedded system / IoT device but never had the pleasure (yet!).

My home router, firewall and VPN gateway is an OpenBSD box, Intel N100 with quad 2.5G Ethernet. To be frank, Linux has better support for fighting bufferbloat with FC-CoDel, but pf is so much saner than Linux firewalls it's not even close. WiFi is handled separately by a Ubiquiti UniFi system, but I don't trust Ubiquiti not to exfiltrate data after their underhanded attempt to turn telemetry on a few years ago. OpenB…

>so much saner than Linux firewalls it's not even close.

This is a big one for me. I've run openBSD and Linux custom boxes as SoHo routers and I just cannot stand Linux firewalls, I've never liked them and IPTables is just terrible. Yes I know there are wrappers around it now but it's still the default everywhere and still used by lots of other software like Docker. I'm using OPNSense now which is FreeBSD based instead of completely rolling my own but I love that it is still BSD under the hood.

One differing opinion I will offer is that I find NixOS to be the Linux distro most in the openBSD spirit despite it being very different from a UX and config management perspective. Alpine is interesting, but it has its own security and compatibility issues, especially around MUSL libc which I have had cause many strange downstream issues over the years, I just hit one recently in JVM GC caused by its memory allocation implementation. I've stopped using alpine altogether because of them.

Re: OpenBSD 7.9

#170

Post by brynet »

mghackerlady wrote: post #111
mxuribe wrote: post #76

Earlier quoted context omitted.

Thanks! And, wow, do i miss the old X-window workstations...well, i should clarify that i LOVED those (I think they were Sparc?) workstations that ran Solaris or SunOS back in the day! Man, that takes me back some years...but i really loved those machines! :-)

OpenBSD supports sparc very well and is compatible with old sunos stuff (iirc). Unfortunately no 68k anymore (okay, technically there's a niche flavour of 68k that still is supported because of a very dedicated man in Japan)

> OpenBSD supports sparc very well and is compatible with old sunos stuff (iirc)

No 32-bit sparc anymore (only UltraSPARC, aka sparc64).

No SunOS compatibility (despite Theo de Raadt inventing it for NetBSD, before being copied by other BSDs).

https://marc.info/?l=openbsd-tech&m=161435521906992&w=2

> Technically there's a niche flavour of 68k that still is supported because of a very dedicated man in Japan

luna88k, while related, is not 68k.

https://www.openbsd.org/luna88k.html

Post reply on HN